diff --git a/tests/unit/Android.bp b/tests/unit/Android.bp index 20d457ff2c..a5d2f4ae30 100644 --- a/tests/unit/Android.bp +++ b/tests/unit/Android.bp @@ -58,14 +58,11 @@ java_defaults { filegroup { name: "non-connectivity-module-test", srcs: [ - "java/android/net/Ikev2VpnProfileTest.java", "java/android/net/IpMemoryStoreTest.java", "java/android/net/TelephonyNetworkSpecifierTest.java", - "java/android/net/VpnManagerTest.java", "java/android/net/ipmemorystore/*.java", "java/android/net/netstats/NetworkStatsDataMigrationUtilsTest.kt", "java/com/android/internal/net/NetworkUtilsInternalTest.java", - "java/com/android/internal/net/VpnProfileTest.java", "java/com/android/server/connectivity/IpConnectivityEventBuilderTest.java", "java/com/android/server/connectivity/IpConnectivityMetricsTest.java", "java/com/android/server/connectivity/MetricsTestUtil.java", diff --git a/tests/unit/java/android/net/Ikev2VpnProfileTest.java b/tests/unit/java/android/net/Ikev2VpnProfileTest.java deleted file mode 100644 index e12e961fd6..0000000000 --- a/tests/unit/java/android/net/Ikev2VpnProfileTest.java +++ /dev/null @@ -1,585 +0,0 @@ -/* - * Copyright (C) 2019 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package android.net; - -import static android.net.cts.util.IkeSessionTestUtils.CHILD_PARAMS; -import static android.net.cts.util.IkeSessionTestUtils.IKE_PARAMS_V6; -import static android.net.cts.util.IkeSessionTestUtils.getTestIkeSessionParams; - -import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2; - -import static org.junit.Assert.assertArrayEquals; -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertNotNull; -import static org.junit.Assert.assertNull; -import static org.junit.Assert.assertTrue; -import static org.junit.Assert.fail; - -import android.net.ipsec.ike.IkeKeyIdIdentification; -import android.net.ipsec.ike.IkeTunnelConnectionParams; -import android.os.Build; -import android.test.mock.MockContext; - -import androidx.test.filters.SmallTest; - -import com.android.internal.net.VpnProfile; -import com.android.internal.org.bouncycastle.x509.X509V1CertificateGenerator; -import com.android.net.module.util.ProxyUtils; -import com.android.testutils.DevSdkIgnoreRule; -import com.android.testutils.DevSdkIgnoreRunner; - -import org.junit.Before; -import org.junit.Rule; -import org.junit.Test; -import org.junit.runner.RunWith; - -import java.math.BigInteger; -import java.security.KeyPair; -import java.security.KeyPairGenerator; -import java.security.PrivateKey; -import java.security.cert.X509Certificate; -import java.util.ArrayList; -import java.util.Arrays; -import java.util.Date; -import java.util.List; -import java.util.concurrent.TimeUnit; - -import javax.security.auth.x500.X500Principal; - -/** Unit tests for {@link Ikev2VpnProfile.Builder}. */ -@SmallTest -@RunWith(DevSdkIgnoreRunner.class) -@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R) -public class Ikev2VpnProfileTest { - private static final String SERVER_ADDR_STRING = "1.2.3.4"; - private static final String IDENTITY_STRING = "Identity"; - private static final String USERNAME_STRING = "username"; - private static final String PASSWORD_STRING = "pa55w0rd"; - private static final String EXCL_LIST = "exclList"; - private static final byte[] PSK_BYTES = "preSharedKey".getBytes(); - private static final int TEST_MTU = 1300; - - @Rule - public final DevSdkIgnoreRule ignoreRule = new DevSdkIgnoreRule(); - - private final MockContext mMockContext = - new MockContext() { - @Override - public String getOpPackageName() { - return "fooPackage"; - } - }; - private final ProxyInfo mProxy = ProxyInfo.buildDirectProxy( - SERVER_ADDR_STRING, -1, ProxyUtils.exclusionStringAsList(EXCL_LIST)); - - private X509Certificate mUserCert; - private X509Certificate mServerRootCa; - private PrivateKey mPrivateKey; - - @Before - public void setUp() throws Exception { - mServerRootCa = generateRandomCertAndKeyPair().cert; - - final CertificateAndKey userCertKey = generateRandomCertAndKeyPair(); - mUserCert = userCertKey.cert; - mPrivateKey = userCertKey.key; - } - - private Ikev2VpnProfile.Builder getBuilderWithDefaultOptions() { - final Ikev2VpnProfile.Builder builder = - new Ikev2VpnProfile.Builder(SERVER_ADDR_STRING, IDENTITY_STRING); - - builder.setBypassable(true); - builder.setProxy(mProxy); - builder.setMaxMtu(TEST_MTU); - builder.setMetered(true); - - return builder; - } - - @Test - public void testBuildValidProfileWithOptions() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa); - final Ikev2VpnProfile profile = builder.build(); - assertNotNull(profile); - - // Check non-auth parameters correctly stored - assertEquals(SERVER_ADDR_STRING, profile.getServerAddr()); - assertEquals(IDENTITY_STRING, profile.getUserIdentity()); - assertEquals(mProxy, profile.getProxyInfo()); - assertTrue(profile.isBypassable()); - assertTrue(profile.isMetered()); - assertEquals(TEST_MTU, profile.getMaxMtu()); - assertEquals(Ikev2VpnProfile.DEFAULT_ALGORITHMS, profile.getAllowedAlgorithms()); - } - - @Test - public void testBuildUsernamePasswordProfile() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa); - final Ikev2VpnProfile profile = builder.build(); - assertNotNull(profile); - - assertEquals(USERNAME_STRING, profile.getUsername()); - assertEquals(PASSWORD_STRING, profile.getPassword()); - assertEquals(mServerRootCa, profile.getServerRootCaCert()); - - assertNull(profile.getPresharedKey()); - assertNull(profile.getRsaPrivateKey()); - assertNull(profile.getUserCert()); - } - - @Test - public void testBuildDigitalSignatureProfile() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa); - final Ikev2VpnProfile profile = builder.build(); - assertNotNull(profile); - - assertEquals(profile.getUserCert(), mUserCert); - assertEquals(mPrivateKey, profile.getRsaPrivateKey()); - assertEquals(profile.getServerRootCaCert(), mServerRootCa); - - assertNull(profile.getPresharedKey()); - assertNull(profile.getUsername()); - assertNull(profile.getPassword()); - } - - @Test - public void testBuildPresharedKeyProfile() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthPsk(PSK_BYTES); - final Ikev2VpnProfile profile = builder.build(); - assertNotNull(profile); - - assertArrayEquals(PSK_BYTES, profile.getPresharedKey()); - - assertNull(profile.getServerRootCaCert()); - assertNull(profile.getUsername()); - assertNull(profile.getPassword()); - assertNull(profile.getRsaPrivateKey()); - assertNull(profile.getUserCert()); - } - - @Test - public void testBuildWithAllowedAlgorithmsAead() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - builder.setAuthPsk(PSK_BYTES); - - List allowedAlgorithms = - Arrays.asList( - IpSecAlgorithm.AUTH_CRYPT_AES_GCM, - IpSecAlgorithm.AUTH_CRYPT_CHACHA20_POLY1305); - builder.setAllowedAlgorithms(allowedAlgorithms); - - final Ikev2VpnProfile profile = builder.build(); - assertEquals(allowedAlgorithms, profile.getAllowedAlgorithms()); - } - - @Test - public void testBuildWithAllowedAlgorithmsNormal() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - builder.setAuthPsk(PSK_BYTES); - - List allowedAlgorithms = - Arrays.asList( - IpSecAlgorithm.AUTH_HMAC_SHA512, - IpSecAlgorithm.AUTH_AES_XCBC, - IpSecAlgorithm.AUTH_AES_CMAC, - IpSecAlgorithm.CRYPT_AES_CBC, - IpSecAlgorithm.CRYPT_AES_CTR); - builder.setAllowedAlgorithms(allowedAlgorithms); - - final Ikev2VpnProfile profile = builder.build(); - assertEquals(allowedAlgorithms, profile.getAllowedAlgorithms()); - } - - @Test - public void testSetAllowedAlgorithmsEmptyList() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - try { - builder.setAllowedAlgorithms(new ArrayList<>()); - fail("Expected exception due to no valid algorithm set"); - } catch (IllegalArgumentException expected) { - } - } - - @Test - public void testSetAllowedAlgorithmsInvalidList() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - List allowedAlgorithms = new ArrayList<>(); - - try { - builder.setAllowedAlgorithms(Arrays.asList(IpSecAlgorithm.AUTH_HMAC_SHA256)); - fail("Expected exception due to missing encryption"); - } catch (IllegalArgumentException expected) { - } - - try { - builder.setAllowedAlgorithms(Arrays.asList(IpSecAlgorithm.CRYPT_AES_CBC)); - fail("Expected exception due to missing authentication"); - } catch (IllegalArgumentException expected) { - } - } - - @Test - public void testSetAllowedAlgorithmsInsecureAlgorithm() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - List allowedAlgorithms = new ArrayList<>(); - - try { - builder.setAllowedAlgorithms(Arrays.asList(IpSecAlgorithm.AUTH_HMAC_MD5)); - fail("Expected exception due to insecure algorithm"); - } catch (IllegalArgumentException expected) { - } - - try { - builder.setAllowedAlgorithms(Arrays.asList(IpSecAlgorithm.AUTH_HMAC_SHA1)); - fail("Expected exception due to insecure algorithm"); - } catch (IllegalArgumentException expected) { - } - } - - @Test - public void testBuildNoAuthMethodSet() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - try { - builder.build(); - fail("Expected exception due to lack of auth method"); - } catch (IllegalArgumentException