diff --git a/api/current.txt b/api/current.txt index 5589a14c74341..1581960852d83 100644 --- a/api/current.txt +++ b/api/current.txt @@ -31777,7 +31777,9 @@ package android.net.wifi { method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setSsidPattern(@NonNull android.os.PatternMatcher); method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa2EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa2Passphrase(@NonNull String); - method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3Enterprise192BitModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @Deprecated @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3EnterpriseStandardModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3Passphrase(@NonNull String); } @@ -31825,7 +31827,9 @@ package android.net.wifi { method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWapiPassphrase(@NonNull String); method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa2EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa2Passphrase(@NonNull String); - method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3Enterprise192BitModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @Deprecated @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3EnterpriseStandardModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3Passphrase(@NonNull String); } diff --git a/wifi/api/current.txt b/wifi/api/current.txt index f0cf75c8bf729..0bc1ff22b7042 100644 --- a/wifi/api/current.txt +++ b/wifi/api/current.txt @@ -479,7 +479,9 @@ package android.net.wifi { method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setSsidPattern(@NonNull android.os.PatternMatcher); method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa2EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa2Passphrase(@NonNull String); - method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3Enterprise192BitModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @Deprecated @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3EnterpriseStandardModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSpecifier.Builder setWpa3Passphrase(@NonNull String); } @@ -527,7 +529,9 @@ package android.net.wifi { method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWapiPassphrase(@NonNull String); method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa2EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa2Passphrase(@NonNull String); - method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3Enterprise192BitModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @Deprecated @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3EnterpriseConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); + method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3EnterpriseStandardModeConfig(@NonNull android.net.wifi.WifiEnterpriseConfig); method @NonNull public android.net.wifi.WifiNetworkSuggestion.Builder setWpa3Passphrase(@NonNull String); } diff --git a/wifi/java/android/net/wifi/WifiNetworkSpecifier.java b/wifi/java/android/net/wifi/WifiNetworkSpecifier.java index e12bb91782352..35853c0862c30 100644 --- a/wifi/java/android/net/wifi/WifiNetworkSpecifier.java +++ b/wifi/java/android/net/wifi/WifiNetworkSpecifier.java @@ -55,6 +55,16 @@ public final class WifiNetworkSpecifier extends NetworkSpecifier implements Parc private static final MacAddress MATCH_EXACT_BSSID_PATTERN_MASK = MacAddress.BROADCAST_ADDRESS; + /** + * Set WPA Enterprise type according to certificate security level. + * This is for backward compatibility in R. + */ + private static final int WPA3_ENTERPRISE_AUTO = 0; + /** Set WPA Enterprise type to standard mode only. */ + private static final int WPA3_ENTERPRISE_STANDARD = 1; + /** Set WPA Enterprise type to 192 bit mode only. */ + private static final int WPA3_ENTERPRISE_192_BIT = 2; + /** * SSID pattern match specified by the app. */ @@ -86,6 +96,10 @@ public final class WifiNetworkSpecifier extends NetworkSpecifier implements Parc * certificates and other settings associated with the WPA3-Enterprise networks. */ private @Nullable WifiEnterpriseConfig mWpa3EnterpriseConfig; + /** + * Indicate what type this WPA3-Enterprise network is. + */ + private int mWpa3EnterpriseType = WPA3_ENTERPRISE_AUTO; /** * This is a