diff --git a/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/ChildSessionParamsTest.java b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/ChildSessionParamsTest.java
new file mode 100644
index 0000000..7fb1b6d
--- /dev/null
+++ b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/ChildSessionParamsTest.java
@@ -0,0 +1,230 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.ipsec.ike.cts;
+
+import static android.system.OsConstants.AF_INET;
+import static android.system.OsConstants.AF_INET6;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import android.net.LinkAddress;
+import android.net.ipsec.ike.ChildSaProposal;
+import android.net.ipsec.ike.ChildSessionParams;
+import android.net.ipsec.ike.TransportModeChildSessionParams;
+import android.net.ipsec.ike.TunnelModeChildSessionParams;
+import android.net.ipsec.ike.TunnelModeChildSessionParams.ConfigRequestIpv4Address;
+import android.net.ipsec.ike.TunnelModeChildSessionParams.ConfigRequestIpv4DhcpServer;
+import android.net.ipsec.ike.TunnelModeChildSessionParams.ConfigRequestIpv4DnsServer;
+import android.net.ipsec.ike.TunnelModeChildSessionParams.ConfigRequestIpv4Netmask;
+import android.net.ipsec.ike.TunnelModeChildSessionParams.ConfigRequestIpv6Address;
+import android.net.ipsec.ike.TunnelModeChildSessionParams.ConfigRequestIpv6DnsServer;
+import android.net.ipsec.ike.TunnelModeChildSessionParams.TunnelModeChildConfigRequest;
+
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.net.Inet4Address;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+
+@RunWith(AndroidJUnit4.class)
+public class ChildSessionParamsTest extends IkeTestBase {
+    private static final int HARD_LIFETIME_SECONDS = (int) TimeUnit.HOURS.toSeconds(3L);
+    private static final int SOFT_LIFETIME_SECONDS = (int) TimeUnit.HOURS.toSeconds(1L);
+
+    // Random proposal. Content doesn't matter
+    private final ChildSaProposal mSaProposal =
+            SaProposalTest.buildChildSaProposalWithCombinedModeCipher();
+
+    private void verifyTunnelModeChildParamsWithDefaultValues(ChildSessionParams childParams) {
+        assertTrue(childParams instanceof TunnelModeChildSessionParams);
+        verifyChildParamsWithDefaultValues(childParams);
+    }
+
+    private void verifyTunnelModeChildParamsWithCustomizedValues(ChildSessionParams childParams) {
+        assertTrue(childParams instanceof TunnelModeChildSessionParams);
+        verifyChildParamsWithCustomizedValues(childParams);
+    }
+
+    private void verifyTransportModeChildParamsWithDefaultValues(ChildSessionParams childParams) {
+        assertTrue(childParams instanceof TransportModeChildSessionParams);
+        verifyChildParamsWithDefaultValues(childParams);
+    }
+
+    private void verifyTransportModeChildParamsWithCustomizedValues(
+            ChildSessionParams childParams) {
+        assertTrue(childParams instanceof TransportModeChildSessionParams);
+        verifyChildParamsWithCustomizedValues(childParams);
+    }
+
+    private void verifyChildParamsWithDefaultValues(ChildSessionParams childParams) {
+        assertEquals(Arrays.asList(mSaProposal), childParams.getSaProposals());
+
+        // Do not do assertEquals to the default values to be avoid being a change-detector test
+        assertTrue(childParams.getHardLifetimeSeconds() > childParams.getSoftLifetimeSeconds());
+        assertTrue(childParams.getSoftLifetimeSeconds() > 0);
+
+        assertEquals(
+                Arrays.asList(DEFAULT_V4_TS, DEFAULT_V6_TS),
+                childParams.getInboundTrafficSelectors());
+        assertEquals(
+                Arrays.asList(DEFAULT_V4_TS, DEFAULT_V6_TS),
+                childParams.getOutboundTrafficSelectors());
+    }
+
+    private void verifyChildParamsWithCustomizedValues(ChildSessionParams childParams) {
+        assertEquals(Arrays.asList(mSaProposal), childParams.getSaProposals());
+
+        assertEquals(HARD_LIFETIME_SECONDS, childParams.getHardLifetimeSeconds());
+        assertEquals(SOFT_LIFETIME_SECONDS, childParams.getSoftLifetimeSeconds());
+
+        assertEquals(
+                Arrays.asList(INBOUND_V4_TS, INBOUND_V6_TS),
+                childParams.getInboundTrafficSelectors());
+        assertEquals(
+                Arrays.asList(OUTBOUND_V4_TS, OUTBOUND_V6_TS),
+                childParams.getOutboundTrafficSelectors());
+    }
+
+    @Test
+    public void testBuildTransportModeParamsWithDefaultValues() {
+        TransportModeChildSessionParams childParams =
+                new TransportModeChildSessionParams.Builder().addSaProposal(mSaProposal).build();
+
+        verifyTransportModeChildParamsWithDefaultValues(childParams);
+    }
+
+    @Test
+    public void testBuildTunnelModeParamsWithDefaultValues() {
+        TunnelModeChildSessionParams childParams =
+                new TunnelModeChildSessionParams.Builder().addSaProposal(mSaProposal).build();
+
+        verifyTunnelModeChildParamsWithDefaultValues(childParams);
+        assertTrue(childParams.getConfigurationRequests().isEmpty());
+    }
+
+    @Test
+    public void testBuildTransportModeParamsWithCustomizedValues() {
+        TransportModeChildSessionParams childParams =
+                new TransportModeChildSessionParams.Builder()
+                        .addSaProposal(mSaProposal)
+                        .setLifetimeSeconds(HARD_LIFETIME_SECONDS, SOFT_LIFETIME_SECONDS)
+                        .addInboundTrafficSelectors(INBOUND_V4_TS)
+                        .addInboundTrafficSelectors(INBOUND_V6_TS)
+                        .addOutboundTrafficSelectors(OUTBOUND_V4_TS)
+                        .addOutboundTrafficSelectors(OUTBOUND_V6_TS)
+                        .build();
+
+        verifyTransportModeChildParamsWithCustomizedValues(childParams);
+    }
+
+    @Test
+    public void testBuildTunnelModeParamsWithCustomizedValues() {
+        TunnelModeChildSessionParams childParams =
+                new TunnelModeChildSessionParams.Builder()
+                        .addSaProposal(mSaProposal)
+                        .setLifetimeSeconds(HARD_LIFETIME_SECONDS, SOFT_LIFETIME_SECONDS)
+                        .addInboundTrafficSelectors(INBOUND_V4_TS)
+                        .addInboundTrafficSelectors(INBOUND_V6_TS)
+                        .addOutboundTrafficSelectors(OUTBOUND_V4_TS)
+                        .addOutboundTrafficSelectors(OUTBOUND_V6_TS)
+                        .build();
+
+        verifyTunnelModeChildParamsWithCustomizedValues(childParams);
+    }
+
+    @Test
+    public void testBuildChildSessionParamsWithConfigReq() {
+        TunnelModeChildSessionParams childParams =
+                new TunnelModeChildSessionParams.Builder()
+                        .addSaProposal(mSaProposal)
+                        .addInternalAddressRequest(AF_INET)
+                        .addInternalAddressRequest(AF_INET6)
+                        .addInternalAddressRequest(AF_INET6)
+                        .addInternalAddressRequest(IPV4_ADDRESS_REMOTE)
+                        .addInternalAddressRequest(IPV6_ADDRESS_REMOTE, IP6_PREFIX_LEN)
+                        .addInternalDnsServerRequest(AF_INET)
+                        .addInternalDnsServerRequest(AF_INET6)
+                        .addInternalDhcpServerRequest(AF_INET)
+                        .addInternalDhcpServerRequest(AF_INET)
+                        .build();
+
+        verifyTunnelModeChildParamsWithDefaultValues(childParams);
+
+        // Verify config request types and number of requests for each type
+        Map<Class<? extends TunnelModeChildConfigRequest>, Integer> expectedAttributeCounts =
+                new HashMap<>();
+        expectedAttributeCounts.put(ConfigRequestIpv4Address.class, 2);
+        expectedAttributeCounts.put(ConfigRequestIpv6Address.class, 3);
+        expectedAttributeCounts.put(ConfigRequestIpv4Netmask.class, 1);
+        expectedAttributeCounts.put(ConfigRequestIpv4DnsServer.class, 1);
+        expectedAttributeCounts.put(ConfigRequestIpv6DnsServer.class, 1);
+        expectedAttributeCounts.put(ConfigRequestIpv4DhcpServer.class, 2);
+        verifyConfigRequestTypes(expectedAttributeCounts, childParams.getConfigurationRequests());
+
+        // Verify specific IPv4 address request
+        Set<Inet4Address> expectedV4Addresses = new HashSet<>();
+        expectedV4Addresses.add(IPV4_ADDRESS_REMOTE);
+        verifySpecificV4AddrConfigReq(expectedV4Addresses, childParams);
+
+        // Verify specific IPv6 address request
+        Set<LinkAddress> expectedV6Addresses = new HashSet<>();
+        expectedV6Addresses.add(new LinkAddress(IPV6_ADDRESS_REMOTE, IP6_PREFIX_LEN));
+        verifySpecificV6AddrConfigReq(expectedV6Addresses, childParams);
+    }
+
+    protected void verifySpecificV4AddrConfigReq(
+            Set<Inet4Address> expectedAddresses, TunnelModeChildSessionParams childParams) {
+        for (TunnelModeChildConfigRequest req : childParams.getConfigurationRequests()) {
+            if (req instanceof ConfigRequestIpv4Address
+                    && ((ConfigRequestIpv4Address) req).getAddress() != null) {
+                Inet4Address address = ((ConfigRequestIpv4Address) req).getAddress();
+
+                // Fail if expectedAddresses does not contain this address
+                assertTrue(expectedAddresses.remove(address));
+            }
+        }
+
+        // Fail if any expected address is not found in result
+        assertTrue(expectedAddresses.isEmpty());
+    }
+
+    protected void verifySpecificV6AddrConfigReq(
+            Set<LinkAddress> expectedAddresses, TunnelModeChildSessionParams childParams) {
+        for (TunnelModeChildConfigRequest req : childParams.getConfigurationRequests()) {
+            if (req instanceof ConfigRequestIpv6Address
+                    && ((ConfigRequestIpv6Address) req).getAddress() != null) {
+                ConfigRequestIpv6Address ipv6AddrReq = (ConfigRequestIpv6Address) req;
+
+                // Fail if expectedAddresses does not contain this address
+                LinkAddress address =
+                        new LinkAddress(ipv6AddrReq.getAddress(), ipv6AddrReq.getPrefixLength());
+                assertTrue(expectedAddresses.remove(address));
+            }
+        }
+
+        // Fail if any expected address is not found in result
+        assertTrue(expectedAddresses.isEmpty());
+    }
+}
diff --git a/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/IkeTestBase.java b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/IkeTestBase.java
new file mode 100644
index 0000000..d3aa8d0
--- /dev/null
+++ b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/IkeTestBase.java
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.ipsec.ike.cts;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+import android.net.InetAddresses;
+import android.net.ipsec.ike.IkeTrafficSelector;
+
+import java.net.Inet4Address;
+import java.net.Inet6Address;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/** Shared parameters and util methods for testing different components of IKE */
+abstract class IkeTestBase {
+    private static final int MIN_PORT = 0;
+    private static final int MAX_PORT = 65535;
+    private static final int INBOUND_TS_START_PORT = MIN_PORT;
+    private static final int INBOUND_TS_END_PORT = 65520;
+    private static final int OUTBOUND_TS_START_PORT = 16;
+    private static final int OUTBOUND_TS_END_PORT = MAX_PORT;
+
+    static final int IP4_PREFIX_LEN = 32;
+    static final int IP6_PREFIX_LEN = 64;
+
+    static final Inet4Address IPV4_ADDRESS_LOCAL =
+            (Inet4Address) (InetAddresses.parseNumericAddress("192.0.2.100"));
+    static final Inet4Address IPV4_ADDRESS_REMOTE =
+            (Inet4Address) (InetAddresses.parseNumericAddress("198.51.100.100"));
+    static final Inet6Address IPV6_ADDRESS_LOCAL =
+            (Inet6Address) (InetAddresses.parseNumericAddress("2001:db8::100"));
+    static final Inet6Address IPV6_ADDRESS_REMOTE =
+            (Inet6Address) (InetAddresses.parseNumericAddress("2001:db8:255::100"));
+
+    static final IkeTrafficSelector DEFAULT_V4_TS =
+            new IkeTrafficSelector(
+                    MIN_PORT,
+                    MAX_PORT,
+                    InetAddresses.parseNumericAddress("0.0.0.0"),
+                    InetAddresses.parseNumericAddress("255.255.255.255"));
+    static final IkeTrafficSelector DEFAULT_V6_TS =
+            new IkeTrafficSelector(
+                    MIN_PORT,
+                    MAX_PORT,
+                    InetAddresses.parseNumericAddress("::"),
+                    InetAddresses.parseNumericAddress("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"));
+    static final IkeTrafficSelector INBOUND_V4_TS =
+            new IkeTrafficSelector(
+                    INBOUND_TS_START_PORT,
+                    INBOUND_TS_END_PORT,
+                    InetAddresses.parseNumericAddress("192.0.2.10"),
+                    InetAddresses.parseNumericAddress("192.0.2.20"));
+    static final IkeTrafficSelector OUTBOUND_V4_TS =
+            new IkeTrafficSelector(
+                    OUTBOUND_TS_START_PORT,
+                    OUTBOUND_TS_END_PORT,
+                    InetAddresses.parseNumericAddress("198.51.100.0"),
+                    InetAddresses.parseNumericAddress("198.51.100.255"));
+
+    static final IkeTrafficSelector INBOUND_V6_TS =
+            new IkeTrafficSelector(
+                    INBOUND_TS_START_PORT,
+                    INBOUND_TS_END_PORT,
+                    InetAddresses.parseNumericAddress("2001:db8::10"),
+                    InetAddresses.parseNumericAddress("2001:db8::128"));
+    static final IkeTrafficSelector OUTBOUND_V6_TS =
+            new IkeTrafficSelector(
+                    OUTBOUND_TS_START_PORT,
+                    OUTBOUND_TS_END_PORT,
+                    InetAddresses.parseNumericAddress("2001:db8:255::64"),
+                    InetAddresses.parseNumericAddress("2001:db8:255::255"));
+
+    // Verify Config requests in TunnelModeChildSessionParams and IkeSessionParams
+    <T> void verifyConfigRequestTypes(
+            Map<Class<? extends T>, Integer> expectedReqCntMap, List<? extends T> resultReqList) {
+        Map<Class<? extends T>, Integer> resultReqCntMap = new HashMap<>();
+
+        // Verify that every config request type in resultReqList is expected, and build
+        // resultReqCntMap at the same time
+        for (T resultReq : resultReqList) {
+            boolean isResultReqExpected = false;
+
+            for (Class<? extends T> expectedReqInterface : expectedReqCntMap.keySet()) {
+                if (expectedReqInterface.isInstance(resultReq)) {
+                    isResultReqExpected = true;
+
+                    resultReqCntMap.put(
+                            expectedReqInterface,
+                            resultReqCntMap.getOrDefault(expectedReqInterface, 0) + 1);
+                }
+            }
+
+            if (!isResultReqExpected) {
+                fail("Failed due to unexpected config request " + resultReq);
+            }
+        }
+
+        assertEquals(expectedReqCntMap, resultReqCntMap);
+
+        // TODO: Think of a neat way to validate both counts and values in this method. Probably can
+        // build Runnables as validators for count and values.
+    }
+}
diff --git a/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/SaProposalTest.java b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/SaProposalTest.java
index 47e8f01..e0d3be0 100644
--- a/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/SaProposalTest.java
+++ b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/SaProposalTest.java
@@ -16,15 +16,241 @@
 
