94d31add64
This commit allows the startLegacyVpn() call to start Platform VPN profiles, allowing Settings to use the IKEv2/IPsec VPN options When using an aliased private key, the Ikev2VpnProfile.KEYSTORE_ALIAS_PREFIX must be prepended to the front of the alias. This will in turn result in the fromVpnProfile() function to pull the key from the KeyStore, as opposed to the inline-key that the VpnManager API uses. Bug: 148991741 Test: FrameworksNetTests passing, new tests added in subsequent CL Test: Manually tested Change-Id: Icbca695c353b2e12e99305676404dbf1a4495949
362 lines
14 KiB
Java
362 lines
14 KiB
Java
/*
|
|
* Copyright (C) 2019 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
package android.net;
|
|
|
|
import static org.junit.Assert.assertArrayEquals;
|
|
import static org.junit.Assert.assertEquals;
|
|
import static org.junit.Assert.assertNotNull;
|
|
import static org.junit.Assert.assertNull;
|
|
import static org.junit.Assert.assertTrue;
|
|
import static org.junit.Assert.fail;
|
|
|
|
import android.test.mock.MockContext;
|
|
|
|
import androidx.test.filters.SmallTest;
|
|
import androidx.test.runner.AndroidJUnit4;
|
|
|
|
import com.android.internal.net.VpnProfile;
|
|
import com.android.org.bouncycastle.x509.X509V1CertificateGenerator;
|
|
|
|
import org.junit.Before;
|
|
import org.junit.Test;
|
|
import org.junit.runner.RunWith;
|
|
|
|
import java.math.BigInteger;
|
|
import java.security.KeyPair;
|
|
import java.security.KeyPairGenerator;
|
|
import java.security.PrivateKey;
|
|
import java.security.cert.X509Certificate;
|
|
import java.util.Date;
|
|
import java.util.concurrent.TimeUnit;
|
|
|
|
import javax.security.auth.x500.X500Principal;
|
|
|
|
/** Unit tests for {@link Ikev2VpnProfile.Builder}. */
|
|
@SmallTest
|
|
@RunWith(AndroidJUnit4.class)
|
|
public class Ikev2VpnProfileTest {
|
|
private static final String SERVER_ADDR_STRING = "1.2.3.4";
|
|
private static final String IDENTITY_STRING = "Identity";
|
|
private static final String USERNAME_STRING = "username";
|
|
private static final String PASSWORD_STRING = "pa55w0rd";
|
|
private static final String EXCL_LIST = "exclList";
|
|
private static final byte[] PSK_BYTES = "preSharedKey".getBytes();
|
|
private static final int TEST_MTU = 1300;
|
|
|
|
private final MockContext mMockContext =
|
|
new MockContext() {
|
|
@Override
|
|
public String getOpPackageName() {
|
|
return "fooPackage";
|
|
}
|
|
};
|
|
private final ProxyInfo mProxy = new ProxyInfo(SERVER_ADDR_STRING, -1, EXCL_LIST);
|
|
|
|
private X509Certificate mUserCert;
|
|
private X509Certificate mServerRootCa;
|
|
private PrivateKey mPrivateKey;
|
|
|
|
@Before
|
|
public void setUp() throws Exception {
|
|
mServerRootCa = generateRandomCertAndKeyPair().cert;
|
|
|
|
final CertificateAndKey userCertKey = generateRandomCertAndKeyPair();
|
|
mUserCert = userCertKey.cert;
|
|
mPrivateKey = userCertKey.key;
|
|
}
|
|
|
|
private Ikev2VpnProfile.Builder getBuilderWithDefaultOptions() {
|
|
final Ikev2VpnProfile.Builder builder =
|
|
new Ikev2VpnProfile.Builder(SERVER_ADDR_STRING, IDENTITY_STRING);
|
|
|
|
builder.setBypassable(true);
|
|
builder.setProxy(mProxy);
|
|
builder.setMaxMtu(TEST_MTU);
|
|
builder.setMetered(true);
|
|
|
|
return builder;
|
|
}
|
|
|
|
@Test
|
|
public void testBuildValidProfileWithOptions() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa);
|
|
final Ikev2VpnProfile profile = builder.build();
|
|
assertNotNull(profile);
|
|
|
|
// Check non-auth parameters correctly stored
|
|
assertEquals(SERVER_ADDR_STRING, profile.getServerAddr());
|
|
assertEquals(IDENTITY_STRING, profile.getUserIdentity());
|
|
assertEquals(mProxy, profile.getProxyInfo());
|
|
assertTrue(profile.isBypassable());
|
|
assertTrue(profile.isMetered());
|
|
assertEquals(TEST_MTU, profile.getMaxMtu());
|
|
}
|
|
|
|
@Test
|
|
public void testBuildUsernamePasswordProfile() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa);
|
|
final Ikev2VpnProfile profile = builder.build();
|
|
assertNotNull(profile);
|
|
|
|