expected) { - } - } - - - // TODO: Refer to Build.VERSION_CODES.SC_V2 when it's available in AOSP and mainline branch - @DevSdkIgnoreRule.IgnoreUpTo(SC_V2) - @Test - public void testBuildExcludeLocalRoutesSet() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - builder.setAuthPsk(PSK_BYTES); - builder.setLocalRoutesExcluded(true); - - final Ikev2VpnProfile profile = builder.build(); - assertNotNull(profile); - assertTrue(profile.areLocalRoutesExcluded()); - - builder.setBypassable(false); - try { - builder.build(); - fail("Expected exception because excludeLocalRoutes should be set only" - + " on the bypassable VPN"); - } catch (IllegalArgumentException expected) { - } - } - - @Test - public void testBuildInvalidMtu() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - try { - builder.setMaxMtu(500); - fail("Expected exception due to too-small MTU"); - } catch (IllegalArgumentException expected) { - } - } - - private void verifyVpnProfileCommon(VpnProfile profile) { - assertEquals(SERVER_ADDR_STRING, profile.server); - assertEquals(IDENTITY_STRING, profile.ipsecIdentifier); - assertEquals(mProxy, profile.proxy); - assertTrue(profile.isBypassable); - assertTrue(profile.isMetered); - assertEquals(TEST_MTU, profile.maxMtu); - } - - @Test - public void testPskConvertToVpnProfile() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthPsk(PSK_BYTES); - final VpnProfile profile = builder.build().toVpnProfile(); - - verifyVpnProfileCommon(profile); - assertEquals(Ikev2VpnProfile.encodeForIpsecSecret(PSK_BYTES), profile.ipsecSecret); - - // Check nothing else is set - assertEquals("", profile.username); - assertEquals("", profile.password); - assertEquals("", profile.ipsecUserCert); - assertEquals("", profile.ipsecCaCert); - } - - @Test - public void testUsernamePasswordConvertToVpnProfile() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa); - final VpnProfile profile = builder.build().toVpnProfile(); - - verifyVpnProfileCommon(profile); - assertEquals(USERNAME_STRING, profile.username); - assertEquals(PASSWORD_STRING, profile.password); - assertEquals(Ikev2VpnProfile.certificateToPemString(mServerRootCa), profile.ipsecCaCert); - - // Check nothing else is set - assertEquals("", profile.ipsecUserCert); - assertEquals("", profile.ipsecSecret); - } - - @Test - public void testRsaConvertToVpnProfile() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa); - final VpnProfile profile = builder.build().toVpnProfile(); - - final String expectedSecret = Ikev2VpnProfile.PREFIX_INLINE - + Ikev2VpnProfile.encodeForIpsecSecret(mPrivateKey.getEncoded()); - verifyVpnProfileCommon(profile); - assertEquals(Ikev2VpnProfile.certificateToPemString(mUserCert), profile.ipsecUserCert); - assertEquals( - expectedSecret, - profile.ipsecSecret); - assertEquals(Ikev2VpnProfile.certificateToPemString(mServerRootCa), profile.ipsecCaCert); - - // Check nothing else is set - assertEquals("", profile.username); - assertEquals("", profile.password); - } - - @Test - public void testPskFromVpnProfileDiscardsIrrelevantValues() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthPsk(PSK_BYTES); - final VpnProfile profile = builder.build().toVpnProfile(); - profile.username = USERNAME_STRING; - profile.password = PASSWORD_STRING; - profile.ipsecCaCert = Ikev2VpnProfile.certificateToPemString(mServerRootCa); - profile.ipsecUserCert = Ikev2VpnProfile.certificateToPemString(mUserCert); - - final Ikev2VpnProfile result = Ikev2VpnProfile.fromVpnProfile(profile); - assertNull(result.getUsername()); - assertNull(result.getPassword()); - assertNull(result.getUserCert()); - assertNull(result.getRsaPrivateKey()); - assertNull(result.getServerRootCaCert()); - } - - @Test - public void testUsernamePasswordFromVpnProfileDiscardsIrrelevantValues() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa); - final VpnProfile profile = builder.build().toVpnProfile(); - profile.ipsecSecret = new String(PSK_BYTES); - profile.ipsecUserCert = Ikev2VpnProfile.certificateToPemString(mUserCert); - - final Ikev2VpnProfile result = Ikev2VpnProfile.fromVpnProfile(profile); - assertNull(result.getPresharedKey()); - assertNull(result.getUserCert()); - assertNull(result.getRsaPrivateKey()); - } - - @Test - public void testRsaFromVpnProfileDiscardsIrrelevantValues() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa); - final VpnProfile profile = builder.build().toVpnProfile(); - profile.username = USERNAME_STRING; - profile.password = PASSWORD_STRING; - - final Ikev2VpnProfile result = Ikev2VpnProfile.fromVpnProfile(profile); - assertNull(result.getUsername()); - assertNull(result.getPassword()); - assertNull(result.getPresharedKey()); - } - - @Test - public void testPskConversionIsLossless() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthPsk(PSK_BYTES); - final Ikev2VpnProfile ikeProfile = builder.build(); - - assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile())); - } - - @Test - public void testUsernamePasswordConversionIsLossless() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa); - final Ikev2VpnProfile ikeProfile = builder.build(); - - assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile())); - } - - @Test - public void testRsaConversionIsLossless() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa); - final Ikev2VpnProfile ikeProfile = builder.build(); - - assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile())); - } - - @Test - public void testBuildWithIkeTunConnParamsConvertToVpnProfile() throws Exception { - // Special keyId that contains delimiter character of VpnProfile - final byte[] keyId = "foo\0bar".getBytes(); - final IkeTunnelConnectionParams tunnelParams = new IkeTunnelConnectionParams( - getTestIkeSessionParams(true /* testIpv6 */, new IkeKeyIdIdentification(keyId)), - CHILD_PARAMS); - final Ikev2VpnProfile ikev2VpnProfile = new Ikev2VpnProfile.Builder(tunnelParams).build(); - final VpnProfile vpnProfile = ikev2VpnProfile.toVpnProfile(); - - assertEquals(VpnProfile.TYPE_IKEV2_FROM_IKE_TUN_CONN_PARAMS, vpnProfile.type); - - // Username, password, server, ipsecIdentifier, ipsecCaCert, ipsecSecret, ipsecUserCert and - // getAllowedAlgorithms should not be set if IkeTunnelConnectionParams is set. - assertEquals("", vpnProfile.server); - assertEquals("", vpnProfile.ipsecIdentifier); - assertEquals("", vpnProfile.username); - assertEquals("", vpnProfile.password); - assertEquals("", vpnProfile.ipsecCaCert); - assertEquals("", vpnProfile.ipsecSecret); - assertEquals("", vpnProfile.ipsecUserCert); - assertEquals(0, vpnProfile.getAllowedAlgorithms().size()); - - // IkeTunnelConnectionParams should stay the same. - assertEquals(tunnelParams, vpnProfile.ikeTunConnParams); - - // Convert to disk-stable format and then back to Ikev2VpnProfile should be the same. - final VpnProfile decodedVpnProfile = - VpnProfile.decode(vpnProfile.key, vpnProfile.encode()); - final Ikev2VpnProfile convertedIkev2VpnProfile = - Ikev2VpnProfile.fromVpnProfile(decodedVpnProfile); - assertEquals(ikev2VpnProfile, convertedIkev2VpnProfile); - } - - @Test - public void testConversionIsLosslessWithIkeTunConnParams() throws Exception { - final IkeTunnelConnectionParams tunnelParams = - new IkeTunnelConnectionParams(IKE_PARAMS_V6, CHILD_PARAMS); - // Config authentication related fields is not required while building with - // IkeTunnelConnectionParams. - final Ikev2VpnProfile ikeProfile = new Ikev2VpnProfile.Builder(tunnelParams).build(); - assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile())); - } - - @Test - public void testAutomaticNattAndIpVersionConversionIsLossless() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - builder.setAutomaticNattKeepaliveTimerEnabled(true); - builder.setAutomaticIpVersionSelectionEnabled(true); - - builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa); - final Ikev2VpnProfile ikeProfile = builder.build(); - - assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile())); - } - - @Test - public void testAutomaticNattAndIpVersionDefaults() throws Exception { - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - - builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa); - final Ikev2VpnProfile ikeProfile = builder.build(); - - assertEquals(false, ikeProfile.isAutomaticNattKeepaliveTimerEnabled()); - assertEquals(false, ikeProfile.isAutomaticIpVersionSelectionEnabled()); - } - - @Test - public void testEquals() throws Exception { - // Verify building without IkeTunnelConnectionParams - final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions(); - builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa); - assertEquals(builder.build(), builder.build()); - - // Verify building with IkeTunnelConnectionParams - final IkeTunnelConnectionParams tunnelParams = - new IkeTunnelConnectionParams(IKE_PARAMS_V6, CHILD_PARAMS); - final IkeTunnelConnectionParams tunnelParams2 = - new IkeTunnelConnectionParams(IKE_PARAMS_V6, CHILD_PARAMS); - assertEquals(new Ikev2VpnProfile.Builder(tunnelParams).build(), - new Ikev2VpnProfile.Builder(tunnelParams2).build()); - } - - @Test - public void testBuildProfileWithNullProxy() throws Exception { - final Ikev2VpnProfile ikev2VpnProfile = - new Ikev2VpnProfile.Builder(SERVER_ADDR_STRING, IDENTITY_STRING) - .setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa) - .build(); - - // ProxyInfo should be null for the profile without setting ProxyInfo. - assertNull(ikev2VpnProfile.getProxyInfo()); - - // ProxyInfo should stay null after performing toVpnProfile() and fromVpnProfile() - final VpnProfile vpnProfile = ikev2VpnProfile.toVpnProfile(); - assertNull(vpnProfile.proxy); - - final Ikev2VpnProfile convertedIkev2VpnProfile = Ikev2VpnProfile.fromVpnProfile(vpnProfile); - assertNull(convertedIkev2VpnProfile.getProxyInfo()); - } - - private static class CertificateAndKey { - public final X509Certificate cert; - public final PrivateKey key; - - CertificateAndKey(X509Certificate cert, PrivateKey key) { - this.cert = cert; - this.key = key; - } - } - - private static CertificateAndKey generateRandomCertAndKeyPair() throws Exception { - final Date validityBeginDate = - new Date(System.currentTimeMillis() - TimeUnit.DAYS.toMillis(1L)); - final Date validityEndDate = - new Date(System.currentTimeMillis() + TimeUnit.DAYS.toMillis(1L)); - - // Generate a keypair - final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); - keyPairGenerator.initialize(512); - final KeyPair keyPair = keyPairGenerator.generateKeyPair(); - - final X500Principal dnName = new X500Principal("CN=test.android.com"); - final X509V1CertificateGenerator certGen = new X509V1CertificateGenerator(); - certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis())); - certGen.setSubjectDN(dnName); - certGen.setIssuerDN(dnName); - certGen.setNotBefore(validityBeginDate); - certGen.setNotAfter(validityEndDate); - certGen.setPublicKey(keyPair.getPublic()); - certGen.setSignatureAlgorithm("SHA256WithRSAEncryption"); - - final X509Certificate cert = certGen.generate(keyPair.getPrivate(), "AndroidOpenSSL"); - return new CertificateAndKey(cert, keyPair.getPrivate()); - } -} diff --git a/tests/unit/java/android/net/VpnManagerTest.java b/tests/unit/java/android/net/VpnManagerTest.java deleted file mode 100644 index 2ab4e45412..0000000000 --- a/tests/unit/java/android/net/VpnManagerTest.java +++ /dev/null @@ -1,148 +0,0 @@ -/* - * Copyright (C) 2019 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package android.net; - -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertNotNull; -import static org.junit.Assert.assertNull; -import static org.junit.Assume.assumeFalse; -import static org.mockito.Matchers.any; -import static org.mockito.Matchers.eq; -import static org.mockito.Mockito.mock; -import static org.mockito.Mockito.verify; -import static org.mockito.Mockito.when; - -import android.content.ComponentName; -import android.content.Intent; -import android.content.pm.PackageManager; -import android.os.Build; -import android.test.mock.MockContext; -import android.util.SparseArray; - -import androidx.test.filters.SmallTest; -import androidx.test.InstrumentationRegistry; - -import com.android.internal.net.VpnProfile; -import com.android.internal.util.MessageUtils; -import com.android.testutils.DevSdkIgnoreRule; -import com.android.testutils.DevSdkIgnoreRunner; - -import org.junit.Before; -import org.junit.Test; -import org.junit.runner.RunWith; - -/** Unit tests for {@link VpnManager}. */ -@SmallTest -@RunWith(DevSdkIgnoreRunner.class) -@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R) -public class VpnManagerTest { - - private static final String PKG_NAME = "fooPackage"; - - private static final String SESSION_NAME_STRING = "testSession"; - private static final String SERVER_ADDR_STRING = "1.2.3.4"; - private static final String IDENTITY_STRING = "Identity"; - private static final byte[] PSK_BYTES = "preSharedKey".getBytes(); - - private IVpnManager mMockService; - private VpnManager mVpnManager; - private final MockContext mMockContext = - new MockContext() { - @Override - public String getOpPackageName() { - return PKG_NAME; - } - }; - - @Before - public void setUp() throws Exception { - assumeFalse("Skipping test because watches don't support VPN", - InstrumentationRegistry.getContext().getPackageManager().hasSystemFeature( - PackageManager.FEATURE_WATCH)); - mMockService = mock(IVpnManager.class); - mVpnManager = new VpnManager(mMockContext, mMockService); - } - - @Test - public void testProvisionVpnProfilePreconsented() throws Exception { - final PlatformVpnProfile profile = getPlatformVpnProfile(); - when(mMockService.provisionVpnProfile(any(VpnProfile.class), eq(PKG_NAME))) - .thenReturn(true); - - // Expect