 package android.net.ipsec.ike.cts;
 
+import static android.net.ipsec.ike.SaProposal.DH_GROUP_1024_BIT_MODP;
+import static android.net.ipsec.ike.SaProposal.DH_GROUP_2048_BIT_MODP;
+import static android.net.ipsec.ike.SaProposal.DH_GROUP_NONE;
+import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_3DES;
+import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_CBC;
+import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_GCM_12;
+import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_GCM_16;
+import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_GCM_8;
+import static android.net.ipsec.ike.SaProposal.INTEGRITY_ALGORITHM_AES_XCBC_96;
+import static android.net.ipsec.ike.SaProposal.INTEGRITY_ALGORITHM_HMAC_SHA1_96;
+import static android.net.ipsec.ike.SaProposal.INTEGRITY_ALGORITHM_HMAC_SHA2_256_128;
+import static android.net.ipsec.ike.SaProposal.INTEGRITY_ALGORITHM_HMAC_SHA2_384_192;
+import static android.net.ipsec.ike.SaProposal.INTEGRITY_ALGORITHM_HMAC_SHA2_512_256;
+import static android.net.ipsec.ike.SaProposal.INTEGRITY_ALGORITHM_NONE;
+import static android.net.ipsec.ike.SaProposal.KEY_LEN_AES_128;
+import static android.net.ipsec.ike.SaProposal.KEY_LEN_AES_192;
+import static android.net.ipsec.ike.SaProposal.KEY_LEN_AES_256;
+import static android.net.ipsec.ike.SaProposal.KEY_LEN_UNUSED;
+import static android.net.ipsec.ike.SaProposal.PSEUDORANDOM_FUNCTION_AES128_XCBC;
+import static android.net.ipsec.ike.SaProposal.PSEUDORANDOM_FUNCTION_HMAC_SHA1;
+import static android.net.ipsec.ike.SaProposal.PSEUDORANDOM_FUNCTION_SHA2_256;
+import static android.net.ipsec.ike.SaProposal.PSEUDORANDOM_FUNCTION_SHA2_384;
+import static android.net.ipsec.ike.SaProposal.PSEUDORANDOM_FUNCTION_SHA2_512;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import android.net.ipsec.ike.ChildSaProposal;
+import android.net.ipsec.ike.IkeSaProposal;
+import android.util.Pair;
+
 import androidx.test.ext.junit.runners.AndroidJUnit4;
 