assertEquals(USERNAME_STRING, profile.getUsername());
|
|
assertEquals(PASSWORD_STRING, profile.getPassword());
|
|
assertEquals(mServerRootCa, profile.getServerRootCaCert());
|
|
|
|
assertNull(profile.getPresharedKey());
|
|
assertNull(profile.getRsaPrivateKey());
|
|
assertNull(profile.getUserCert());
|
|
}
|
|
|
|
@Test
|
|
public void testBuildDigitalSignatureProfile() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa);
|
|
final Ikev2VpnProfile profile = builder.build();
|
|
assertNotNull(profile);
|
|
|
|
assertEquals(profile.getUserCert(), mUserCert);
|
|
assertEquals(mPrivateKey, profile.getRsaPrivateKey());
|
|
assertEquals(profile.getServerRootCaCert(), mServerRootCa);
|
|
|
|
assertNull(profile.getPresharedKey());
|
|
assertNull(profile.getUsername());
|
|
assertNull(profile.getPassword());
|
|
}
|
|
|
|
@Test
|
|
public void testBuildPresharedKeyProfile() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthPsk(PSK_BYTES);
|
|
final Ikev2VpnProfile profile = builder.build();
|
|
assertNotNull(profile);
|
|
|
|
assertArrayEquals(PSK_BYTES, profile.getPresharedKey());
|
|
|
|
assertNull(profile.getServerRootCaCert());
|
|
assertNull(profile.getUsername());
|
|
assertNull(profile.getPassword());
|
|
assertNull(profile.getRsaPrivateKey());
|
|
assertNull(profile.getUserCert());
|
|
}
|
|
|
|
@Test
|
|
public void testBuildNoAuthMethodSet() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
try {
|
|
builder.build();
|
|
fail("Expected exception due to lack of auth method");
|
|
} catch (IllegalArgumentException expected) {
|
|
}
|
|
}
|
|
|
|
@Test
|
|
public void testBuildInvalidMtu() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
try {
|
|
builder.setMaxMtu(500);
|
|
fail("Expected exception due to too-small MTU");
|
|
} catch (IllegalArgumentException expected) {
|
|
}
|
|
}
|
|
|
|
private void verifyVpnProfileCommon(VpnProfile profile) {
|
|
assertEquals(SERVER_ADDR_STRING, profile.server);
|
|
assertEquals(IDENTITY_STRING, profile.ipsecIdentifier);
|
|
assertEquals(mProxy, profile.proxy);
|
|
assertTrue(profile.isBypassable);
|
|
assertTrue(profile.isMetered);
|
|
assertEquals(TEST_MTU, profile.maxMtu);
|
|
}
|
|
|
|
@Test
|
|
public void testPskConvertToVpnProfile() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthPsk(PSK_BYTES);
|
|
final VpnProfile profile = builder.build().toVpnProfile();
|
|
|
|
verifyVpnProfileCommon(profile);
|
|
assertEquals(Ikev2VpnProfile.encodeForIpsecSecret(PSK_BYTES), profile.ipsecSecret);
|
|
|
|
// Check nothing else is set
|
|
assertEquals("", profile.username);
|
|
assertEquals("", profile.password);
|
|
assertEquals("", profile.ipsecUserCert);
|
|
assertEquals("", profile.ipsecCaCert);
|
|
}
|
|
|
|
@Test
|
|
public void testUsernamePasswordConvertToVpnProfile() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa);
|
|
final VpnProfile profile = builder.build().toVpnProfile();
|
|
|
|
verifyVpnProfileCommon(profile);
|
|
assertEquals(USERNAME_STRING, profile.username);
|
|
assertEquals(PASSWORD_STRING, profile.password);
|
|
assertEquals(Ikev2VpnProfile.certificateToPemString(mServerRootCa), profile.ipsecCaCert);
|
|
|
|
// Check nothing else is set
|
|
assertEquals("", profile.ipsecUserCert);
|
|
assertEquals("", profile.ipsecSecret);
|
|
}
|
|
|
|
@Test
|
|
public void testRsaConvertToVpnProfile() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa);
|
|
final VpnProfile profile = builder.build().toVpnProfile();
|
|
|
|
final String expectedSecret = Ikev2VpnProfile.PREFIX_INLINE
|
|
+ Ikev2VpnProfile.encodeForIpsecSecret(mPrivateKey.getEncoded());
|
|
verifyVpnProfileCommon(profile);
|
|
assertEquals(Ikev2VpnProfile.certificateToPemString(mUserCert), profile.ipsecUserCert);
|
|
assertEquals(
|
|
expectedSecret,
|
|
profile.ipsecSecret);
|
|
assertEquals(Ikev2VpnProfile.certificateToPemString(mServerRootCa), profile.ipsecCaCert);
|
|
|
|
// Check nothing else is set
|
|
assertEquals("", profile.username);
|
|
assertEquals("", profile.password);
|
|
}
|
|
|
|
@Test
|
|
public void testPskFromVpnProfileDiscardsIrrelevantValues() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthPsk(PSK_BYTES);
