Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b56816d5 authored by Treehugger Robot's avatar Treehugger Robot Committed by Gerrit Code Review
Browse files

Merge "Validate all INTERNET-providing VCN-managed networks"

parents f5014f43 e3f53477

common/moduleutils/src/android/net/shared/NetworkMonitorUtils.java

+15 −4
Original line number Diff line number Diff line
@@ -37,6 +37,14 @@ public class NetworkMonitorUtils { 
    // TODO: use NetworkCapabilities.TRANSPORT_TEST once NetworkStack builds against API 31.

    private static final int TRANSPORT_TEST = 7;



    // This class is used by both NetworkMonitor and ConnectivityService, so it cannot use

    // NetworkStack shims, but at the same time cannot use non-system APIs.

    // NET_CAPABILITY_NOT_VCN_MANAGED is system API as of S (so it is enforced to always be 28 and

    // can't be changed).

    // TODO: use NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED once NetworkStack builds against

    //       API 31.

    public static final int NET_CAPABILITY_NOT_VCN_MANAGED = 28;



    // Network conditions broadcast constants

    public static final String ACTION_NETWORK_CONDITIONS_MEASURED =

            "android.net.conn.NETWORK_CONDITIONS_MEASURED";
@@ -60,12 +68,15 @@ public class NetworkMonitorUtils { 
    public static boolean isPrivateDnsValidationRequired(NetworkCapabilities nc) {

        if (nc == null) return false;



        final boolean isVcnManaged = !nc.hasCapability(NET_CAPABILITY_NOT_VCN_MANAGED);

        final boolean isOemPaid = nc.hasCapability(NET_CAPABILITY_OEM_PAID)

                && nc.hasCapability(NET_CAPABILITY_TRUSTED);

        final boolean isDefaultCapable = nc.hasCapability(NET_CAPABILITY_NOT_RESTRICTED)

                && nc.hasCapability(NET_CAPABILITY_TRUSTED);



        // TODO: Consider requiring validation for DUN networks.

        if (nc.hasCapability(NET_CAPABILITY_INTERNET)

                && (nc.hasCapability(NET_CAPABILITY_NOT_RESTRICTED)

                        || nc.hasCapability(NET_CAPABILITY_OEM_PAID))

                && nc.hasCapability(NET_CAPABILITY_TRUSTED)) {

            // Real networks

                && (isVcnManaged || isOemPaid || isDefaultCapable)) {

            return true;

        }

tests/unit/src/com/android/server/connectivity/NetworkMonitorTest.java

+42 −0
Original line number Diff line number Diff line
@@ -116,6 +116,7 @@ import android.net.NetworkTestResultParcelable; 
import android.net.Uri;

import android.net.captiveportal.CaptivePortalProbeResult;

import android.net.metrics.IpConnectivityLog;

import android.net.shared.NetworkMonitorUtils;

import android.net.shared.PrivateDnsConfig;

import android.net.util.SharedLog;

import android.net.wifi.WifiInfo;
@@ -1805,6 +1806,47 @@ public class NetworkMonitorTest { 
        verify(mCleartextDnsNetwork, never()).openConnection(any());

    }



    private NetworkCapabilities getVcnUnderlyingCarrierWifiCaps() {

        // Must be called from within the test because NOT_VCN_MANAGED is an invalid capability

        // value up to Android R. Thus, this must be guarded by an SDK check in tests that use this.

        return new NetworkCapabilities.Builder()

                .addTransportType(NetworkCapabilities.TRANSPORT_WIFI)

                .removeCapability(NetworkMonitorUtils.NET_CAPABILITY_NOT_VCN_MANAGED)

                .removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)

                .removeCapability(NetworkCapabilities.NET_CAPABILITY_TRUSTED)

                .addCapability(NET_CAPABILITY_INTERNET)

                .build();

    }



    @Test

    public void testVcnUnderlyingNetwork() throws Exception {

        assumeTrue(ShimUtils.isAtLeastS());

        setStatus(mHttpsConnection, 204);

        setStatus(mHttpConnection, 204);



        final NetworkMonitor nm = runNetworkTest(

                TEST_LINK_PROPERTIES, getVcnUnderlyingCarrierWifiCaps(),

                NETWORK_VALIDATION_RESULT_VALID,

                NETWORK_VALIDATION_PROBE_DNS | NETWORK_VALIDATION_PROBE_HTTPS,

                null /* redirectUrl */);

        assertEquals(NETWORK_VALIDATION_RESULT_VALID,

                nm.getEvaluationState().getEvaluationResult());

    }



    @Test

    public void testVcnUnderlyingNetworkBadNetwork() throws Exception {

        assumeTrue(ShimUtils.isAtLeastS());

        setSslException(mHttpsConnection);

        setStatus(mHttpConnection, 500);

        setStatus(mFallbackConnection, 404);



        final NetworkMonitor nm = runNetworkTest(

                TEST_LINK_PROPERTIES, getVcnUnderlyingCarrierWifiCaps(),

                VALIDATION_RESULT_INVALID, 0 /* probesSucceeded */, null /* redirectUrl */);

        assertEquals(VALIDATION_RESULT_INVALID,

                nm.getEvaluationState().getEvaluationResult());

    }



    @Test

    public void testLaunchCaptivePortalApp() throws Exception {

        setSslException(mHttpsConnection);