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
 @RunWith(AndroidJUnit4.class)
 public class SaProposalTest {
-    @Test
-    public void testBuildIkeSaProposal() {
-        // TODO(b/148689509): Add real tests here
+    private static final List<Pair<Integer, Integer>> NORMAL_MODE_CIPHERS = new ArrayList<>();
+    private static final List<Pair<Integer, Integer>> COMBINED_MODE_CIPHERS = new ArrayList<>();
+    private static final List<Integer> INTEGRITY_ALGOS = new ArrayList<>();
+    private static final List<Integer> DH_GROUPS = new ArrayList<>();
+    private static final List<Integer> DH_GROUPS_WITH_NONE = new ArrayList<>();
+    private static final List<Integer> PRFS = new ArrayList<>();
+
+    static {
+        NORMAL_MODE_CIPHERS.add(new Pair<>(ENCRYPTION_ALGORITHM_3DES, KEY_LEN_UNUSED));
+        NORMAL_MODE_CIPHERS.add(new Pair<>(ENCRYPTION_ALGORITHM_AES_CBC, KEY_LEN_AES_128));
+        NORMAL_MODE_CIPHERS.add(new Pair<>(ENCRYPTION_ALGORITHM_AES_CBC, KEY_LEN_AES_192));
+        NORMAL_MODE_CIPHERS.add(new Pair<>(ENCRYPTION_ALGORITHM_AES_CBC, KEY_LEN_AES_256));
+
+        COMBINED_MODE_CIPHERS.add(new Pair<>(ENCRYPTION_ALGORITHM_AES_GCM_8, KEY_LEN_AES_128));
+        COMBINED_MODE_CIPHERS.add(new Pair<>(ENCRYPTION_ALGORITHM_AES_GCM_12, KEY_LEN_AES_192));
+        COMBINED_MODE_CIPHERS.add(new Pair<>(ENCRYPTION_ALGORITHM_AES_GCM_16, KEY_LEN_AES_256));
+
+        INTEGRITY_ALGOS.add(INTEGRITY_ALGORITHM_HMAC_SHA1_96);
+        INTEGRITY_ALGOS.add(INTEGRITY_ALGORITHM_AES_XCBC_96);
+        INTEGRITY_ALGOS.add(INTEGRITY_ALGORITHM_HMAC_SHA2_256_128);
+        INTEGRITY_ALGOS.add(INTEGRITY_ALGORITHM_HMAC_SHA2_384_192);
+        INTEGRITY_ALGOS.add(INTEGRITY_ALGORITHM_HMAC_SHA2_512_256);
+
+        DH_GROUPS.add(DH_GROUP_1024_BIT_MODP);
+        DH_GROUPS.add(DH_GROUP_2048_BIT_MODP);
+
+        DH_GROUPS_WITH_NONE.add(DH_GROUP_NONE);
+        DH_GROUPS_WITH_NONE.addAll(DH_GROUPS);
+
+        PRFS.add(PSEUDORANDOM_FUNCTION_HMAC_SHA1);
+        PRFS.add(PSEUDORANDOM_FUNCTION_AES128_XCBC);
+        PRFS.add(PSEUDORANDOM_FUNCTION_SHA2_256);
+        PRFS.add(PSEUDORANDOM_FUNCTION_SHA2_384);
+        PRFS.add(PSEUDORANDOM_FUNCTION_SHA2_512);
     }
+
+    // Package private
+    static IkeSaProposal buildIkeSaProposalWithNormalModeCipher() {
+        return buildIkeSaProposal(NORMAL_MODE_CIPHERS, INTEGRITY_ALGOS, PRFS, DH_GROUPS);
+    }
+
+    // Package private
+    static IkeSaProposal buildIkeSaProposalWithCombinedModeCipher() {
+        return buildIkeSaProposalWithCombinedModeCipher(true /* hasIntegrityNone */);
+    }
+
+    private static IkeSaProposal buildIkeSaProposalWithCombinedModeCipher(
+            boolean hasIntegrityNone) {
+        List<Integer> integerAlgos = new ArrayList<>();
+        if (hasIntegrityNone) {
+            integerAlgos.add(INTEGRITY_ALGORITHM_NONE);
+        }
+        return buildIkeSaProposal(COMBINED_MODE_CIPHERS, integerAlgos, PRFS, DH_GROUPS);
+    }
+
+    private static IkeSaProposal buildIkeSaProposal(
+            List<Pair<Integer, Integer>> ciphers,
+            List<Integer> integrityAlgos,
+            List<Integer> prfs,
+            List<Integer> dhGroups) {
+        IkeSaProposal.Builder builder = new IkeSaProposal.Builder();
+
+        for (Pair<Integer, Integer> pair : ciphers) {
+            builder.addEncryptionAlgorithm(pair.first, pair.second);
+        }
+        for (int algo : integrityAlgos) {
+            builder.addIntegrityAlgorithm(algo);
+        }
+        for (int algo : prfs) {
+            builder.addPseudorandomFunction(algo);
+        }
+        for (int algo : dhGroups) {
+            builder.addDhGroup(algo);
+        }
+
+        return builder.build();
+    }
+
+    // Package private
+    static ChildSaProposal buildChildSaProposalWithNormalModeCipher() {
+        return buildChildSaProposal(NORMAL_MODE_CIPHERS, INTEGRITY_ALGOS, DH_GROUPS_WITH_NONE);
+    }
+
+    // Package private
+    static ChildSaProposal buildChildSaProposalWithCombinedModeCipher() {
+        return buildChildSaProposalWithCombinedModeCipher(true /* hasIntegrityNone */);
+    }
+
+    private static ChildSaProposal buildChildSaProposalWithCombinedModeCipher(
+            boolean hasIntegrityNone) {
+        List<Integer> integerAlgos = new ArrayList<>();
+        if (hasIntegrityNone) {
+            integerAlgos.add(INTEGRITY_ALGORITHM_NONE);
+        }
+
+        return buildChildSaProposal(COMBINED_MODE_CIPHERS, integerAlgos, DH_GROUPS_WITH_NONE);
+    }
+
+    private static ChildSaProposal buildChildSaProposal(
+            List<Pair<Integer, Integer>> ciphers,
+            List<Integer> integrityAlgos,
+            List<Integer> dhGroups) {
+        ChildSaProposal.Builder builder = new ChildSaProposal.Builder();
+
+        for (Pair<Integer, Integer> pair : ciphers) {
+            builder.addEncryptionAlgorithm(pair.first, pair.second);
+        }
+        for (int algo : integrityAlgos) {
+            builder.addIntegrityAlgorithm(algo);
+        }
+        for (int algo : dhGroups) {
+            builder.addDhGroup(algo);
+        }
+
+        return builder.build();
+    }
+
+    // Package private
+    static ChildSaProposal buildChildSaProposalWithOnlyCiphers() {
+        return buildChildSaProposal(
+                COMBINED_MODE_CIPHERS, Collections.EMPTY_LIST, Collections.EMPTY_LIST);
+    }
+
+    @Test
+    public void testBuildIkeSaProposalWithNormalModeCipher() {
+        IkeSaProposal saProposal = buildIkeSaProposalWithNormalModeCipher();
+
+        assertEquals(NORMAL_MODE_CIPHERS, saProposal.getEncryptionAlgorithms());
+        assertEquals(INTEGRITY_ALGOS, saProposal.getIntegrityAlgorithms());
+        assertEquals(PRFS, saProposal.getPseudorandomFunctions());
+        assertEquals(DH_GROUPS, saProposal.getDhGroups());
+    }
+
+    @Test
+    public void testBuildIkeSaProposalWithCombinedModeCipher() {
+        IkeSaProposal saProposal =
+                buildIkeSaProposalWithCombinedModeCipher(false /* hasIntegrityNone */);
+
+        assertEquals(COMBINED_MODE_CIPHERS, saProposal.getEncryptionAlgorithms());
+        assertEquals(PRFS, saProposal.getPseudorandomFunctions());
+        assertEquals(DH_GROUPS, saProposal.getDhGroups());
+        assertTrue(saProposal.getIntegrityAlgorithms().isEmpty());
+    }
+
+    @Test
+    public void testBuildIkeSaProposalWithCombinedModeCipherAndIntegrityNone() {
+        IkeSaProposal saProposal =
+                buildIkeSaProposalWithCombinedModeCipher(true /* hasIntegrityNone */);
+
+        assertEquals(COMBINED_MODE_CIPHERS, saProposal.getEncryptionAlgorithms());
+        assertEquals(PRFS, saProposal.getPseudorandomFunctions());
+        assertEquals(DH_GROUPS, saProposal.getDhGroups());
+        assertEquals(Arrays.asList(INTEGRITY_ALGORITHM_NONE), saProposal.getIntegrityAlgorithms());
+    }
+
+    @Test
+    public void testBuildChildSaProposalWithNormalModeCipher() {
+        ChildSaProposal saProposal = buildChildSaProposalWithNormalModeCipher();
+
+        assertEquals(NORMAL_MODE_CIPHERS, saProposal.getEncryptionAlgorithms());
+        assertEquals(INTEGRITY_ALGOS, saProposal.getIntegrityAlgorithms());
+        assertEquals(DH_GROUPS_WITH_NONE, saProposal.getDhGroups());
+    }
+
+    @Test
+    public void testBuildChildProposalWithCombinedModeCipher() {
+        ChildSaProposal saProposal =
+                buildChildSaProposalWithCombinedModeCipher(false /* hasIntegrityNone */);
+
+        assertEquals(COMBINED_MODE_CIPHERS, saProposal.getEncryptionAlgorithms());
+        assertTrue(saProposal.getIntegrityAlgorithms().isEmpty());
+        assertEquals(DH_GROUPS_WITH_NONE, saProposal.getDhGroups());
+    }
+
+    @Test
+    public void testBuildChildProposalWithCombinedModeCipherAndIntegrityNone() {
+        ChildSaProposal saProposal =
+                buildChildSaProposalWithCombinedModeCipher(true /* hasIntegrityNone */);
+
+        assertEquals(COMBINED_MODE_CIPHERS, saProposal.getEncryptionAlgorithms());
+        assertEquals(Arrays.asList(INTEGRITY_ALGORITHM_NONE), saProposal.getIntegrityAlgorithms());
+        assertEquals(DH_GROUPS_WITH_NONE, saProposal.getDhGroups());
+    }
+
+    @Test
+    public void testBuildChildSaProposalWithOnlyCiphers() {
+        ChildSaProposal saProposal = buildChildSaProposalWithOnlyCiphers();
+
+        assertEquals(COMBINED_MODE_CIPHERS, saProposal.getEncryptionAlgorithms());
+        assertTrue(saProposal.getIntegrityAlgorithms().isEmpty());
+        assertTrue(saProposal.getDhGroups().isEmpty());
+    }
+
+    // TODO(b/148689509): Test throwing exception when algorithm combination is invalid
 }
diff --git a/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/TestNetworkUtils.java b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/TestNetworkUtils.java
new file mode 100644
index 0000000..5b08cdc
--- /dev/null
+++ b/tests/cts/net/ipsec/src/android/net/ipsec/ike/cts/TestNetworkUtils.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.ipsec.ike.cts;
+
+import static android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN;
+import static android.net.NetworkCapabilities.NET_CAPABILITY_TRUSTED;
+import static android.net.NetworkCapabilities.TRANSPORT_TEST;
+
+import android.net.ConnectivityManager;
+import android.net.Network;
+import android.net.NetworkRequest;
+import android.net.TestNetworkManager;
+import android.os.IBinder;
+import android.os.RemoteException;
+
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+
+// TODO(b/148689509): Share this class with net CTS test (e.g. IpSecManagerTunnelTest)
+public class TestNetworkUtils {
+    private static final int TIMEOUT_MS = 500;
+
+    /** Callback to receive requested test network. */
+    public static class TestNetworkCallback extends ConnectivityManager.NetworkCallback {
+        private final CompletableFuture<Network> futureNetwork = new CompletableFuture<>();
+
+        @Override
+        public void onAvailable(Network network) {
+            futureNetwork.complete(network);
+        }
+
+        public Network getNetworkBlocking() throws Exception {
+            return futureNetwork.get(TIMEOUT_MS, TimeUnit.MILLISECONDS);
+        }
+    }
+
+    /**
+     * Set up test network.
+     *
+     * <p>Caller MUST have MANAGE_TEST_NETWORKS permission to use this method.
+     *
+     * @param connMgr ConnectivityManager to request network.
+     * @param testNetworkMgr TestNetworkManager to set up test network.
+     * @param ifname the name of the interface to be used for the Network LinkProperties.
+     * @param binder a binder object guarding the lifecycle of this test network.
+     * @return TestNetworkCallback to retrieve the test network.
+     * @throws RemoteException if test network setup failed.
+     * @see android.net.TestNetworkManager
+     */
+    public static TestNetworkCallback setupAndGetTestNetwork(
+            ConnectivityManager connMgr,
+            TestNetworkManager testNetworkMgr,
+            String ifname,
+            IBinder binder)
+            throws RemoteException {
+        NetworkRequest nr =
+                new NetworkRequest.Builder()
+                        .addTransportType(TRANSPORT_TEST)
+                        .removeCapability(NET_CAPABILITY_TRUSTED)
+                        .removeCapability(NET_CAPABILITY_NOT_VPN)
+                        .setNetworkSpecifier(ifname)
+                        .build();
+
+        TestNetworkCallback cb = new TestNetworkCallback();
+        connMgr.requestNetwork(nr, cb);
+
+        // Setup the test network after network request is filed to prevent Network from being
+        // reaped due to no requests matching it.
+        testNetworkMgr.setupTestNetwork(ifname, binder);
+
+        return cb;
+    }
+}
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index fa7e138..3a52ee6 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -709,7 +709,7 @@
     @AppModeFull(reason = "Cannot get WifiManager in instant app mode")
     public void testGetMultipathPreference() throws Exception {
         final ContentResolver resolver = mContext.getContentResolver();
-        final Network network = ensureWifiConnected();
+        ensureWifiConnected();
         final String ssid = unquoteSSID(mWifiManager.getConnectionInfo().getSSID());
         final String oldMeteredSetting = getWifiMeteredStatus(ssid);
         final String oldMeteredMultipathPreference = Settings.Global.getString(
@@ -721,6 +721,10 @@
                     Integer.toString(newMeteredPreference));
             setWifiMeteredStatus(ssid, "true");
             waitForActiveNetworkMetered(true);
+            // Wifi meterness changes from unmetered to metered will disconnect and reconnect since
+            // R.
+            final Network network = mCm.getActiveNetwork();
+            assertEquals(ssid, unquoteSSID(mWifiManager.getConnectionInfo().getSSID()));
             assertEquals(mCm.getNetworkCapabilities(network).hasCapability(
                     NET_CAPABILITY_NOT_METERED), false);
             assertMultipathPreferenceIsEventually(network, initialMeteredPreference,
@@ -736,6 +740,7 @@
                     oldMeteredPreference, newMeteredPreference);
 