there to be no intent returned, as consent has already been granted. - assertNull(mVpnManager.provisionVpnProfile(profile)); - verify(mMockService).provisionVpnProfile(eq(profile.toVpnProfile()), eq(PKG_NAME)); - } - - @Test - public void testProvisionVpnProfileNeedsConsent() throws Exception { - final PlatformVpnProfile profile = getPlatformVpnProfile(); - when(mMockService.provisionVpnProfile(any(VpnProfile.class), eq(PKG_NAME))) - .thenReturn(false); - - // Expect intent to be returned, as consent has not already been granted. - final Intent intent = mVpnManager.provisionVpnProfile(profile); - assertNotNull(intent); - - final ComponentName expectedComponentName = - ComponentName.unflattenFromString( - "com.android.vpndialogs/com.android.vpndialogs.PlatformVpnConfirmDialog"); - assertEquals(expectedComponentName, intent.getComponent()); - verify(mMockService).provisionVpnProfile(eq(profile.toVpnProfile()), eq(PKG_NAME)); - } - - @Test - public void testDeleteProvisionedVpnProfile() throws Exception { - mVpnManager.deleteProvisionedVpnProfile(); - verify(mMockService).deleteVpnProfile(eq(PKG_NAME)); - } - - @Test - public void testStartProvisionedVpnProfile() throws Exception { - mVpnManager.startProvisionedVpnProfile(); - verify(mMockService).startVpnProfile(eq(PKG_NAME)); - } - - @Test - public void testStopProvisionedVpnProfile() throws Exception { - mVpnManager.stopProvisionedVpnProfile(); - verify(mMockService).stopVpnProfile(eq(PKG_NAME)); - } - - private Ikev2VpnProfile getPlatformVpnProfile() throws Exception { - return new Ikev2VpnProfile.Builder(SERVER_ADDR_STRING, IDENTITY_STRING) - .setBypassable(true) - .setMaxMtu(1300) - .setMetered(true) - .setAuthPsk(PSK_BYTES) - .build(); - } - - @Test - public void testVpnTypesEqual() throws Exception { - SparseArray vmVpnTypes = MessageUtils.findMessageNames( - new Class[] { VpnManager.class }, new String[]{ "TYPE_VPN_" }); - SparseArray nativeVpnType = MessageUtils.findMessageNames( - new Class[] { NativeVpnType.class }, new String[]{ "" }); - - // TYPE_VPN_NONE = -1 is only defined in VpnManager. - assertEquals(vmVpnTypes.size() - 1, nativeVpnType.size()); - for (int i = VpnManager.TYPE_VPN_SERVICE; i < vmVpnTypes.size(); i++) { - assertEquals(vmVpnTypes.get(i), "TYPE_VPN_" + nativeVpnType.get(i)); - } - } -} diff --git a/tests/unit/java/com/android/internal/net/VpnProfileTest.java b/tests/unit/java/com/android/internal/net/VpnProfileTest.java deleted file mode 100644 index acae7d25cd..0000000000 --- a/tests/unit/java/com/android/internal/net/VpnProfileTest.java +++ /dev/null @@ -1,323 +0,0 @@ -/* - * Copyright (C) 2019 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package com.android.internal.net; - -import static android.net.cts.util.IkeSessionTestUtils.CHILD_PARAMS; -import static android.net.cts.util.IkeSessionTestUtils.IKE_PARAMS_V4; - -import static com.android.modules.utils.build.SdkLevel.isAtLeastT; -import static com.android.modules.utils.build.SdkLevel.isAtLeastU; -import static com.android.testutils.ParcelUtils.assertParcelSane; - -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertFalse; -import static org.junit.Assert.assertNotEquals; -import static org.junit.Assert.assertNotSame; -import static org.junit.Assert.assertNull; -import static org.junit.Assert.assertTrue; - -import android.net.IpSecAlgorithm; -import android.net.ipsec.ike.IkeTunnelConnectionParams; -import android.os.Build; - -import androidx.test.filters.SmallTest; - -import com.android.testutils.DevSdkIgnoreRule; -import com.android.testutils.DevSdkIgnoreRunner; - -import org.junit.Test; -import org.junit.runner.RunWith; - -import java.util.ArrayList; -import java.util.Arrays; -import java.util.List; - -/** Unit tests for {@link VpnProfile}. */ -@SmallTest -@RunWith(DevSdkIgnoreRunner.class) -@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R) -public class VpnProfileTest { - private static final String DUMMY_PROFILE_KEY = "Test"; - - private static final int ENCODED_INDEX_AUTH_PARAMS_INLINE = 23; - private static final int ENCODED_INDEX_RESTRICTED_TO_TEST_NETWORKS = 24; - private static final int ENCODED_INDEX_EXCLUDE_LOCAL_ROUTE = 25; - private static final int ENCODED_INDEX_REQUIRE_PLATFORM_VALIDATION = 26; - private static final int ENCODED_INDEX_IKE_TUN_CONN_PARAMS = 27; - private static final int ENCODED_INDEX_AUTOMATIC_NATT_KEEPALIVE_TIMER_ENABLED = 28; - private static final int ENCODED_INDEX_AUTOMATIC_IP_VERSION_SELECTION_ENABLED = 29; - - @Test - public void testDefaults() throws