From 9b39089eba368fe04f6e4e56afde0c0d404623e3 Mon Sep 17 00:00:00 2001 From: Nate Jiang Date: Fri, 19 Jun 2020 14:43:00 -0700 Subject: [PATCH] Use installed keystore alias to check if enterprise config is insure Bug: 158582707 Test: atest WifiEnterpriseConfigTest Change-Id: Ic5818db5eac19b9480e1b30a8e596b176fdbee4b --- .../android/net/wifi/WifiEnterpriseConfig.java | 15 ++++++++++++--- .../net/wifi/WifiEnterpriseConfigTest.java | 7 +++++++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/wifi/java/android/net/wifi/WifiEnterpriseConfig.java b/wifi/java/android/net/wifi/WifiEnterpriseConfig.java index 7b86b084baab9..252165f5aa66c 100644 --- a/wifi/java/android/net/wifi/WifiEnterpriseConfig.java +++ b/wifi/java/android/net/wifi/WifiEnterpriseConfig.java @@ -1397,10 +1397,19 @@ public class WifiEnterpriseConfig implements Parcelable { if (mEapMethod != Eap.PEAP && mEapMethod != Eap.TLS && mEapMethod != Eap.TTLS) { return false; } - if (!mIsAppInstalledCaCert && TextUtils.isEmpty(getCaPath())) { + if (TextUtils.isEmpty(getAltSubjectMatch()) + && TextUtils.isEmpty(getDomainSuffixMatch())) { + // Both subject and domain match are not set, it's insecure. return true; } - return TextUtils.isEmpty(getAltSubjectMatch()) && TextUtils.isEmpty( - getDomainSuffixMatch()); + if (mIsAppInstalledCaCert) { + // CA certificate is installed by App, it's secure. + return false; + } + if (getCaCertificateAliases() != null) { + // CA certificate alias from keyStore is set, it's secure. + return false; + } + return TextUtils.isEmpty(getCaPath()); } } diff --git a/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java b/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java index 268645c85cae7..62485ecb6f7b7 100644 --- a/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java +++ b/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java @@ -565,6 +565,13 @@ public class WifiEnterpriseConfigTest { secureConfig.setCaCertificate(FakeKeys.CA_CERT0); secureConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); assertFalse(secureConfig.isInsecure()); + + WifiEnterpriseConfig secureConfigWithCaAlias = new WifiEnterpriseConfig(); + secureConfigWithCaAlias.setEapMethod(Eap.PEAP); + secureConfigWithCaAlias.setPhase2Method(Phase2.MSCHAPV2); + secureConfigWithCaAlias.setCaCertificateAliases(new String[]{"alias1", "alisa2"}); + secureConfigWithCaAlias.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH); + assertFalse(secureConfigWithCaAlias.isInsecure()); } }