             setWifiMeteredStatus(ssid, "false");
+            // No disconnect from unmetered to metered.
             waitForActiveNetworkMetered(false);
             assertEquals(mCm.getNetworkCapabilities(network).hasCapability(
                     NET_CAPABILITY_NOT_METERED), true);
diff --git a/tests/cts/net/src/android/net/cts/DhcpInfoTest.java b/tests/cts/net/src/android/net/cts/DhcpInfoTest.java
deleted file mode 100644
index b8d2392..0000000
--- a/tests/cts/net/src/android/net/cts/DhcpInfoTest.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright (C) 2009 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.net.cts;
-
-import static android.net.shared.Inet4AddressUtils.inet4AddressToIntHTL;
-
-import static com.android.testutils.MiscAssertsKt.assertFieldCountEquals;
-import static com.android.testutils.ParcelUtilsKt.parcelingRoundTrip;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
-import android.annotation.Nullable;
-import android.net.DhcpInfo;
-
-import androidx.test.runner.AndroidJUnit4;
-
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import java.net.Inet4Address;
-import java.net.InetAddress;
-
-@RunWith(AndroidJUnit4.class)
-public class DhcpInfoTest {
-    private static final String STR_ADDR1 = "255.255.255.255";
-    private static final String STR_ADDR2 = "127.0.0.1";
-    private static final String STR_ADDR3 = "192.168.1.1";
-    private static final String STR_ADDR4 = "192.168.1.0";
-    private static final int LEASE_TIME = 9999;
-
-    private int ipToInteger(String ipString) throws Exception {
-        return inet4AddressToIntHTL((Inet4Address) InetAddress.getByName(ipString));
-    }
-
-    private DhcpInfo createDhcpInfoObject() throws Exception {
-        final DhcpInfo dhcpInfo = new DhcpInfo();
-        dhcpInfo.ipAddress = ipToInteger(STR_ADDR1);
-        dhcpInfo.gateway = ipToInteger(STR_ADDR2);
-        dhcpInfo.netmask = ipToInteger(STR_ADDR3);
-        dhcpInfo.dns1 = ipToInteger(STR_ADDR4);
-        dhcpInfo.dns2 = ipToInteger(STR_ADDR4);
-        dhcpInfo.serverAddress = ipToInteger(STR_ADDR2);
-        dhcpInfo.leaseDuration = LEASE_TIME;
-        return dhcpInfo;
-    }
-
-    @Test
-    public void testConstructor() {
-        new DhcpInfo();
-    }
-
-    @Test
-    public void testToString() throws Exception {
-        final String expectedDefault = "ipaddr 0.0.0.0 gateway 0.0.0.0 netmask 0.0.0.0 "
-                + "dns1 0.0.0.0 dns2 0.0.0.0 DHCP server 0.0.0.0 lease 0 seconds";
-
-        DhcpInfo dhcpInfo = new DhcpInfo();
-
-        // Test default string.
-        assertEquals(expectedDefault, dhcpInfo.toString());
-
-        dhcpInfo = createDhcpInfoObject();
-
-        final String expected = "ipaddr " + STR_ADDR1 + " gateway " + STR_ADDR2 + " netmask "
-                + STR_ADDR3 + " dns1 " + STR_ADDR4 + " dns2 " + STR_ADDR4 + " DHCP server "
-                + STR_ADDR2 + " lease " + LEASE_TIME + " seconds";
-        // Test with new values
-        assertEquals(expected, dhcpInfo.toString());
-    }
-
-    private boolean dhcpInfoEquals(@Nullable DhcpInfo left, @Nullable DhcpInfo right) {
-        if (left == null && right == null) return true;
-
-        if (left == null || right == null) return false;
-
-        return left.ipAddress == right.ipAddress
-                && left.gateway == right.gateway
-                && left.netmask == right.netmask
-                && left.dns1 == right.dns1
-                && left.dns2 == right.dns2
-                && left.serverAddress == right.serverAddress
-                && left.leaseDuration == right.leaseDuration;
-    }
-
-    @Test
-    public void testParcelDhcpInfo() throws Exception {
-        // Cannot use assertParcelSane() here because this requires .equals() to work as
-        // defined, but DhcpInfo has a different legacy behavior that we cannot change.
-        final DhcpInfo dhcpInfo = createDhcpInfoObject();
-        assertFieldCountEquals(7, DhcpInfo.class);
-
-        final DhcpInfo dhcpInfoRoundTrip = parcelingRoundTrip(dhcpInfo);
-        assertTrue(dhcpInfoEquals(null, null));
-        assertFalse(dhcpInfoEquals(null, dhcpInfoRoundTrip));
-        assertFalse(dhcpInfoEquals(dhcpInfo, null));
-        assertTrue(dhcpInfoEquals(dhcpInfo, dhcpInfoRoundTrip));
-    }
-}
diff --git a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
index 85c94e7..89d3dff 100644
--- a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
@@ -18,54 +18,113 @@
 import android.app.Instrumentation
 import android.content.Context
 import android.net.ConnectivityManager
+import android.net.KeepalivePacketData
+import android.net.LinkAddress
 import android.net.LinkProperties
+import android.net.Network
 import android.net.NetworkAgent
+import android.net.NetworkAgent.CMD_ADD_KEEPALIVE_PACKET_FILTER
+import android.net.NetworkAgent.CMD_PREVENT_AUTOMATIC_RECONNECT
+import android.net.NetworkAgent.CMD_REMOVE_KEEPALIVE_PACKET_FILTER
+import android.net.NetworkAgent.CMD_REPORT_NETWORK_STATUS
+import android.net.NetworkAgent.CMD_SAVE_ACCEPT_UNVALIDATED
+import android.net.NetworkAgent.CMD_START_SOCKET_KEEPALIVE
+import android.net.NetworkAgent.CMD_STOP_SOCKET_KEEPALIVE
+import android.net.NetworkAgent.INVALID_NETWORK
+import android.net.NetworkAgent.VALID_NETWORK
 import android.net.NetworkAgentConfig
 import android.net.NetworkCapabilities
 import android.net.NetworkProvider
 import android.net.NetworkRequest
-import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnNetworkUnwanted
+import android.net.SocketKeepalive
+import android.net.StringNetworkSpecifier
+import android.net.Uri
 import android.os.Build
+import android.os.Bundle
+import android.os.Handler
 import android.os.HandlerThread
 import android.os.Looper
+import android.os.Message
+import android.os.Messenger
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnAddKeepalivePacketFilter
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnAutomaticReconnectDisabled
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnBandwidthUpdateRequested
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnNetworkUnwanted
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnRemoveKeepalivePacketFilter
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnSaveAcceptUnvalidated
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnSignalStrengthThresholdsUpdated
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnStartSocketKeepalive
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnStopSocketKeepalive
+import android.net.cts.NetworkAgentTest.TestableNetworkAgent.CallbackEntry.OnValidationStatus
 import androidx.test.InstrumentationRegistry
 import androidx.test.runner.AndroidJUnit4
+import com.android.internal.util.AsyncChannel
 import com.android.testutils.ArrayTrackRecord
 import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.RecorderCallback.CallbackEntry.Available
 import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import java.util.UUID
 import org.junit.After
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.fail
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
+import java.net.InetAddress
+import java.time.Duration
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
 import kotlin.test.assertFailsWith
+import kotlin.test.assertNotNull
+import kotlin.test.assertNull
 import kotlin.test.assertTrue
 
