From 120511dbeb20a0566c1f6eee3aa769f49fa65f8d Mon Sep 17 00:00:00 2001 From: Eran Messeri Date: Thu, 20 Sep 2018 15:15:41 +0100 Subject: [PATCH] Enterprise Policy for Private DNS Setting A new API for setting the Private DNS settings value programatically via the DevicePolicyManager. Since there are two separate settings for Private DNS, and the value provided for the hostname needs to be validated, a new DevicePolicyManager API is introduced. Only a Device Policy Client in Device Owner mode may change these settings. The DPC may additionally set a user restriction (added in a separate CL) to prevent the user from changing Private DNS settings. Bug: 112982691 Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testPrivateDnsPolicy Change-Id: I566437e4fe10e1346858149120c50b3c20ca073f --- core/java/android/net/NetworkUtils.java | 31 +++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/core/java/android/net/NetworkUtils.java b/core/java/android/net/NetworkUtils.java index 34e9476b3e..c431e40ede 100644 --- a/core/java/android/net/NetworkUtils.java +++ b/core/java/android/net/NetworkUtils.java @@ -16,8 +16,13 @@ package android.net; +import static android.system.OsConstants.AF_INET; +import static android.system.OsConstants.AF_INET6; + +import android.annotation.NonNull; import android.annotation.UnsupportedAppUsage; import android.os.Parcel; +import android.system.Os; import android.util.Log; import android.util.Pair; @@ -570,4 +575,30 @@ public class NetworkUtils { } return routedIPCount; } + + private static final int[] ADDRESS_FAMILIES = new int[] {AF_INET, AF_INET6}; + + /** + * Returns true if the hostname is weakly validated. + * @param hostname Name of host to validate. + * @return True if it's a valid-ish hostname. + * + * @hide + */ + public static boolean isWeaklyValidatedHostname(@NonNull String hostname) { + // TODO(b/34953048): Use a validation method that permits more accurate, + // but still inexpensive, checking of likely valid DNS hostnames. + final String weakHostnameRegex = "^[a-zA-Z0-9_.-]+$"; + if (!hostname.matches(weakHostnameRegex)) { + return false; + } + + for (int address_family : ADDRESS_FAMILIES) { + if (Os.inet_pton(address_family, hostname) != null) { + return false; + } + } + + return true; + } }