|
|
final VpnProfile profile = builder.build().toVpnProfile();
|
|
profile.username = USERNAME_STRING;
|
|
profile.password = PASSWORD_STRING;
|
|
profile.ipsecCaCert = Ikev2VpnProfile.certificateToPemString(mServerRootCa);
|
|
profile.ipsecUserCert = Ikev2VpnProfile.certificateToPemString(mUserCert);
|
|
|
|
final Ikev2VpnProfile result = Ikev2VpnProfile.fromVpnProfile(profile);
|
|
assertNull(result.getUsername());
|
|
assertNull(result.getPassword());
|
|
assertNull(result.getUserCert());
|
|
assertNull(result.getRsaPrivateKey());
|
|
assertNull(result.getServerRootCaCert());
|
|
}
|
|
|
|
@Test
|
|
public void testUsernamePasswordFromVpnProfileDiscardsIrrelevantValues() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa);
|
|
final VpnProfile profile = builder.build().toVpnProfile();
|
|
profile.ipsecSecret = new String(PSK_BYTES);
|
|
profile.ipsecUserCert = Ikev2VpnProfile.certificateToPemString(mUserCert);
|
|
|
|
final Ikev2VpnProfile result = Ikev2VpnProfile.fromVpnProfile(profile);
|
|
assertNull(result.getPresharedKey());
|
|
assertNull(result.getUserCert());
|
|
assertNull(result.getRsaPrivateKey());
|
|
}
|
|
|
|
@Test
|
|
public void testRsaFromVpnProfileDiscardsIrrelevantValues() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa);
|
|
final VpnProfile profile = builder.build().toVpnProfile();
|
|
profile.username = USERNAME_STRING;
|
|
profile.password = PASSWORD_STRING;
|
|
|
|
final Ikev2VpnProfile result = Ikev2VpnProfile.fromVpnProfile(profile);
|
|
assertNull(result.getUsername());
|
|
assertNull(result.getPassword());
|
|
assertNull(result.getPresharedKey());
|
|
}
|
|
|
|
@Test
|
|
public void testPskConversionIsLossless() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthPsk(PSK_BYTES);
|
|
final Ikev2VpnProfile ikeProfile = builder.build();
|
|
|
|
assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile()));
|
|
}
|
|
|
|
@Test
|
|
public void testUsernamePasswordConversionIsLossless() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthUsernamePassword(USERNAME_STRING, PASSWORD_STRING, mServerRootCa);
|
|
final Ikev2VpnProfile ikeProfile = builder.build();
|
|
|
|
assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile()));
|
|
}
|
|
|
|
@Test
|
|
public void testRsaConversionIsLossless() throws Exception {
|
|
final Ikev2VpnProfile.Builder builder = getBuilderWithDefaultOptions();
|
|
|
|
builder.setAuthDigitalSignature(mUserCert, mPrivateKey, mServerRootCa);
|
|
final Ikev2VpnProfile ikeProfile = builder.build();
|
|
|
|
assertEquals(ikeProfile, Ikev2VpnProfile.fromVpnProfile(ikeProfile.toVpnProfile()));
|
|
}
|
|
|
|
private static class CertificateAndKey {
|
|
public final X509Certificate cert;
|
|
public final PrivateKey key;
|
|
|
|
CertificateAndKey(X509Certificate cert, PrivateKey key) {
|
|
this.cert = cert;
|
|
this.key = key;
|
|
}
|
|
}
|
|
|
|
private static CertificateAndKey generateRandomCertAndKeyPair() throws Exception {
|
|
final Date validityBeginDate =
|
|
new Date(System.currentTimeMillis() - TimeUnit.DAYS.toMillis(1L));
|
|
final Date validityEndDate =
|
|
new Date(System.currentTimeMillis() + TimeUnit.DAYS.toMillis(1L));
|
|
|
|
// Generate a keypair
|
|
final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
|
|
keyPairGenerator.initialize(512);
|
|
final KeyPair keyPair = keyPairGenerator.generateKeyPair();
|
|
|
|
final X500Principal dnName = new X500Principal("CN=test.android.com");
|
|
final X509V1CertificateGenerator certGen = new X509V1CertificateGenerator();
|
|
certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
|
|
certGen.setSubjectDN(dnName);
|
|
certGen.setIssuerDN(dnName);
|
|
certGen.setNotBefore(validityBeginDate);
|
|
certGen.setNotAfter(validityEndDate);
|
|
certGen.setPublicKey(keyPair.getPublic());
|
|
certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");
|
|
|
|
final X509Certificate cert = certGen.generate(keyPair.getPrivate(), "AndroidOpenSSL");
|
|
return new CertificateAndKey(cert, keyPair.getPrivate());
|
|
}
|
|
}
|