 // This test doesn't really have a constraint on how fast the methods should return. If it's
 // going to fail, it will simply wait forever, so setting a high timeout lowers the flake ratio
 // without affecting the run time of successful runs. Thus, set a very high timeout.
 private const val DEFAULT_TIMEOUT_MS = 5000L
+// When waiting for a NetworkCallback to determine there was no timeout, waiting is the
+// only possible thing (the relevant handler is the one in the real ConnectivityService,
+// and then there is the Binder call), so have a short timeout for this as it will be
+// exhausted every time.
+private const val NO_CALLBACK_TIMEOUT = 200L
 // Any legal score (0~99) for the test network would do, as it is going to be kept up by the
 // requests filed by the test and should never match normal internet requests. 70 is the default
 // score of Ethernet networks, it's as good a value as any other.
 private const val TEST_NETWORK_SCORE = 70
+private const val BETTER_NETWORK_SCORE = 75
+private const val FAKE_NET_ID = 1098
 private val instrumentation: Instrumentation
     get() = InstrumentationRegistry.getInstrumentation()
 private val context: Context
     get() = InstrumentationRegistry.getContext()
+private fun Message(what: Int, arg1: Int, arg2: Int, obj: Any?) = Message.obtain().also {
+    it.what = what
+    it.arg1 = arg1
+    it.arg2 = arg2
+    it.obj = obj
+}
 
 @RunWith(AndroidJUnit4::class)
 class NetworkAgentTest {
     @Rule @JvmField
     val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = Build.VERSION_CODES.Q)
 
+    private val LOCAL_IPV4_ADDRESS = InetAddress.parseNumericAddress("192.0.2.1")
+    private val REMOTE_IPV4_ADDRESS = InetAddress.parseNumericAddress("192.0.2.2")
+
     private val mCM = context.getSystemService(ConnectivityManager::class.java)
     private val mHandlerThread = HandlerThread("${javaClass.simpleName} handler thread")
+    private val mFakeConnectivityService by lazy { FakeConnectivityService(mHandlerThread.looper) }
 
     private class Provider(context: Context, looper: Looper) :
             NetworkProvider(context, looper, "NetworkAgentTest NetworkProvider")
 
+    private val agentsToCleanUp = mutableListOf<NetworkAgent>()
+    private val callbacksToCleanUp = mutableListOf<TestableNetworkCallback>()
+
     @Before
     fun setUp() {
         instrumentation.getUiAutomation().adoptShellPermissionIdentity()
@@ -74,35 +133,174 @@
 
     @After
     fun tearDown() {
+        agentsToCleanUp.forEach { it.unregister() }
+        callbacksToCleanUp.forEach { mCM.unregisterNetworkCallback(it) }
         mHandlerThread.quitSafely()
         instrumentation.getUiAutomation().dropShellPermissionIdentity()
     }
 
-    internal class TestableNetworkAgent(
-        looper: Looper,
-        nc: NetworkCapabilities,
-        lp: LinkProperties,
+    /**
+     * A fake that helps simulating ConnectivityService talking to a harnessed agent.
+     * This fake only supports speaking to one harnessed agent at a time because it
+     * only keeps track of one async channel.
+     */
+    private class FakeConnectivityService(looper: Looper) {
+        private val CMD_EXPECT_DISCONNECT = 1
+        private var disconnectExpected = false
+        private val msgHistory = ArrayTrackRecord<Message>().newReadHead()
+        private val asyncChannel = AsyncChannel()
+        private val handler = object : Handler(looper) {
+            override fun handleMessage(msg: Message) {
+                msgHistory.add(Message.obtain(msg)) // make a copy as the original will be recycled
+                when (msg.what) {
+                    CMD_EXPECT_DISCONNECT -> disconnectExpected = true
+                    AsyncChannel.CMD_CHANNEL_HALF_CONNECTED ->
+                        asyncChannel.sendMessage(AsyncChannel.CMD_CHANNEL_FULL_CONNECTION)
+                    AsyncChannel.CMD_CHANNEL_DISCONNECTED ->
+                        if (!disconnectExpected) {
+                            fail("Agent unexpectedly disconnected")
+                        } else {
+                            disconnectExpected = false
+                        }
+                }
+            }
+        }
+
+        fun connect(agentMsngr: Messenger) = asyncChannel.connect(context, handler, agentMsngr)
+
+        fun disconnect() = asyncChannel.disconnect()
+
+        fun sendMessage(what: Int, arg1: Int = 0, arg2: Int = 0, obj: Any? = null) =
+            asyncChannel.sendMessage(Message(what, arg1, arg2, obj))
+
+        fun expectMessage(what: Int) =
+            assertNotNull(msgHistory.poll(DEFAULT_TIMEOUT_MS) { it.what == what })
+
+        fun willExpectDisconnectOnce() = handler.sendEmptyMessage(CMD_EXPECT_DISCONNECT)
+    }
+
+    private open class TestableNetworkAgent(
+        val looper: Looper,
+        val nc: NetworkCapabilities,
+        val lp: LinkProperties,
         conf: NetworkAgentConfig
     ) : NetworkAgent(context, looper, TestableNetworkAgent::class.java.simpleName /* tag */,
             nc, lp, TEST_NETWORK_SCORE, conf, Provider(context, looper)) {
         private val history = ArrayTrackRecord<CallbackEntry>().newReadHead()
 
         sealed class CallbackEntry {
+            object OnBandwidthUpdateRequested : CallbackEntry()
             object OnNetworkUnwanted : CallbackEntry()
+            data class OnAddKeepalivePacketFilter(
+                val slot: Int,
+                val packet: KeepalivePacketData
+            ) : CallbackEntry()
+            data class OnRemoveKeepalivePacketFilter(val slot: Int) : CallbackEntry()
+            data class OnStartSocketKeepalive(
+                val slot: Int,
+                val interval: Int,
+                val packet: KeepalivePacketData
+            ) : CallbackEntry()
+            data class OnStopSocketKeepalive(val slot: Int) : CallbackEntry()
+            data class OnSaveAcceptUnvalidated(val accept: Boolean) : CallbackEntry()
+            object OnAutomaticReconnectDisabled : CallbackEntry()
+            data class OnValidationStatus(val status: Int, val uri: Uri?) : CallbackEntry()
+            data class OnSignalStrengthThresholdsUpdated(val thresholds: IntArray) : CallbackEntry()
+        }
+
+        fun getName(): String? = (nc.getNetworkSpecifier() as? StringNetworkSpecifier)?.specifier
+
+        override fun onBandwidthUpdateRequested() {
+            history.add(OnBandwidthUpdateRequested)
         }
 
         override fun onNetworkUnwanted() {
-            super.onNetworkUnwanted()
             history.add(OnNetworkUnwanted)
         }
 
