LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add IPsec checks for IPSEC_TUNNEL feature

Browse Source 
This patch adds checks to ensure that the IPSEC_TUNNEL feature flag is
enabled.

Bug: 117183273
Test: Compiles & tests passing
Change-Id: I2699dda29e1eed139bc6fd1b70071e5ab33cad88
This commit is contained in:
Benedict Wong
2018-11-08 19:45:34 -08:00
parent 53578de5d1
commit d7be3aa1d2
1 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
tests/net/java/com/android/server/IpSecServiceParameterizedTest.java
View File

@@ -32,6 +32,7 @@ import static org.mockito.Mockito.when;
import android.app.AppOpsManager; import android.app.AppOpsManager;
import android.content.Context; import android.content.Context;
import android.content.pm.PackageManager;
import android.net.INetd; import android.net.INetd;
import android.net.IpSecAlgorithm; import android.net.IpSecAlgorithm;
import android.net.IpSecConfig; import android.net.IpSecConfig;
@@ -57,6 +58,7 @@ import org.junit.Test;
import org.junit.runner.RunWith; import org.junit.runner.RunWith;
import org.junit.runners.Parameterized; import org.junit.runners.Parameterized;
import java.net.Inet4Address;
import java.net.Socket; import java.net.Socket;
import java.util.Arrays; import java.util.Arrays;
import java.util.Collection; import java.util.Collection;
@@ -118,6 +120,11 @@ public class IpSecServiceParameterizedTest {
} }
} }
@Override
public PackageManager getPackageManager() {
return mMockPkgMgr;
}
@Override @Override
public void enforceCallingOrSelfPermission(String permission, String message) { public void enforceCallingOrSelfPermission(String permission, String message) {
if (permission == android.Manifest.permission.MANAGE_IPSEC_TUNNELS) { if (permission == android.Manifest.permission.MANAGE_IPSEC_TUNNELS) {
@@ -128,6 +135,7 @@ public class IpSecServiceParameterizedTest {
}; };
INetd mMockNetd; INetd mMockNetd;
PackageManager mMockPkgMgr;
IpSecService.IpSecServiceConfiguration mMockIpSecSrvConfig; IpSecService.IpSecServiceConfiguration mMockIpSecSrvConfig;
IpSecService mIpSecService; IpSecService mIpSecService;
Network fakeNetwork = new Network(0xAB); Network fakeNetwork = new Network(0xAB);
@@ -152,11 +160,16 @@ public class IpSecServiceParameterizedTest {
@Before @Before
public void setUp() throws Exception { public void setUp() throws Exception {
mMockNetd = mock(INetd.class); mMockNetd = mock(INetd.class);
mMockPkgMgr = mock(PackageManager.class);
mMockIpSecSrvConfig = mock(IpSecService.IpSecServiceConfiguration.class); mMockIpSecSrvConfig = mock(IpSecService.IpSecServiceConfiguration.class);
mIpSecService = new IpSecService(mMockContext, mMockIpSecSrvConfig); mIpSecService = new IpSecService(mMockContext, mMockIpSecSrvConfig);
// Injecting mock netd // Injecting mock netd
when(mMockIpSecSrvConfig.getNetdInstance()).thenReturn(mMockNetd); when(mMockIpSecSrvConfig.getNetdInstance()).thenReturn(mMockNetd);
// PackageManager should always return true (feature flag tests in IpSecServiceTest)
when(mMockPkgMgr.hasSystemFeature(anyString())).thenReturn(true);
// A package granted the AppOp for MANAGE_IPSEC_TUNNELS will be MODE_ALLOWED. // A package granted the AppOp for MANAGE_IPSEC_TUNNELS will be MODE_ALLOWED.
when(mMockAppOps.noteOp(anyInt(), anyInt(), eq("blessedPackage"))) when(mMockAppOps.noteOp(anyInt(), anyInt(), eq("blessedPackage")))
.thenReturn(AppOpsManager.MODE_ALLOWED); .thenReturn(AppOpsManager.MODE_ALLOWED);
@@ -709,4 +722,18 @@ public class IpSecServiceParameterizedTest {
} catch (SecurityException expected) { } catch (SecurityException expected) {
} }
} }
@Test
public void testFeatureFlagVerification() throws Exception {
when(mMockPkgMgr.hasSystemFeature(eq(PackageManager.FEATURE_IPSEC_TUNNELS)))
.thenReturn(false);
try {
String addr = Inet4Address.getLoopbackAddress().getHostAddress();
mIpSecService.createTunnelInterface(
addr, addr, new Network(0), new Binder(), "blessedPackage");
fail("Expected UnsupportedOperationException for disabled feature");
} catch (UnsupportedOperationException expected) {
}
}
} }