diff options
Diffstat (limited to 'tests/NetworkSecurityConfigTest')
5 files changed, 118 insertions, 0 deletions
diff --git a/tests/NetworkSecurityConfigTest/res/raw/test_debug_ca.pem b/tests/NetworkSecurityConfigTest/res/raw/test_debug_ca.pem new file mode 100644 index 000000000000..81648d984d64 --- /dev/null +++ b/tests/NetworkSecurityConfigTest/res/raw/test_debug_ca.pem @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDITCCAgmgAwIBAgIJAP/YiWztz/J7MA0GCSqGSIb3DQEBCwUAMCcxFjAUBgNV +BAMMDVRlc3QgZGVidWcgQ0ExDTALBgNVBAoMBEFPU1AwHhcNMTUxMTA5MjEyNjQ2 +WhcNMTgwODI5MjEyNjQ2WjAnMRYwFAYDVQQDDA1UZXN0IGRlYnVnIENBMQ0wCwYD +VQQKDARBT1NQMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuPFmkOJj +ehjfvdDr2qTcBWNqNATrW1SuM88Vj00ubUFQ4tZElozj8YnQOw1FeC79c1k88b8R +6jcqYYp/mw2JYoD6yWcFPHo5BplIpk0EhIUARH/aeoclHvsUN2GGDyTO0vf0CfJn +9Wp6lSLjyq7V/6tYdk+0cL632t56MHp8TCO+AaveYP1T8JZqx0/50xNcsK7lIqNa +ctWyRGFxR4ifdVsgkw9WhAB/Ow2uOwN9uLGqzsCd+yXW2weX52EIivoTGZfJo+U8 +Fi0ygnCHBv2jsJA7yWLhHmZ4ijsVtfutIKmN0w+DHkl6S25girXhy0zJp/1QvHGm +jaF60V1gw471jQIDAQABo1AwTjAdBgNVHQ4EFgQUoq66jncy83L5eeyW1g78s/uq +iyQwHwYDVR0jBBgwFoAUoq66jncy83L5eeyW1g78s/uqiyQwDAYDVR0TBAUwAwEB +/zANBgkqhkiG9w0BAQsFAAOCAQEAohytuH4CdX0gO8EGVDRVurRH7LO69lwd/6Iw +hJ1lIK/mzj5RM2itVGTkintyHCLu5giVkHn4FHg4X9qzZaTPOcXv9ntQNS2nacZe +bY8nfhsAhstJT4nIOWHE3FrZkMDOK6nZHIzfscX3V/VVq5MeA+WzXwmKp6MBNr+E +oUegXCGjd26Bl6SFz3rD7Qh+dzSTtyf/ECzXaMjpZu3k6fb4EgRz6vdBCHKKtpv6 +Mxcr0nLwdI6LnAGXvJLV4sj+l6Ngg00EeyorG8ATgtmsUrXXOR1e+yDCQv6fjQfs +CWYztECAUE9hfCXJwb0TBrq9YeJAvcO7iE6S0Pq+X3xNtetE1A== +-----END CERTIFICATE----- diff --git a/tests/NetworkSecurityConfigTest/res/xml/debug_basic.xml b/tests/NetworkSecurityConfigTest/res/xml/debug_basic.xml new file mode 100644 index 000000000000..8da93173e6ec --- /dev/null +++ b/tests/NetworkSecurityConfigTest/res/xml/debug_basic.xml @@ -0,0 +1,12 @@ +<?xml version="1.0" encoding="utf-8"?> +<network-security-config> + <base-config> + <trust-anchors> + </trust-anchors> + </base-config> + <debug-overrides> + <trust-anchors> + <certificates src="system" /> + </trust-anchors> + </debug-overrides> +</network-security-config> diff --git a/tests/NetworkSecurityConfigTest/res/xml/debug_domain.xml b/tests/NetworkSecurityConfigTest/res/xml/debug_domain.xml new file mode 100644 index 000000000000..24eed7a4e943 --- /dev/null +++ b/tests/NetworkSecurityConfigTest/res/xml/debug_domain.xml @@ -0,0 +1,14 @@ +<?xml version="1.0" encoding="utf-8"?> +<network-security-config> + <domain-config> + <domain>android.com</domain> + <trust-anchors> + <certificates src="@raw/ca_certs_pem" /> + </trust-anchors> + </domain-config> + <debug-overrides> + <trust-anchors> + <certificates src="@raw/test_debug_ca" /> + </trust-anchors> + </debug-overrides> +</network-security-config> diff --git a/tests/NetworkSecurityConfigTest/res/xml/debug_inherit.xml b/tests/NetworkSecurityConfigTest/res/xml/debug_inherit.xml new file mode 100644 index 000000000000..ce0cbc874ca6 --- /dev/null +++ b/tests/NetworkSecurityConfigTest/res/xml/debug_inherit.xml @@ -0,0 +1,8 @@ +<?xml version="1.0" encoding="utf-8"?> +<network-security-config> + <debug-overrides> + <trust-anchors> + <certificates src="@raw/test_debug_ca" /> + </trust-anchors> + </debug-overrides> +</network-security-config> diff --git a/tests/NetworkSecurityConfigTest/src/android/security/net/config/XmlConfigTests.java b/tests/NetworkSecurityConfigTest/src/android/security/net/config/XmlConfigTests.java index f52a27995854..43fa830f733e 100644 --- a/tests/NetworkSecurityConfigTest/src/android/security/net/config/XmlConfigTests.java +++ b/tests/NetworkSecurityConfigTest/src/android/security/net/config/XmlConfigTests.java @@ -26,6 +26,7 @@ import java.net.Socket; import java.net.URL; import java.util.ArrayList; import java.util.Collections; +import java.util.Set; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLHandshakeException; @@ -33,6 +34,8 @@ import javax.net.ssl.TrustManager; public class XmlConfigTests extends AndroidTestCase { + private final static String DEBUG_CA_SUBJ = "O=AOSP, CN=Test debug CA"; + public void testEmptyConfigFile() throws Exception { XmlConfigSource source = new XmlConfigSource(getContext(), R.xml.empty_config); ApplicationConfig appConfig = new ApplicationConfig(source); @@ -274,6 +277,68 @@ public class XmlConfigTests extends AndroidTestCase { assertFalse(child.isCleartextTrafficPermitted()); } + public void testDebugOverridesDisabled() throws Exception { + XmlConfigSource source = new XmlConfigSource(getContext(), R.xml.debug_basic, false); + ApplicationConfig appConfig = new ApplicationConfig(source); + NetworkSecurityConfig config = appConfig.getConfigForHostname(""); + Set<TrustAnchor> anchors = config.getTrustAnchors(); + MoreAsserts.assertEmpty(anchors); + SSLContext context = TestUtils.getSSLContext(source); + TestUtils.assertConnectionFails(context, "android.com", 443); + TestUtils.assertConnectionFails(context, "developer.android.com", 443); + } + + public void testBasicDebugOverrides() throws Exception { + XmlConfigSource source = new XmlConfigSource(getContext(), R.xml.debug_basic, true); + ApplicationConfig appConfig = new ApplicationConfig(source); + NetworkSecurityConfig config = appConfig.getConfigForHostname(""); + Set<TrustAnchor> anchors = config.getTrustAnchors(); + MoreAsserts.assertNotEmpty(anchors); + for (TrustAnchor anchor : anchors) { + assertTrue(anchor.overridesPins); + } + SSLContext context = TestUtils.getSSLContext(source); + TestUtils.assertConnectionSucceeds(context, "android.com", 443); + TestUtils.assertConnectionSucceeds(context, "developer.android.com", 443); + } + + public void testDebugOverridesWithDomain() throws Exception { + XmlConfigSource source = new XmlConfigSource(getContext(), R.xml.debug_domain, true); + ApplicationConfig appConfig = new ApplicationConfig(source); + NetworkSecurityConfig config = appConfig.getConfigForHostname("android.com"); + Set<TrustAnchor> anchors = config.getTrustAnchors(); + boolean foundDebugCA = false; + for (TrustAnchor anchor : anchors) { + if (anchor.certificate.getSubjectDN().toString().equals(DEBUG_CA_SUBJ)) { + foundDebugCA = true; + assertTrue(anchor.overridesPins); + } + } + assertTrue(foundDebugCA); + SSLContext context = TestUtils.getSSLContext(source); + TestUtils.assertConnectionSucceeds(context, "android.com", 443); + TestUtils.assertConnectionSucceeds(context, "developer.android.com", 443); + } + + public void testDebugInherit() throws Exception { + XmlConfigSource source = new XmlConfigSource(getContext(), R.xml.debug_domain, true); + ApplicationConfig appConfig = new ApplicationConfig(source); + NetworkSecurityConfig config = appConfig.getConfigForHostname("android.com"); + Set<TrustAnchor> anchors = config.getTrustAnchors(); + boolean foundDebugCA = false; + for (TrustAnchor anchor : anchors) { + if (anchor.certificate.getSubjectDN().toString().equals(DEBUG_CA_SUBJ)) { + foundDebugCA = true; + assertTrue(anchor.overridesPins); + } + } + assertTrue(foundDebugCA); + assertTrue(anchors.size() > 1); + SSLContext context = TestUtils.getSSLContext(source); + TestUtils.assertConnectionSucceeds(context, "android.com", 443); + TestUtils.assertConnectionSucceeds(context, "developer.android.com", 443); + } + private void testBadConfig(int configId) throws Exception { try { XmlConfigSource source = new XmlConfigSource(getContext(), configId); |