-        inline fun <reified T : CallbackEntry> expectCallback() {
+        override fun onAddKeepalivePacketFilter(slot: Int, packet: KeepalivePacketData) {
+            history.add(OnAddKeepalivePacketFilter(slot, packet))
+        }
+
+        override fun onRemoveKeepalivePacketFilter(slot: Int) {
+            history.add(OnRemoveKeepalivePacketFilter(slot))
+        }
+
+        override fun onStartSocketKeepalive(
+            slot: Int,
+            interval: Duration,
+            packet: KeepalivePacketData
+        ) {
+            history.add(OnStartSocketKeepalive(slot, interval.seconds.toInt(), packet))
+        }
+
+        override fun onStopSocketKeepalive(slot: Int) {
+            history.add(OnStopSocketKeepalive(slot))
+        }
+
+        override fun onSaveAcceptUnvalidated(accept: Boolean) {
+            history.add(OnSaveAcceptUnvalidated(accept))
+        }
+
+        override fun onAutomaticReconnectDisabled() {
+            history.add(OnAutomaticReconnectDisabled)
+        }
+
+        override fun onSignalStrengthThresholdsUpdated(thresholds: IntArray) {
+            history.add(OnSignalStrengthThresholdsUpdated(thresholds))
+        }
+
+        fun expectEmptySignalStrengths() {
+            expectCallback<OnSignalStrengthThresholdsUpdated>().let {
+                // intArrayOf() without arguments makes an empty array
+                assertArrayEquals(intArrayOf(), it.thresholds)
+            }
+        }
+
+        override fun onValidationStatus(status: Int, uri: Uri?) {
+            history.add(OnValidationStatus(status, uri))
+        }
+
+        // Expects the initial validation event that always occurs immediately after registering
+        // a NetworkAgent whose network does not require validation (which test networks do
+        // not, since they lack the INTERNET capability). It always contains the default argument
+        // for the URI.
+        fun expectNoInternetValidationStatus() = expectCallback<OnValidationStatus>().let {
+            assertEquals(it.status, VALID_NETWORK)
+            // The returned Uri is parsed from the empty string, which means it's an
+            // instance of the (private) Uri.StringUri. There are no real good ways
+            // to check this, the least bad is to just convert it to a string and
+            // make sure it's empty.
+            assertEquals("", it.uri.toString())
+        }
+
+        inline fun <reified T : CallbackEntry> expectCallback(): T {
             val foundCallback = history.poll(DEFAULT_TIMEOUT_MS)
             assertTrue(foundCallback is T, "Expected ${T::class} but found $foundCallback")
+            return foundCallback
+        }
+
+        fun assertNoCallback() {
+            assertTrue(waitForIdle(DEFAULT_TIMEOUT_MS),
+                    "Handler didn't became idle after ${DEFAULT_TIMEOUT_MS}ms")
+            assertNull(history.peek())
         }
     }
 
-    private fun createNetworkAgent(): TestableNetworkAgent {
+    private fun requestNetwork(request: NetworkRequest, callback: TestableNetworkCallback) {
+        mCM.requestNetwork(request, callback)
+        callbacksToCleanUp.add(callback)
+    }
+
+    private fun registerNetworkCallback(
+        request: NetworkRequest,
+        callback: TestableNetworkCallback
+    ) {
+        mCM.registerNetworkCallback(request, callback)
+        callbacksToCleanUp.add(callback)
+    }
+
+    private fun createNetworkAgent(name: String? = null): TestableNetworkAgent {
         val nc = NetworkCapabilities().apply {
             addTransportType(NetworkCapabilities.TRANSPORT_TEST)
             removeCapability(NetworkCapabilities.NET_CAPABILITY_TRUSTED)
@@ -110,28 +308,43 @@
             addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED)
             addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING)
             addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
+            if (null != name) {
+                setNetworkSpecifier(StringNetworkSpecifier(name))
+            }
         }
-        val lp = LinkProperties()
+        val lp = LinkProperties().apply {
+            addLinkAddress(LinkAddress(LOCAL_IPV4_ADDRESS, 0))
+        }
         val config = NetworkAgentConfig.Builder().build()
-        return TestableNetworkAgent(mHandlerThread.looper, nc, lp, config)
+        return TestableNetworkAgent(mHandlerThread.looper, nc, lp, config).also {
+            agentsToCleanUp.add(it)
+        }
     }
 
-    private fun createConnectedNetworkAgent(): Pair<TestableNetworkAgent, TestableNetworkCallback> {
+    private fun createConnectedNetworkAgent(name: String? = null):
+            Pair<TestableNetworkAgent, TestableNetworkCallback> {
         val request: NetworkRequest = NetworkRequest.Builder()
                 .clearCapabilities()
                 .addTransportType(NetworkCapabilities.TRANSPORT_TEST)
                 .build()
         val callback = TestableNetworkCallback(timeoutMs = DEFAULT_TIMEOUT_MS)
-        mCM.requestNetwork(request, callback)
-        val agent = createNetworkAgent().also { it.register() }
+        requestNetwork(request, callback)
+        val agent = createNetworkAgent(name)
+        agent.register()
         agent.markConnected()
         return agent to callback
     }
 