network that does not broadcast its SSID, so an * SSID-specific probe request must be used for scans. @@ -249,9 +263,14 @@ public final class WifiNetworkSpecifier extends NetworkSpecifier implements Parc * sha384WithRSAEncryption (OID 1.2.840.113549.1.1.12) or ecdsa-with-SHA384 * (OID 1.2.840.10045.4.3.3). * + * @deprecated use {@link #setWpa3EnterpriseStandardModeConfig(WifiEnterpriseConfig)} or + * {@link #setWpa3Enterprise192BitModeConfig(WifiEnterpriseConfig)} to specify + * WPA3-Enterprise type explicitly. + * * @param enterpriseConfig Instance of {@link WifiEnterpriseConfig}. * @return Instance of {@link Builder} to enable chaining of the builder method. */ + @Deprecated public @NonNull Builder setWpa3EnterpriseConfig( @NonNull WifiEnterpriseConfig enterpriseConfig) { checkNotNull(enterpriseConfig); @@ -259,6 +278,58 @@ public final class WifiNetworkSpecifier extends NetworkSpecifier implements Parc return this; } + /** + * Set the associated enterprise configuration for this network. Needed for authenticating + * to standard WPA3-Enterprise networks. See {@link WifiEnterpriseConfig} for description. + * For WPA3-Enterprise in 192-bit security mode networks, + * see {@link #setWpa3Enterprise192BitModeConfig(WifiEnterpriseConfig)} for description. + * + * @param enterpriseConfig Instance of {@link WifiEnterpriseConfig}. + * @return Instance of {@link Builder} to enable chaining of the builder method. + */ + public @NonNull Builder setWpa3EnterpriseStandardModeConfig( + @NonNull WifiEnterpriseConfig enterpriseConfig) { + checkNotNull(enterpriseConfig); + mWpa3EnterpriseConfig = new WifiEnterpriseConfig(enterpriseConfig); + mWpa3EnterpriseType = WPA3_ENTERPRISE_STANDARD; + return this; + } + + /** + * Set the associated enterprise configuration for this network. Needed for authenticating + * to WPA3-Enterprise in 192-bit security mode networks. See {@link WifiEnterpriseConfig} + * for description. Both the client and CA certificates must be provided, + * and must be of type of either sha384WithRSAEncryption with key length of 3072bit or + * more (OID 1.2.840.113549.1.1.12), or ecdsa-with-SHA384 with key length of 384bit or + * more (OID 1.2.840.10045.4.3.3). + * + * @param enterpriseConfig Instance of {@link WifiEnterpriseConfig}. + * @return Instance of {@link Builder} to enable chaining of the builder method. + * @throws IllegalArgumentException if the EAP type or certificates do not + * meet 192-bit mode requirements. + */ + public @NonNull Builder setWpa3Enterprise192BitModeConfig( + @NonNull WifiEnterpriseConfig enterpriseConfig) { + checkNotNull(enterpriseConfig); + if (enterpriseConfig.getEapMethod() != WifiEnterpriseConfig.Eap.TLS) { + throw new IllegalArgumentException("The 192-bit mode network type must be TLS"); + } + if (!WifiEnterpriseConfig.isSuiteBCipherCert( + enterpriseConfig.getClientCertificate())) { + throw new IllegalArgumentException( + "The client certificate does not meet 192-bit mode requirements."); + } + if (!WifiEnterpriseConfig.isSuiteBCipherCert( + enterpriseConfig.getCaCertificate())) { + throw new IllegalArgumentException( + "The CA certificate does not meet 192-bit mode requirements."); + } + + mWpa3EnterpriseConfig = new WifiEnterpriseConfig(enterpriseConfig); + mWpa3EnterpriseType = WPA3_ENTERPRISE_192_BIT; + return this; + } + /** * Specifies whether this represents a hidden network. *

@@ -289,12 +360,16 @@ public final class WifiNetworkSpecifier extends NetworkSpecifier implements Parc configuration.setSecurityParams(WifiConfiguration.SECURITY_TYPE_EAP); configuration.enterpriseConfig = mWpa2EnterpriseConfig; } else if (mWpa3EnterpriseConfig != null) { // WPA3-Enterprise - if (mWpa3EnterpriseConfig.getEapMethod() == WifiEnterpriseConfig.Eap.TLS + if (mWpa3EnterpriseType == WPA3_ENTERPRISE_AUTO + && mWpa3EnterpriseConfig.getEapMethod() == WifiEnterpriseConfig.Eap.TLS && WifiEnterpriseConfig.isSuiteBCipherCert( mWpa3EnterpriseConfig.getClientCertificate()) && WifiEnterpriseConfig.isSuiteBCipherCert( mWpa3EnterpriseConfig.getCaCertificate())) { - // WPA3-Enterprise in 192-bit security mode (Suite-B) + // WPA3-Enterprise in 192-bit security mode + configuration.setSecurityParams(WifiConfiguration.SECURITY_TYPE_EAP_SUITE_B); + } else if (mWpa3EnterpriseType == WPA3_ENTERPRISE_192_BIT) { + // WPA3-Enterprise in 192-bit security mode configuration.setSecurityParams(WifiConfiguration.SECURITY_TYPE_EAP_SUITE_B); } else { // WPA3-Enterprise diff --git a/wifi/java/android/net/wifi/WifiNetworkSuggestion.java b/wifi/java/android/net/wifi/WifiNetworkSuggestion.java index c1f900519fc5a..0b368708d2832 100644 --- a/wifi/java/android/net/wifi/WifiNetworkSuggestion.java +++ b/wifi/java/android/net/wifi/WifiNetworkSuggestion.java @@ -54,6 +54,16 @@ public final class WifiNetworkSuggestion implements Parcelable { public static final class Builder { private static final int UNASSIGNED_PRIORITY = -1; + /** + * Set WPA Enterprise type according to certificate security level. + * This is for backward compatibility in R. + */ + private static final int WPA3_ENTERPRISE_AUTO = 0; + /** Set WPA Enterprise type to standard mode only. */ + private static final int WPA3_ENTERPRISE_STANDARD = 1; + /** Set WPA Enterprise type to 192 bit mode only. */ + private static final int WPA3_ENTERPRISE_192_BIT = 2; + /** * SSID of the network. */ @@ -84,6 +94,10 @@ public final class WifiNetworkSuggestion implements Parcelable { * certificates and other settings associated with the WPA3-Enterprise networks. */ private @Nullable WifiEnterpriseConfig mWpa3EnterpriseConfig; + /** + * Indicate what type this WPA3-Enterprise network is. + */ + private int mWpa3EnterpriseType = WPA3_ENTERPRISE_AUTO; /** * The passpoint config for use with Hotspot 2.0 network */ @@ -311,11 +325,16 @@ public final class WifiNetworkSuggestion implements Parcelable { * sha384WithRSAEncryption (OID 1.2.840.113549.1.1.12) or ecdsa-with-SHA384 * (OID 1.2.840.10045.4.3.3). * + * @deprecated use {@link #setWpa3EnterpriseStandardModeConfig(WifiEnterpriseConfig)} or + * {@link #setWpa3Enterprise192BitModeConfig(WifiEnterpriseConfig)} to specify + * WPA3-Enterprise type explicitly. + * * @param enterpriseConfig Instance of {@link WifiEnterpriseConfig}. * @return Instance of {@link Builder} to enable chaining of the builder method. * @throws IllegalArgumentException if configuration CA certificate or * AltSubjectMatch/DomainSuffixMatch is not set. */ + @Deprecated public @NonNull Builder setWpa3EnterpriseConfig( @NonNull WifiEnterpriseConfig enterpriseConfig) { checkNotNull(enterpriseConfig); @@ -326,6 +345,63 @@ public final class WifiNetworkSuggestion implements Parcelable { return this; } + /** + * Set the associated enterprise configuration for this network. Needed for authenticating + * to WPA3-Enterprise standard networks. See {@link WifiEnterpriseConfig} for description. + * For WPA3-Enterprise in 192-bit security mode networks, + * see {@link #setWpa3Enterprise192BitModeConfig(WifiEnterpriseConfig)} for description. + * + * @param enterpriseConfig Instance of {@link WifiEnterpriseConfig}. + * @return Instance of {@link Builder} to enable chaining of the builder method. + * @throws IllegalArgumentException if configuration CA certificate or + * AltSubjectMatch/DomainSuffixMatch is not set. + */ + public @NonNull Builder setWpa3EnterpriseStandardModeConfig( + @NonNull WifiEnterpriseConfig enterpriseConfig) { + checkNotNull(enterpriseConfig); + if (enterpriseConfig.isInsecure()) { + throw new IllegalArgumentException("Enterprise configuration is insecure"); + } + mWpa3EnterpriseConfig = new WifiEnterpriseConfig(enterpriseConfig); + mWpa3EnterpriseType = WPA3_ENTERPRISE_STANDARD; + return this; + } + + /** + * Set the associated enterprise configuration for this network. Needed for authenticating + * to WPA3-Enterprise in 192-bit security mode networks. See {@link WifiEnterpriseConfig} + * for description. Both the client and CA certificates must be provided, + * and must be of type of either sha384WithRSAEncryption with key length of 3072bit or + * more (OID 1.2.840.113549.1.1.12), or ecdsa-with-SHA384 with key length of 384bit or + * more (OID 1.2.840.10045.4.3.3). + * + * @param enterpriseConfig Instance of {@link WifiEnterpriseConfig}. + * @return Instance of {@link Builder} to enable chaining of the builder method. + * @throws IllegalArgumentException if the EAP type or certificates do not + * meet 192-bit mode requirements. + */ + public @NonNull Builder setWpa3Enterprise192BitModeConfig( + @NonNull