Commit Graph

2 Commits

Author SHA1 Message Date
Chad Brubaker
08d36202da Add support for debug-overrides configuration
Debug overrides are only used if the application is debuggable in
order to help local debugging and development by trusting additional
CAs. In a non-debuggable version of the application the debug-overrides
are ignored.

Trust anchors in the debug override configuration have two key
differences from those in base-config and domain-config:
1) trust anchors in the debug-overrides are trusted for all connections
in addition to any trust anchors included in the relevant base/domain
configs.
2) By default trust anchors in the debug config override pins, as their
purpose is for connecting to non-standard servers for debugging and
testing and those servers should not be pinned in the production
configuration.

Change-Id: I15ee98eae182be0ffaa49b06bc5e1c6c3d22baee
2015-11-10 12:40:00 -08:00
Chad Brubaker
5f96702f58 Add xml source for network security configuration
XmlConfigSource parses an ApplicationConfig from an xml resource.
Currently this supports app-wide default configuration via the
base-config element, per domain via the domain-config element and
inheritance of unset properties at parse time.

Inheritance of unset properties is currently only:
domain-config -> base-config -> platform default configuration
Where the most specific value is used.
For example: If the base-config specifies trust anchors, all connections
will use those anchors except for connections to a domain which has a
domain-config that specifies trust anchors, in which case the
domain-config's trust anchors will be used. If the domain-config or
base-config don't set trust anchors, or don't exist, then the platform
default trust anchors will be used.

Nested domain-config entries, debug-overrides, and thorough
documentation of the xml format will follow in later commits.

Change-Id: I1232ff1e8079a81b340bc12e142f0889f6947aa0
2015-11-06 22:24:01 -08:00