+    private fun createNetworkAgentWithFakeCS() = createNetworkAgent().also {
+        mFakeConnectivityService.connect(it.registerForTest(Network(FAKE_NET_ID)))
+    }
+
     @Test
     fun testConnectAndUnregister() {
         val (agent, callback) = createConnectedNetworkAgent()
         callback.expectAvailableThenValidatedCallbacks(agent.network)
+        agent.expectEmptySignalStrengths()
+        agent.expectNoInternetValidationStatus()
         agent.unregister()
         callback.expectCallback<Lost>(agent.network)
         agent.expectCallback<OnNetworkUnwanted>()
@@ -139,4 +352,244 @@
             agent.register()
         }
     }
+
+    @Test
+    fun testOnBandwidthUpdateRequested() {
+        val (agent, callback) = createConnectedNetworkAgent()
+        callback.expectAvailableThenValidatedCallbacks(agent.network)
+        agent.expectEmptySignalStrengths()
+        agent.expectNoInternetValidationStatus()
+        mCM.requestBandwidthUpdate(agent.network)
+        agent.expectCallback<OnBandwidthUpdateRequested>()
+        agent.unregister()
+    }
+
+    @Test
+    fun testSignalStrengthThresholds() {
+        val thresholds = intArrayOf(30, 50, 65)
+        val callbacks = thresholds.map { strength ->
+            val request = NetworkRequest.Builder()
+                    .clearCapabilities()
+                    .addTransportType(NetworkCapabilities.TRANSPORT_TEST)
+                    .setSignalStrength(strength)
+                    .build()
+            TestableNetworkCallback(DEFAULT_TIMEOUT_MS).also {
+                registerNetworkCallback(request, it)
+            }
+        }
+        createConnectedNetworkAgent().let { (agent, callback) ->
+            callback.expectAvailableThenValidatedCallbacks(agent.network)
+            agent.expectCallback<OnSignalStrengthThresholdsUpdated>().let {
+                assertArrayEquals(it.thresholds, thresholds)
+            }
+            agent.expectNoInternetValidationStatus()
+
+            // Send signal strength and check that the callbacks are called appropriately.
+            val nc = NetworkCapabilities(agent.nc)
+            nc.setSignalStrength(20)
+            agent.sendNetworkCapabilities(nc)
+            callbacks.forEach { it.assertNoCallback(NO_CALLBACK_TIMEOUT) }
+
+            nc.setSignalStrength(40)
+            agent.sendNetworkCapabilities(nc)
+            callbacks[0].expectAvailableCallbacks(agent.network)
+            callbacks[1].assertNoCallback(NO_CALLBACK_TIMEOUT)
+            callbacks[2].assertNoCallback(NO_CALLBACK_TIMEOUT)
+
+            nc.setSignalStrength(80)
+            agent.sendNetworkCapabilities(nc)
+            callbacks[0].expectCapabilitiesThat(agent.network) { it.signalStrength == 80 }
+            callbacks[1].expectAvailableCallbacks(agent.network)
+            callbacks[2].expectAvailableCallbacks(agent.network)
+
+            nc.setSignalStrength(55)
+            agent.sendNetworkCapabilities(nc)
+            callbacks[0].expectCapabilitiesThat(agent.network) { it.signalStrength == 55 }
+            callbacks[1].expectCapabilitiesThat(agent.network) { it.signalStrength == 55 }
+            callbacks[2].expectCallback<Lost>(agent.network)
+        }
+        callbacks.forEach {
+            mCM.unregisterNetworkCallback(it)
+        }
+    }
+
+    @Test
+    fun testSocketKeepalive(): Unit = createNetworkAgentWithFakeCS().let { agent ->
+        val packet = object : KeepalivePacketData(
+                LOCAL_IPV4_ADDRESS /* srcAddress */, 1234 /* srcPort */,
+                REMOTE_IPV4_ADDRESS /* dstAddress */, 4567 /* dstPort */,
+                ByteArray(100 /* size */) { it.toByte() /* init */ }) {}
+        val slot = 4
+        val interval = 37
+
+        mFakeConnectivityService.sendMessage(CMD_ADD_KEEPALIVE_PACKET_FILTER,
+                arg1 = slot, obj = packet)
+        mFakeConnectivityService.sendMessage(CMD_START_SOCKET_KEEPALIVE,
+                arg1 = slot, arg2 = interval, obj = packet)
+
+        agent.expectCallback<OnAddKeepalivePacketFilter>().let {
+            assertEquals(it.slot, slot)
+            assertEquals(it.packet, packet)
+        }
+        agent.expectCallback<OnStartSocketKeepalive>().let {
+            assertEquals(it.slot, slot)
+            assertEquals(it.interval, interval)
+            assertEquals(it.packet, packet)
+        }
+
+        agent.assertNoCallback()
+
+        // Check that when the agent sends a keepalive event, ConnectivityService receives the
+        // expected message.
+        agent.sendSocketKeepaliveEvent(slot, SocketKeepalive.ERROR_UNSUPPORTED)
+        mFakeConnectivityService.expectMessage(NetworkAgent.EVENT_SOCKET_KEEPALIVE).let() {
+            assertEquals(slot, it.arg1)
+            assertEquals(SocketKeepalive.ERROR_UNSUPPORTED, it.arg2)
+        }
+
+        mFakeConnectivityService.sendMessage(CMD_STOP_SOCKET_KEEPALIVE, arg1 = slot)
+        mFakeConnectivityService.sendMessage(CMD_REMOVE_KEEPALIVE_PACKET_FILTER, arg1 = slot)
+        agent.expectCallback<OnStopSocketKeepalive>().let {
+            assertEquals(it.slot, slot)
+        }
+        agent.expectCallback<OnRemoveKeepalivePacketFilter>().let {
+            assertEquals(it.slot, slot)
+        }
+    }
+
+    @Test
+    fun testSendUpdates(): Unit = createConnectedNetworkAgent().let { (agent, callback) ->
+        callback.expectAvailableThenValidatedCallbacks(agent.network)
+        agent.expectEmptySignalStrengths()
+        agent.expectNoInternetValidationStatus()
+        val ifaceName = "adhocIface"
+        val lp = LinkProperties(agent.lp)
+        lp.setInterfaceName(ifaceName)
+        agent.sendLinkProperties(lp)
+        callback.expectLinkPropertiesThat(agent.network) {
+            it.getInterfaceName() == ifaceName
+        }
+        val nc = NetworkCapabilities(agent.nc)
+        nc.addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED)
+        agent.sendNetworkCapabilities(nc)
+        callback.expectCapabilitiesThat(agent.network) {
+            it.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED)
+        }
+    }
+
+    @Test
+    fun testSendScore() {
+        // This test will create two networks and check that the one with the stronger
+        // score wins out for a request that matches them both.
+        // First create requests to make sure both networks are kept up, using the
+        // specifier so they are specific to each network
+        val name1 = UUID.randomUUID().toString()
+        val name2 = UUID.randomUUID().toString()
+        val request1 = NetworkRequest.Builder()
+                .clearCapabilities()
+                .addTransportType(NetworkCapabilities.TRANSPORT_TEST)
+                .setNetworkSpecifier(StringNetworkSpecifier(name1))
+                .build()
+        val request2 = NetworkRequest.Builder()
+                .clearCapabilities()
+                .addTransportType(NetworkCapabilities.TRANSPORT_TEST)
+                .setNetworkSpecifier(StringNetworkSpecifier(name2))
+                .build()
+        val callback1 = TestableNetworkCallback()
+        val callback2 = TestableNetworkCallback()
+        requestNetwork(request1, callback1)
+        requestNetwork(request2, callback2)
+
+        // Then file the interesting request
+        val request = NetworkRequest.Builder()
+                .clearCapabilities()
+                .addTransportType(NetworkCapabilities.TRANSPORT_TEST)
+                .build()
+        val callback = TestableNetworkCallback()
+        requestNetwork(request, callback)
+
+        // Connect the first Network
+        createConnectedNetworkAgent(name1).let { (agent1, _) ->
+            callback.expectAvailableThenValidatedCallbacks(agent1.network)
+            // Upgrade agent1 to a better score so that there is no ambiguity when
+            // agent2 connects that agent1 is still better
+            agent1.sendNetworkScore(BETTER_NETWORK_SCORE - 1)
+            // Connect the second agent
+            createConnectedNetworkAgent(name2).let { (agent2, _) ->
+                agent2.markConnected()
+                // The callback should not see anything yet
+                callback.assertNoCallback(NO_CALLBACK_TIMEOUT)
+                // Now update the score and expect the callback now prefers agent2
+                agent2.sendNetworkScore(BETTER_NETWORK_SCORE)
+                callback.expectCallback<Available>(agent2.network)
+            }
+        }
+
+        // tearDown() will unregister the requests and agents
+    }
+
+    @Test
+    fun testSetAcceptUnvalidated() {
+        createNetworkAgentWithFakeCS().let { agent ->
+            mFakeConnectivityService.sendMessage(CMD_SAVE_ACCEPT_UNVALIDATED, 1)
+            agent.expectCallback<OnSaveAcceptUnvalidated>().let {
+                assertTrue(it.accept)
+            }
+            agent.assertNoCallback()
+        }
+    }
+
+    @Test
+    fun testSetAcceptUnvalidatedPreventAutomaticReconnect() {
+        createNetworkAgentWithFakeCS().let { agent ->
+            mFakeConnectivityService.sendMessage(CMD_SAVE_ACCEPT_UNVALIDATED, 0)
+            mFakeConnectivityService.sendMessage(CMD_PREVENT_AUTOMATIC_RECONNECT)
+            agent.expectCallback<OnSaveAcceptUnvalidated>().let {
+                assertFalse(it.accept)
+            }
+            agent.expectCallback<OnAutomaticReconnectDisabled>()
+            agent.assertNoCallback()
+            // When automatic reconnect is turned off, the network is torn down and
+            // ConnectivityService sends a disconnect. This in turn causes the agent
+            // to send a DISCONNECTED message to CS.
+            mFakeConnectivityService.willExpectDisconnectOnce()
+            mFakeConnectivityService.disconnect()
+            mFakeConnectivityService.expectMessage(AsyncChannel.CMD_CHANNEL_DISCONNECTED)
+            agent.expectCallback<OnNetworkUnwanted>()
+        }
+    }
+
+    @Test
+    fun testPreventAutomaticReconnect() {
+        createNetworkAgentWithFakeCS().let { agent ->
+            mFakeConnectivityService.sendMessage(CMD_PREVENT_AUTOMATIC_RECONNECT)
+            agent.expectCallback<OnAutomaticReconnectDisabled>()
+            agent.assertNoCallback()
+            mFakeConnectivityService.willExpectDisconnectOnce()
+            mFakeConnectivityService.disconnect()
+            mFakeConnectivityService.expectMessage(AsyncChannel.CMD_CHANNEL_DISCONNECTED)
+            agent.expectCallback<OnNetworkUnwanted>()
+        }
+    }
+
+    @Test
+    fun testValidationStatus() = createNetworkAgentWithFakeCS().let { agent ->
+        val uri = Uri.parse("http://www.google.com")
+        val bundle = Bundle().apply {
+            putString(NetworkAgent.REDIRECT_URL_KEY, uri.toString())
+        }
+        mFakeConnectivityService.sendMessage(CMD_REPORT_NETWORK_STATUS,
+                arg1 = VALID_NETWORK, obj = bundle)
+        agent.expectCallback<OnValidationStatus>().let {
+            assertEquals(it.status, VALID_NETWORK)
+            assertEquals(it.uri, uri)
+        }
+
+        mFakeConnectivityService.sendMessage(CMD_REPORT_NETWORK_STATUS,
+                arg1 = INVALID_NETWORK, obj = Bundle())
+        agent.expectCallback<OnValidationStatus>().let {
+            assertEquals(it.status, INVALID_NETWORK)
+            assertNull(it.uri)
+        }
+    }
 }
diff --git a/tests/cts/net/src/android/net/cts/NetworkRequestTest.java b/tests/cts/net/src/android/net/cts/NetworkRequestTest.java
index 8b97c8c..6a1d9de 100644
--- a/tests/cts/net/src/android/net/cts/NetworkRequestTest.java
+++ b/tests/cts/net/src/android/net/cts/NetworkRequestTest.java
@@ -16,8 +16,11 @@
 
 package android.net.cts;
 
+import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_MMS;
 import static android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH;
+import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
+import static android.net.NetworkCapabilities.TRANSPORT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 
 import static org.junit.Assert.assertEquals;
@@ -26,13 +29,13 @@
 import static org.junit.Assert.assertTrue;
 
 import android.net.MacAddress;
+import android.net.NetworkCapabilities;
 import android.net.NetworkRequest;
 import android.net.NetworkSpecifier;
-import android.net.wifi.WifiConfiguration;
 import android.net.wifi.WifiNetworkSpecifier;
 import android.os.Build;
+import android.os.Process;
 import android.os.PatternMatcher;
-import android.util.Pair;
 
 import androidx.test.runner.AndroidJUnit4;
 
@@ -49,6 +52,7 @@
     public final DevSdkIgnoreRule ignoreRule = new DevSdkIgnoreRule();
 
     private static final String TEST_SSID = "TestSSID";
+    private static final String OTHER_SSID = "OtherSSID";
     private static final int TEST_UID = 2097;
     private static final String TEST_PACKAGE_NAME = "test.package.name";
     private static final MacAddress ARBITRARY_ADDRESS = MacAddress.fromString("3:5:8:12:9:2");
@@ -59,6 +63,18 @@
                 .hasCapability(NET_CAPABILITY_MMS));
         assertFalse(new NetworkRequest.Builder().removeCapability(NET_CAPABILITY_MMS).build()
                 .hasCapability(NET_CAPABILITY_MMS));
+
+        final NetworkRequest nr = new NetworkRequest.Builder().clearCapabilities().build();
+        // Verify request has no capabilities
+        verifyNoCapabilities(nr);
+    }
+
+    private void verifyNoCapabilities(NetworkRequest nr) {
+        // NetworkCapabilities.mNetworkCapabilities is defined as type long
+        final int MAX_POSSIBLE_CAPABILITY = Long.SIZE;
+        for(int bit = 0; bit < MAX_POSSIBLE_CAPABILITY; bit++) {
+            assertFalse(nr.hasCapability(bit));
+        }
     }
 