WifiEnterpriseConfig enterpriseConfig) { + checkNotNull(enterpriseConfig); + if (enterpriseConfig.getEapMethod() != WifiEnterpriseConfig.Eap.TLS) { + throw new IllegalArgumentException("The 192-bit mode network type must be TLS"); + } + if (!WifiEnterpriseConfig.isSuiteBCipherCert( + enterpriseConfig.getClientCertificate())) { + throw new IllegalArgumentException( + "The client certificate does not meet 192-bit mode requirements."); + } + if (!WifiEnterpriseConfig.isSuiteBCipherCert( + enterpriseConfig.getCaCertificate())) { + throw new IllegalArgumentException( + "The CA certificate does not meet 192-bit mode requirements."); + } + + mWpa3EnterpriseConfig = new WifiEnterpriseConfig(enterpriseConfig); + mWpa3EnterpriseType = WPA3_ENTERPRISE_192_BIT; + return this; + } + /** * Set the associated Passpoint configuration for this network. Needed for authenticating * to Hotspot 2.0 networks. See {@link PasspointConfiguration} for description. @@ -652,12 +728,16 @@ public final class WifiNetworkSuggestion implements Parcelable { configuration.setSecurityParams(WifiConfiguration.SECURITY_TYPE_EAP); configuration.enterpriseConfig = mWpa2EnterpriseConfig; } else if (mWpa3EnterpriseConfig != null) { // WPA3-Enterprise - if (mWpa3EnterpriseConfig.getEapMethod() == WifiEnterpriseConfig.Eap.TLS + if (mWpa3EnterpriseType == WPA3_ENTERPRISE_AUTO + && mWpa3EnterpriseConfig.getEapMethod() == WifiEnterpriseConfig.Eap.TLS && WifiEnterpriseConfig.isSuiteBCipherCert( mWpa3EnterpriseConfig.getClientCertificate()) && WifiEnterpriseConfig.isSuiteBCipherCert( mWpa3EnterpriseConfig.getCaCertificate())) { - // WPA3-Enterprise in 192-bit security mode (Suite-B) + // WPA3-Enterprise in 192-bit security mode + configuration.setSecurityParams(WifiConfiguration.SECURITY_TYPE_EAP_SUITE_B); + } else if (mWpa3EnterpriseType == WPA3_ENTERPRISE_192_BIT) { + // WPA3-Enterprise in 192-bit security mode configuration.setSecurityParams(WifiConfiguration.SECURITY_TYPE_EAP_SUITE_B); } else { // WPA3-Enterprise diff --git a/wifi/tests/src/android/net/wifi/WifiNetworkSpecifierTest.java b/wifi/tests/src/android/net/wifi/WifiNetworkSpecifierTest.java index 6f47f3da710fb..464f462964a04 100644 --- a/wifi/tests/src/android/net/wifi/WifiNetworkSpecifierTest.java +++ b/wifi/tests/src/android/net/wifi/WifiNetworkSpecifierTest.java @@ -141,11 +141,11 @@ public class WifiNetworkSpecifierTest { } /** - * Validate correctness of WifiNetworkSuggestion object created by - * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise network. + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise network. */ @Test - public void testWifiNetworkSuggestionBuilderForWpa3EapNetwork() { + public void testWifiNetworkSpecifierBuilderForWpa3EapNetwork() { WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); enterpriseConfig.setCaCertificate(FakeKeys.CA_CERT0); @@ -174,11 +174,118 @@ public class WifiNetworkSpecifierTest { } /** - * Validate correctness of WifiNetworkSuggestion object created by - * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise 192-bit RSA SuiteB network. + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise network. */ @Test - public void testWifiNetworkSuggestionBuilderForWpa3SuiteBRsaEapNetwork() { + public void testWifiNetworkSpecifierBuilderForWpa3EapNetworkWithStandardApi() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_CERT0); + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + NetworkSpecifier specifier = new WifiNetworkSpecifier.Builder() + .setSsid(TEST_SSID) + .setWpa3EnterpriseStandardModeConfig(enterpriseConfig) + .build(); + + assertTrue(specifier instanceof WifiNetworkSpecifier); + WifiNetworkSpecifier wifiNetworkSpecifier = (WifiNetworkSpecifier) specifier; + + assertEquals("\"" + TEST_SSID + "\"", wifiNetworkSpecifier.wifiConfiguration.SSID); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.IEEE8021X)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.WPA_EAP)); + assertFalse(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.CCMP)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.requirePmf); + assertNull(wifiNetworkSpecifier.wifiConfiguration.preSharedKey); + assertNotNull(wifiNetworkSpecifier.wifiConfiguration.enterpriseConfig); + } + + /** + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise network + * with 192-bit RSA certificates. + */ + @Test + public void testWifiNetworkSpecifierBuilderForWpa3EapNetworkWithSuiteBRsaCerts() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_RSA3072_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_RSA3072_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_RSA3072_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + NetworkSpecifier specifier = new WifiNetworkSpecifier.Builder() + .setSsid(TEST_SSID) + .setWpa3EnterpriseStandardModeConfig(enterpriseConfig) + .build(); + + assertTrue(specifier instanceof WifiNetworkSpecifier); + WifiNetworkSpecifier wifiNetworkSpecifier = (WifiNetworkSpecifier) specifier; + + assertEquals("\"" + TEST_SSID + "\"", wifiNetworkSpecifier.wifiConfiguration.SSID); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.IEEE8021X)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.WPA_EAP)); + assertFalse(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.CCMP)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.requirePmf); + assertNull(wifiNetworkSpecifier.wifiConfiguration.preSharedKey); + assertNotNull(wifiNetworkSpecifier.wifiConfiguration.enterpriseConfig); + } + + /** + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise network + * with 192-bit ECC certificates. + */ + @Test + public void testWifiNetworkSpecifierBuilderForWpa3EapNetworkWithSuiteBEccCerts() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_ECDSA_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_ECC_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_ECDSA_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + NetworkSpecifier specifier = new WifiNetworkSpecifier.Builder() + .setSsid(TEST_SSID) + .setWpa3EnterpriseStandardModeConfig(enterpriseConfig) + .build(); + + assertTrue(specifier instanceof WifiNetworkSpecifier); + WifiNetworkSpecifier wifiNetworkSpecifier = (WifiNetworkSpecifier) specifier; + + assertEquals("\"" + TEST_SSID + "\"", wifiNetworkSpecifier.wifiConfiguration.SSID); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.IEEE8021X)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.WPA_EAP)); + assertFalse(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.CCMP)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.requirePmf); + assertNull(wifiNetworkSpecifier.wifiConfiguration.preSharedKey); + assertNotNull(wifiNetworkSpecifier.wifiConfiguration.enterpriseConfig); + } + + /** + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise 192-bit RSA SuiteB network. + */ + @Test + public void testWifiNetworkSpecifierBuilderForWpa3SuiteBRsaEapNetwork() { WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_RSA3072_CERT); @@ -208,11 +315,11 @@ public class WifiNetworkSpecifierTest { } /** - * Validate correctness of WifiNetworkSuggestion object created by - * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise 192-bit ECC SuiteB network. + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise 192-bit ECC SuiteB network. */ @Test - public void testWifiNetworkSuggestionBuilderForWpa3SuiteBEccEapNetwork() { + public void testWifiNetworkSpecifierBuilderForWpa3SuiteBEccEapNetwork() { WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_ECDSA_CERT); @@ -241,6 +348,74 @@ public class WifiNetworkSpecifierTest { assertNotNull(wifiNetworkSpecifier.wifiConfiguration.enterpriseConfig); } + /** + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise 192-bit RSA SuiteB network. + */ + @Test + public void testWifiNetworkSpecifierBuilderForWpa3SuiteBRsaEapNetworkWith192BitApi() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_RSA3072_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_RSA3072_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_RSA3072_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + NetworkSpecifier specifier = new WifiNetworkSpecifier.Builder() + .setSsid(TEST_SSID) + .setWpa3Enterprise192BitModeConfig(enterpriseConfig) + .build(); + + assertTrue(specifier instanceof WifiNetworkSpecifier); + WifiNetworkSpecifier wifiNetworkSpecifier = (WifiNetworkSpecifier) specifier; + + assertEquals("\"" + TEST_SSID + "\"", wifiNetworkSpecifier.wifiConfiguration.SSID); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.GCMP_256)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedGroupManagementCiphers + .get(WifiConfiguration.GroupMgmtCipher.BIP_GMAC_256)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.requirePmf); + assertNull(wifiNetworkSpecifier.wifiConfiguration.preSharedKey); + assertNotNull(wifiNetworkSpecifier.wifiConfiguration.enterpriseConfig); + } + + /** + * Validate correctness of WifiNetworkSpecifier object created by + * {@link WifiNetworkSpecifier.Builder#build()} for WPA3-Enterprise 192-bit ECC SuiteB network. + */ + @Test + public void testWifiNetworkSpecifierBuilderForWpa3SuiteBEccEapNetworkWith192BitApi() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_ECDSA_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_ECC_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_ECDSA_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + NetworkSpecifier specifier = new WifiNetworkSpecifier.Builder() + .setSsid(TEST_SSID) + .setWpa3Enterprise192BitModeConfig(enterpriseConfig) + .build(); + + assertTrue(specifier instanceof WifiNetworkSpecifier); + WifiNetworkSpecifier wifiNetworkSpecifier = (WifiNetworkSpecifier) specifier; + + assertEquals("\"" + TEST_SSID + "\"", wifiNetworkSpecifier.wifiConfiguration.SSID); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.GCMP_256)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.allowedGroupManagementCiphers + .get(WifiConfiguration.GroupMgmtCipher.BIP_GMAC_256)); + assertTrue(wifiNetworkSpecifier.wifiConfiguration.requirePmf); + assertNull(wifiNetworkSpecifier.wifiConfiguration.preSharedKey); + assertNotNull(wifiNetworkSpecifier.wifiConfiguration.enterpriseConfig); + } + /** * Ensure {@link WifiNetworkSpecifier.Builder#setSsid(String)} throws an exception * when the string is not Unicode. @@ -430,15 +605,16 @@ public class WifiNetworkSpecifierTest { /** * Ensure {@link WifiNetworkSpecifier.Builder#build()} throws an exception * when both {@link WifiNetworkSpecifier.Builder#setWpa3Passphrase(String)} and - * {@link WifiNetworkSpecifier.Builder#setWpa3EnterpriseConfig(WifiEnterpriseConfig)} are - * invoked. + * {@link WifiNetworkSpecifier.Builder + * #setWpa3EnterpriseStandardModeConfig(WifiEnterpriseConfig)} + * are invoked. */ @Test(expected = IllegalStateException.class) public void testWifiNetworkSpecifierBuilderWithBothWpa3PasphraseAndEnterprise() { new WifiNetworkSpecifier.Builder() .setSsidPattern(new PatternMatcher(TEST_SSID, PATTERN_LITERAL)) .setWpa3Passphrase(TEST_PRESHARED_KEY) - .setWpa3EnterpriseConfig(new WifiEnterpriseConfig()) + .setWpa3EnterpriseStandardModeConfig(new WifiEnterpriseConfig()) .build(); } diff --git a/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java b/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java index 3f9ce5b675ff5..bb84120da6ed0 100644 --- a/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java +++ b/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java @@ -278,6 +278,116 @@ public class WifiNetworkSuggestionTest { assertNotNull(suggestion.getEnterpriseConfig()); } + /** + * Validate correctness of WifiNetworkSuggestion object created by + * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise standard network. + */ + @Test + public void testWifiNetworkSuggestionBuilderForWpa3EapNetworkWithStandardApi() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_CERT0); + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + WifiNetworkSuggestion suggestion = new WifiNetworkSuggestion.Builder() + .setSsid(TEST_SSID) + .setWpa3EnterpriseStandardModeConfig(enterpriseConfig) + .build(); + + assertEquals("\"" + TEST_SSID + "\"", suggestion.wifiConfiguration.SSID); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.IEEE8021X)); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.WPA_EAP)); + assertFalse(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(suggestion.