Exception { - final VpnProfile p = new VpnProfile(DUMMY_PROFILE_KEY); - - assertEquals(DUMMY_PROFILE_KEY, p.key); - assertEquals("", p.name); - assertEquals(VpnProfile.TYPE_PPTP, p.type); - assertEquals("", p.server); - assertEquals("", p.username); - assertEquals("", p.password); - assertEquals("", p.dnsServers); - assertEquals("", p.searchDomains); - assertEquals("", p.routes); - assertTrue(p.mppe); - assertEquals("", p.l2tpSecret); - assertEquals("", p.ipsecIdentifier); - assertEquals("", p.ipsecSecret); - assertEquals("", p.ipsecUserCert); - assertEquals("", p.ipsecCaCert); - assertEquals("", p.ipsecServerCert); - assertEquals(null, p.proxy); - assertTrue(p.getAllowedAlgorithms() != null && p.getAllowedAlgorithms().isEmpty()); - assertFalse(p.isBypassable); - assertFalse(p.isMetered); - assertEquals(1360, p.maxMtu); - assertFalse(p.areAuthParamsInline); - assertFalse(p.isRestrictedToTestNetworks); - assertFalse(p.excludeLocalRoutes); - assertFalse(p.requiresInternetValidation); - assertFalse(p.automaticNattKeepaliveTimerEnabled); - assertFalse(p.automaticIpVersionSelectionEnabled); - } - - private VpnProfile getSampleIkev2Profile(String key) { - final VpnProfile p = new VpnProfile(key, true /* isRestrictedToTestNetworks */, - false /* excludesLocalRoutes */, true /* requiresPlatformValidation */, - null /* ikeTunConnParams */, true /* mAutomaticNattKeepaliveTimerEnabled */, - true /* automaticIpVersionSelectionEnabled */); - - p.name = "foo"; - p.type = VpnProfile.TYPE_IKEV2_IPSEC_USER_PASS; - p.server = "bar"; - p.username = "baz"; - p.password = "qux"; - p.dnsServers = "8.8.8.8"; - p.searchDomains = ""; - p.routes = "0.0.0.0/0"; - p.mppe = false; - p.l2tpSecret = ""; - p.ipsecIdentifier = "quux"; - p.ipsecSecret = "quuz"; - p.ipsecUserCert = "corge"; - p.ipsecCaCert = "grault"; - p.ipsecServerCert = "garply"; - p.proxy = null; - p.setAllowedAlgorithms( - Arrays.asList( - IpSecAlgorithm.AUTH_CRYPT_AES_GCM, - IpSecAlgorithm.AUTH_CRYPT_CHACHA20_POLY1305, - IpSecAlgorithm.AUTH_HMAC_SHA512, - IpSecAlgorithm.CRYPT_AES_CBC)); - p.isBypassable = true; - p.isMetered = true; - p.maxMtu = 1350; - p.areAuthParamsInline = true; - - // Not saved, but also not compared. - p.saveLogin = true; - - return p; - } - - private VpnProfile getSampleIkev2ProfileWithIkeTunConnParams(String key) { - final VpnProfile p = new VpnProfile(key, true /* isRestrictedToTestNetworks */, - false /* excludesLocalRoutes */, true /* requiresPlatformValidation */, - new IkeTunnelConnectionParams(IKE_PARAMS_V4, CHILD_PARAMS), - true /* mAutomaticNattKeepaliveTimerEnabled */, - true /* automaticIpVersionSelectionEnabled */); - - p.name = "foo"; - p.server = "bar"; - p.dnsServers = "8.8.8.8"; - p.searchDomains = ""; - p.routes = "0.0.0.0/0"; - p.mppe = false; - p.proxy = null; - p.setAllowedAlgorithms( - Arrays.asList( - IpSecAlgorithm.AUTH_CRYPT_AES_GCM, - IpSecAlgorithm.AUTH_CRYPT_CHACHA20_POLY1305, - IpSecAlgorithm.AUTH_HMAC_SHA512, - IpSecAlgorithm.CRYPT_AES_CBC)); - p.isBypassable = true; - p.isMetered = true; - p.maxMtu = 1350; - p.areAuthParamsInline = true; - - // Not saved, but also not compared. - p.saveLogin = true; - - return p; - } - - @Test - public void testEquals() { - assertEquals( - getSampleIkev2Profile(DUMMY_PROFILE_KEY), getSampleIkev2Profile(DUMMY_PROFILE_KEY)); - - final VpnProfile modified = getSampleIkev2Profile(DUMMY_PROFILE_KEY); - modified.maxMtu--; - assertNotEquals(getSampleIkev2Profile(DUMMY_PROFILE_KEY), modified); - } - - @Test - public void testParcelUnparcel() { - if (isAtLeastU()) { - // automaticNattKeepaliveTimerEnabled, automaticIpVersionSelectionEnabled added in U. - assertParcelSane(getSampleIkev2Profile(DUMMY_PROFILE_KEY), 28); - assertParcelSane(getSampleIkev2ProfileWithIkeTunConnParams(DUMMY_PROFILE_KEY), 28); - } else if (isAtLeastT()) { - // excludeLocalRoutes, requiresPlatformValidation were added in T. - assertParcelSane(getSampleIkev2Profile(DUMMY_PROFILE_KEY), 26); - assertParcelSane(getSampleIkev2ProfileWithIkeTunConnParams(DUMMY_PROFILE_KEY), 26); - } else { - assertParcelSane(getSampleIkev2Profile(DUMMY_PROFILE_KEY), 23); - } - } - - @Test - public void testEncodeDecodeWithIkeTunConnParams() { - final VpnProfile profile = getSampleIkev2ProfileWithIkeTunConnParams(DUMMY_PROFILE_KEY); - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, profile.encode()); - assertEquals(profile, decoded); - } - - @Test - public void testEncodeDecode() { - final VpnProfile profile = getSampleIkev2Profile(DUMMY_PROFILE_KEY); - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, profile.encode()); - assertEquals(profile, decoded); - } - - @Test - public void testEncodeDecodeTooManyValues() { - final VpnProfile profile = getSampleIkev2Profile(DUMMY_PROFILE_KEY); - final byte[] tooManyValues = - (new String(profile.encode()) + VpnProfile.VALUE_DELIMITER + "invalid").getBytes(); - - assertNull(VpnProfile.decode(DUMMY_PROFILE_KEY, tooManyValues)); - } - - private String getEncodedDecodedIkev2ProfileMissingValues(int... missingIndices) { - // Sort to ensure when we remove, we can do it from greatest first. - Arrays.sort(missingIndices); - - final String encoded = new String(getSampleIkev2Profile(DUMMY_PROFILE_KEY).encode()); - final List parts = - new ArrayList<>(Arrays.asList(encoded.split(VpnProfile.VALUE_DELIMITER))); - - // Remove from back first to ensure indexing is consistent. - for (int i = missingIndices.length - 1; i >= 0; i--) { - parts.remove(missingIndices[i]); - } - - return String.join(VpnProfile.VALUE_DELIMITER, parts.toArray(new String[0])); - } - - @Test - public void testEncodeDecodeInvalidNumberOfValues() { - final String tooFewValues = - getEncodedDecodedIkev2ProfileMissingValues( - ENCODED_INDEX_AUTH_PARAMS_INLINE, - ENCODED_INDEX_RESTRICTED_TO_TEST_NETWORKS, - ENCODED_INDEX_EXCLUDE_LOCAL_ROUTE, - ENCODED_INDEX_REQUIRE_PLATFORM_VALIDATION, - ENCODED_INDEX_IKE_TUN_CONN_PARAMS, - ENCODED_INDEX_AUTOMATIC_NATT_KEEPALIVE_TIMER_ENABLED, - ENCODED_INDEX_AUTOMATIC_IP_VERSION_SELECTION_ENABLED - /* missingIndices */); - - assertNull(VpnProfile.decode(DUMMY_PROFILE_KEY, tooFewValues.getBytes())); - } - - private String getEncodedDecodedIkev2ProfileWithtooFewValues() { - return getEncodedDecodedIkev2ProfileMissingValues( - ENCODED_INDEX_RESTRICTED_TO_TEST_NETWORKS, - ENCODED_INDEX_EXCLUDE_LOCAL_ROUTE, - ENCODED_INDEX_REQUIRE_PLATFORM_VALIDATION, - ENCODED_INDEX_IKE_TUN_CONN_PARAMS, - ENCODED_INDEX_AUTOMATIC_NATT_KEEPALIVE_TIMER_ENABLED, - ENCODED_INDEX_AUTOMATIC_IP_VERSION_SELECTION_ENABLED /* missingIndices */); - } - - @Test - public void testEncodeDecodeMissingIsRestrictedToTestNetworks() { - final String tooFewValues = getEncodedDecodedIkev2ProfileWithtooFewValues(); - - // Verify decoding without isRestrictedToTestNetworks defaults to false - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, tooFewValues.getBytes()); - assertFalse(decoded.isRestrictedToTestNetworks); - } - - @Test - public void testEncodeDecodeMissingExcludeLocalRoutes() { - final String tooFewValues = getEncodedDecodedIkev2ProfileWithtooFewValues(); - - // Verify decoding without excludeLocalRoutes defaults to false - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, tooFewValues.getBytes()); - assertFalse(decoded.excludeLocalRoutes); - } - - @Test - public void testEncodeDecodeMissingRequiresValidation() { - final String tooFewValues = getEncodedDecodedIkev2ProfileWithtooFewValues(); - - // Verify decoding without requiresValidation defaults to false - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, tooFewValues.getBytes()); - assertFalse(decoded.requiresInternetValidation); - } - - @Test - public void testEncodeDecodeMissingAutomaticNattKeepaliveTimerEnabled() { - final String tooFewValues = getEncodedDecodedIkev2ProfileWithtooFewValues(); - - // Verify decoding without automaticNattKeepaliveTimerEnabled defaults to false - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, tooFewValues.getBytes()); - assertFalse(decoded.automaticNattKeepaliveTimerEnabled); - } - - @Test - public void testEncodeDecodeMissingAutomaticIpVersionSelectionEnabled() { - final String tooFewValues = getEncodedDecodedIkev2ProfileWithtooFewValues(); - - // Verify decoding without automaticIpVersionSelectionEnabled defaults to false - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, tooFewValues.getBytes()); - assertFalse(decoded.automaticIpVersionSelectionEnabled); - } - - @Test - public void testEncodeDecodeLoginsNotSaved() { - final VpnProfile profile = getSampleIkev2Profile(DUMMY_PROFILE_KEY); - profile.saveLogin = false; - - final VpnProfile decoded = VpnProfile.decode(DUMMY_PROFILE_KEY, profile.encode()); - assertNotEquals(profile, decoded); - - // Add the username/password back, everything else must be equal. - decoded.username = profile.username; - decoded.password = profile.password; - assertEquals(profile, decoded); - } - - @Test - public void testClone() { - final VpnProfile profile = getSampleIkev2Profile(DUMMY_PROFILE_KEY); - final VpnProfile clone = profile.clone(); - assertEquals(profile, clone); - assertNotSame(profile, clone); - } -}