Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74c2a01f authored by Mike Yu's avatar Mike Yu Committed by android-build-merger
Browse files

Add the test for nat64 prefix discovery bypass tls 

am: 76256d0679

Change-Id: Id7b7c439f8daa609db59eb56115f422f4411ad8b
parents 00c38239 f14e1a98

dns_responder/dns_tls_frontend.h

+1 −0
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ public: 
    bool startServer();

    bool stopServer();

    int queries() const { return queries_; }

    void clearQueries() { queries_ = 0; }

    bool waitForQueries(int number, int timeoutMs) const;

    void set_chain_length(int length) { chain_length_ = length; }

    // Represents a fingerprint from the middle of the certificate chain.

resolver_test.cpp

+46 −1
Original line number Diff line number Diff line
@@ -95,7 +95,6 @@ class ResolverTest : public ::testing::Test { 


    void SetUp() { mDnsClient.SetUp(); }

    void TearDown() {

        mDnsClient.resolvService()->stopPrefix64Discovery(TEST_NETID);

        mDnsClient.TearDown();

    }
@@ -3276,3 +3275,49 @@ TEST_F(ResolverTest, GetHostByName2_Dns64QuerySpecialUseIPv4Addresses) { 
        dns.clearQueries();

    }

}



TEST_F(ResolverTest, PrefixDiscoveryBypassTls) {

    constexpr char listen_addr[] = "::1";

    constexpr char cleartext_port[] = "53";

    constexpr char tls_port[] = "853";

    constexpr char dns64_name[] = "ipv4only.arpa.";

    const std::vector<std::string> servers = {listen_addr};



    test::DNSResponder dns(listen_addr);

    StartDns(dns, {{dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"}});

    test::DnsTlsFrontend tls(listen_addr, tls_port, listen_addr, cleartext_port);

    ASSERT_TRUE(tls.startServer());



    // Setup OPPORTUNISTIC mode and wait for the validation complete.

    ASSERT_TRUE(

            mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "", {}));

    EXPECT_TRUE(tls.waitForQueries(1, 5000));

    tls.clearQueries();



    // Start NAT64 prefix discovery and wait for it complete.

    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());

    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));



    // Verify it bypassed TLS even though there's a TLS server available.

    EXPECT_EQ(0, tls.queries());

    EXPECT_EQ(1U, GetNumQueries(dns, dns64_name));



    // Restart the testing network to reset the cache.

    mDnsClient.TearDown();

    mDnsClient.SetUp();

    dns.clearQueries();



    // Setup STRICT mode and wait for the validation complete.

    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "",

                                               {base64Encode(tls.fingerprint())}));

    EXPECT_TRUE(tls.waitForQueries(1, 5000));

    tls.clearQueries();



    // Start NAT64 prefix discovery and wait for it to complete.

    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());

    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));



    // Verify it bypassed TLS despite STRICT mode.

    EXPECT_EQ(0, tls.queries());

    EXPECT_EQ(1U, GetNumQueries(dns, dns64_name));

}