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.CCMP)); + assertTrue(suggestion.wifiConfiguration.requirePmf); + assertNull(suggestion.wifiConfiguration.preSharedKey); + // allowedSuiteBCiphers are set according to the loaded certificate and cannot be tested + // here. + assertTrue(suggestion.isUserAllowedToManuallyConnect); + assertTrue(suggestion.isInitialAutoJoinEnabled); + assertNotNull(suggestion.getEnterpriseConfig()); + } + + /** + * Validate correctness of WifiNetworkSuggestion object created by + * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise network + * with 192-bit RSA SuiteB certificates. + */ + @Test + public void testWifiNetworkSuggestionBuilderForWpa3EapNetworkWithSuiteBRsaCerts() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_RSA3072_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_RSA3072_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_RSA3072_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + WifiNetworkSuggestion suggestion = new WifiNetworkSuggestion.Builder() + .setSsid(TEST_SSID) + .setWpa3EnterpriseStandardModeConfig(enterpriseConfig) + .build(); + + assertEquals("\"" + TEST_SSID + "\"", suggestion.wifiConfiguration.SSID); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.IEEE8021X)); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.WPA_EAP)); + assertFalse(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(suggestion.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.CCMP)); + assertTrue(suggestion.wifiConfiguration.requirePmf); + assertNull(suggestion.wifiConfiguration.preSharedKey); + // allowedSuiteBCiphers are set according to the loaded certificate and cannot be tested + // here. + assertTrue(suggestion.isUserAllowedToManuallyConnect); + assertTrue(suggestion.isInitialAutoJoinEnabled); + assertNotNull(suggestion.getEnterpriseConfig()); + } + + /** + * Validate correctness of WifiNetworkSuggestion object created by + * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise network + * with 192-bit ECC certificates. + */ + @Test + public void testWifiNetworkSuggestionBuilderForWpa3EapNetworkWithSuiteBEccCerts() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_ECDSA_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_ECC_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_ECDSA_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + WifiNetworkSuggestion suggestion = new WifiNetworkSuggestion.Builder() + .setSsid(TEST_SSID) + .setWpa3EnterpriseStandardModeConfig(enterpriseConfig) + .build(); + + assertEquals("\"" + TEST_SSID + "\"", suggestion.wifiConfiguration.SSID); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.IEEE8021X)); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.WPA_EAP)); + assertFalse(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(suggestion.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.CCMP)); + assertTrue(suggestion.wifiConfiguration.requirePmf); + assertNull(suggestion.wifiConfiguration.preSharedKey); + // allowedSuiteBCiphers are set according to the loaded certificate and cannot be tested + // here. + assertTrue(suggestion.isUserAllowedToManuallyConnect); + assertTrue(suggestion.isInitialAutoJoinEnabled); + assertNotNull(suggestion.getEnterpriseConfig()); + } + /** * Validate correctness of WifiNetworkSuggestion object created by * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise 192-bit RSA SuiteB network. @@ -313,6 +423,41 @@ public class WifiNetworkSuggestionTest { assertNotNull(suggestion.getEnterpriseConfig()); } + /** + * Validate correctness of WifiNetworkSuggestion object created by + * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise 192-bit RSA SuiteB network. + */ + @Test + public void testWifiNetworkSuggestionBuilderForWpa3SuiteBRsaEapNetworWith192BitApi() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_RSA3072_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_RSA3072_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_RSA3072_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + WifiNetworkSuggestion suggestion = new WifiNetworkSuggestion.Builder() + .setSsid(TEST_SSID) + .setWpa3Enterprise192BitModeConfig(enterpriseConfig) + .build(); + + assertEquals("\"" + TEST_SSID + "\"", suggestion.wifiConfiguration.SSID); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(suggestion.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.GCMP_256)); + assertTrue(suggestion.wifiConfiguration.allowedGroupManagementCiphers + .get(WifiConfiguration.GroupMgmtCipher.BIP_GMAC_256)); + assertTrue(suggestion.wifiConfiguration.requirePmf); + assertNull(suggestion.wifiConfiguration.preSharedKey); + // allowedSuiteBCiphers are set according to the loaded certificate and cannot be tested + // here. + assertTrue(suggestion.isUserAllowedToManuallyConnect); + assertTrue(suggestion.isInitialAutoJoinEnabled); + assertNotNull(suggestion.getEnterpriseConfig()); + } + /** * Validate correctness of WifiNetworkSuggestion object created by * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise 192-bit ECC SuiteB network. @@ -348,6 +493,41 @@ public class WifiNetworkSuggestionTest { assertNotNull(suggestion.getEnterpriseConfig()); } + /** + * Validate correctness of WifiNetworkSuggestion object created by + * {@link WifiNetworkSuggestion.Builder#build()} for WPA3-Enterprise 192-bit ECC SuiteB network. + */ + @Test + public void testWifiNetworkSuggestionBuilderForWpa3SuiteBEccEapNetworkWith192BitApi() { + WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig(); + enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TLS); + enterpriseConfig.setCaCertificate(FakeKeys.CA_SUITE_B_ECDSA_CERT); + enterpriseConfig.setClientKeyEntryWithCertificateChain(FakeKeys.CLIENT_SUITE_B_ECC_KEY, + new X509Certificate[] {FakeKeys.CLIENT_SUITE_B_ECDSA_CERT}); + + enterpriseConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + + WifiNetworkSuggestion suggestion = new WifiNetworkSuggestion.Builder() + .setSsid(TEST_SSID) + .setWpa3Enterprise192BitModeConfig(enterpriseConfig) + .build(); + + assertEquals("\"" + TEST_SSID + "\"", suggestion.wifiConfiguration.SSID); + assertTrue(suggestion.wifiConfiguration.allowedKeyManagement + .get(WifiConfiguration.KeyMgmt.SUITE_B_192)); + assertTrue(suggestion.wifiConfiguration.allowedGroupCiphers + .get(WifiConfiguration.GroupCipher.GCMP_256)); + assertTrue(suggestion.wifiConfiguration.allowedGroupManagementCiphers + .get(WifiConfiguration.GroupMgmtCipher.BIP_GMAC_256)); + assertTrue(suggestion.wifiConfiguration.requirePmf); + assertNull(suggestion.wifiConfiguration.preSharedKey); + // allowedSuiteBCiphers are set according to the loaded certificate and cannot be tested + // here. + assertTrue(suggestion.isUserAllowedToManuallyConnect); + assertTrue(suggestion.isInitialAutoJoinEnabled); + assertNotNull(suggestion.getEnterpriseConfig()); + } + /** * Ensure create enterprise suggestion requires CA, when CA certificate is missing, will throw * an exception. @@ -378,7 +558,7 @@ public class WifiNetworkSuggestionTest { WifiNetworkSuggestion suggestion = new WifiNetworkSuggestion.Builder() .setSsid(TEST_SSID) - .setWpa3EnterpriseConfig(enterpriseConfig) + .setWpa3EnterpriseStandardModeConfig(enterpriseConfig) .build(); } @@ -600,15 +780,16 @@ public class WifiNetworkSuggestionTest { /** * Ensure {@link WifiNetworkSuggestion.Builder#build()} throws an exception * when both {@link WifiNetworkSuggestion.Builder#setWpa3Passphrase(String)} and - * {@link WifiNetworkSuggestion.Builder#setWpa3EnterpriseConfig(WifiEnterpriseConfig)} are - * invoked. + * {@link WifiNetworkSuggestion.Builderi + * #setWpa3EnterpriseStandardModeConfig(WifiEnterpriseConfig)} + * are invoked. */ @Test(expected = IllegalStateException.class) public void testWifiNetworkSuggestionBuilderWithBothWpa3PasphraseAndEnterprise() { new WifiNetworkSuggestion.Builder() .setSsid(TEST_SSID) .setWpa3Passphrase(TEST_PRESHARED_KEY) - .setWpa3EnterpriseConfig(new WifiEnterpriseConfig()) + .setWpa3EnterpriseStandardModeConfig(new WifiEnterpriseConfig()) .build(); } @@ -670,7 +851,9 @@ public class WifiNetworkSuggestionTest { /** * Ensure {@link WifiNetworkSuggestion.Builder#build()} throws an exception - * when both {@link WifiNetworkSuggestion.Builder#setWpa3EnterpriseConfig(WifiEnterpriseConfig)} + * when both + * {@link WifiNetworkSuggestion.Builder + * #setWpa3EnterpriseStandardModeConfig(WifiEnterpriseConfig)} * and {@link WifiNetworkSuggestion.Builder#setPasspointConfig(PasspointConfiguration)} are * invoked. */ @@ -678,7 +861,7 @@ public class WifiNetworkSuggestionTest { public void testWifiNetworkSuggestionBuilderWithBothEnterpriseAndPasspointConfig() { PasspointConfiguration passpointConfiguration = PasspointTestUtils.createConfig(); new WifiNetworkSuggestion.Builder() - .setWpa3EnterpriseConfig(new WifiEnterpriseConfig()) + .setWpa3EnterpriseStandardModeConfig(new WifiEnterpriseConfig()) .setPasspointConfig(passpointConfiguration) .build(); }