     @Test
@@ -83,5 +99,81 @@
                 .build()
                 .getNetworkSpecifier();
         assertEquals(obtainedSpecifier, specifier);
+
+        assertNull(new NetworkRequest.Builder()
+                .clearCapabilities()
+                .build()
+                .getNetworkSpecifier());
+    }
+
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.Q)
+    public void testRequestorPackageName() {
+        assertNull(new NetworkRequest.Builder().build().getRequestorPackageName());
+        final String pkgName = "android.net.test";
+        final NetworkCapabilities nc = new NetworkCapabilities.Builder()
+                .setRequestorPackageName(pkgName)
+                .build();
+        final NetworkRequest nr = new NetworkRequest.Builder()
+                .setCapabilities(nc)
+                .build();
+        assertEquals(pkgName, nr.getRequestorPackageName());
+        assertNull(new NetworkRequest.Builder()
+                .clearCapabilities()
+                .build()
+                .getRequestorPackageName());
+    }
+
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.Q)
+    public void testCanBeSatisfiedBy() {
+        final WifiNetworkSpecifier specifier1 = new WifiNetworkSpecifier.Builder()
+                .setSsidPattern(new PatternMatcher(TEST_SSID, PatternMatcher.PATTERN_LITERAL))
+                .setBssidPattern(ARBITRARY_ADDRESS, ARBITRARY_ADDRESS)
+                .build();
+        final WifiNetworkSpecifier specifier2 = new WifiNetworkSpecifier.Builder()
+                .setSsidPattern(new PatternMatcher(OTHER_SSID, PatternMatcher.PATTERN_LITERAL))
+                .setBssidPattern(ARBITRARY_ADDRESS, ARBITRARY_ADDRESS)
+                .build();
+        final NetworkCapabilities cap = new NetworkCapabilities()
+                .addTransportType(TRANSPORT_WIFI)
+                .addCapability(NET_CAPABILITY_INTERNET);
+        final NetworkCapabilities capWithSp =
+                new NetworkCapabilities(cap).setNetworkSpecifier(specifier1);
+        final NetworkCapabilities cellCap = new NetworkCapabilities()
+                .addTransportType(TRANSPORT_CELLULAR)
+                .addCapability(NET_CAPABILITY_MMS)
+                .addCapability(NET_CAPABILITY_INTERNET);
+        final NetworkRequest request = new NetworkRequest.Builder()
+                .addTransportType(TRANSPORT_WIFI)
+                .addCapability(NET_CAPABILITY_INTERNET)
+                .setNetworkSpecifier(specifier1)
+                .build();
+        assertFalse(request.canBeSatisfiedBy(null));
+        assertFalse(request.canBeSatisfiedBy(new NetworkCapabilities()));
+        assertTrue(request.canBeSatisfiedBy(cap));
+        assertTrue(request.canBeSatisfiedBy(
+                new NetworkCapabilities(cap).addTransportType(TRANSPORT_VPN)));
+        assertTrue(request.canBeSatisfiedBy(capWithSp));
+        assertFalse(request.canBeSatisfiedBy(
+                new NetworkCapabilities(cap).setNetworkSpecifier(specifier2)));
+        assertFalse(request.canBeSatisfiedBy(cellCap));
+        assertEquals(request.canBeSatisfiedBy(capWithSp),
+                new NetworkCapabilities(capWithSp).satisfiedByNetworkCapabilities(capWithSp));
+    }
+
+    @Test @IgnoreUpTo(Build.VERSION_CODES.Q)
+    public void testRequestorUid() {
+        final NetworkCapabilities nc = new NetworkCapabilities();
+        // Verify default value is INVALID_UID
+        assertEquals(Process.INVALID_UID, new NetworkRequest.Builder()
+                 .setCapabilities(nc).build().getRequestorUid());
+
+        nc.setRequestorUid(1314);
+        final NetworkRequest nr = new NetworkRequest.Builder().setCapabilities(nc).build();
+        assertEquals(1314, nr.getRequestorUid());
+
+        assertEquals(Process.INVALID_UID, new NetworkRequest.Builder()
+                .clearCapabilities().build().getRequestorUid());
     }
 }
diff --git a/tests/cts/tethering/Android.bp b/tests/cts/tethering/Android.bp
index 0f98125..63de301 100644
--- a/tests/cts/tethering/Android.bp
+++ b/tests/cts/tethering/Android.bp
@@ -25,12 +25,19 @@
     ],
 
     static_libs: [
+        "TetheringIntegrationTestsLib",
         "compatibility-device-util-axt",
         "ctstestrunner-axt",
         "junit",
         "junit-params",
     ],
 
+    jni_libs: [
+        // For mockito extended
+        "libdexmakerjvmtiagent",
+        "libstaticjvmtiagent",
+    ],
+
     // Change to system current when TetheringManager move to bootclass path.
     platform_apis: true,
 
@@ -41,4 +48,6 @@
         "mts",
     ],
 
+    // Include both the 32 and 64 bit versions
+    compile_multilib: "both",
 }
diff --git a/tests/cts/tethering/OWNERS b/tests/cts/tethering/OWNERS
new file mode 100644
index 0000000..cd6abeb
--- /dev/null
+++ b/tests/cts/tethering/OWNERS
@@ -0,0 +1,4 @@
+# Bug component: 31808
+lorenzo@google.com
+satk@google.com
+
diff --git a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
index b132982..ccad14c 100644
--- a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
+++ b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
@@ -15,8 +15,13 @@
  */
 package android.tethering.test;
 
+import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_FAILED;
+import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_STARTED;
+import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_STOPPED;
 import static android.net.TetheringManager.TETHERING_USB;
 import static android.net.TetheringManager.TETHERING_WIFI;
+import static android.net.TetheringManager.TETHERING_WIFI_P2P;
+import static android.net.TetheringManager.TETHER_ERROR_ENTITLEMENT_UNKNOWN;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -32,9 +37,12 @@
 import android.net.Network;
 import android.net.TetheredClient;
 import android.net.TetheringManager;
+import android.net.TetheringManager.OnTetheringEntitlementResultListener;
 import android.net.TetheringManager.TetheringEventCallback;
 import android.net.TetheringManager.TetheringInterfaceRegexps;
 import android.net.TetheringManager.TetheringRequest;
+import android.os.Bundle;
+import android.os.ResultReceiver;
 
 import androidx.annotation.NonNull;
 import androidx.test.InstrumentationRegistry;
@@ -49,8 +57,12 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ExecutionException;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.function.Consumer;
 
 @RunWith(AndroidJUnit4.class)
 public class TetheringManagerTest {
@@ -273,6 +285,7 @@
             ON_TETHERED_IFACES,
             ON_ERROR,
             ON_CLIENTS,
+            ON_OFFLOAD_STATUS,
         };
 
         public static class CallbackValue {
@@ -330,6 +343,11 @@
             mCallbacks.add(new CallbackValue(CallbackType.ON_CLIENTS, clients, 0));
         }
 
+        @Override
+        public void onOffloadStatusChanged(int status) {
+            mCallbacks.add(new CallbackValue(CallbackType.ON_OFFLOAD_STATUS, status, 0));
+        }
+
         public CallbackValue pollCallback() {
             try {
                 return mCallbacks.poll(DEFAULT_TIMEOUT_MS, TimeUnit.MILLISECONDS);
@@ -382,6 +400,17 @@
             }
         }
 
+        public void expectOneOfOffloadStatusChanged(int... offloadStatuses) {
+            while (true) {
+                final CallbackValue cv = pollCallback();
+                if (cv == null) fail("No expected offload status change callback");
+                if (cv.callbackType != CallbackType.ON_OFFLOAD_STATUS) continue;
+
+                final int status = (int) cv.callbackParam;
+                for (int offloadStatus : offloadStatuses) if (offloadStatus == status) return;
+            }
+        }
+
         public TetheringInterfaceRegexps getTetheringInterfaceRegexps() {
             return mTetherableRegex;
         }
@@ -403,6 +432,7 @@
 
         mTM.registerTetheringEventCallback(c -> c.run(), tetherEventCallback);
         tetherEventCallback.expectCallbackStarted();
+        tetherEventCallback.expectOneOfOffloadStatusChanged(TETHER_HARDWARE_OFFLOAD_STOPPED);
 
         final TetheringInterfaceRegexps tetherableRegexs =
                 tetherEventCallback.getTetheringInterfaceRegexps();
@@ -422,10 +452,89 @@
         }
 
         tetherEventCallback.expectTetheredInterfacesChanged(wifiRegexs);
+        tetherEventCallback.expectOneOfOffloadStatusChanged(
+                TETHER_HARDWARE_OFFLOAD_STARTED,
+                TETHER_HARDWARE_OFFLOAD_FAILED);
 
         mTM.stopTethering(TETHERING_WIFI);
 
         tetherEventCallback.expectTetheredInterfacesChanged(null);
+        tetherEventCallback.expectOneOfOffloadStatusChanged(TETHER_HARDWARE_OFFLOAD_STOPPED);
         mTM.unregisterTetheringEventCallback(tetherEventCallback);
     }
+
+    @Test
+    public void testGetTetherableInterfaceRegexps() {
+        if (!mTM.isTetheringSupported()) return;
+
+        final TestTetheringEventCallback tetherEventCallback = new TestTetheringEventCallback();
+        mTM.registerTetheringEventCallback(c -> c.run(), tetherEventCallback);
+        tetherEventCallback.expectCallbackStarted();
+
+        final TetheringInterfaceRegexps tetherableRegexs =
+                tetherEventCallback.getTetheringInterfaceRegexps();
+        final List<String> wifiRegexs = tetherableRegexs.getTetherableWifiRegexs();
+        final List<String> usbRegexs = tetherableRegexs.getTetherableUsbRegexs();
+        final List<String> btRegexs = tetherableRegexs.getTetherableBluetoothRegexs();
+
+        assertEquals(wifiRegexs, Arrays.asList(mTM.getTetherableWifiRegexs()));
+        assertEquals(usbRegexs, Arrays.asList(mTM.getTetherableUsbRegexs()));
+        assertEquals(btRegexs, Arrays.asList(mTM.getTetherableBluetoothRegexs()));
+
+        //Verify that any regex name should only contain in one array.
+        wifiRegexs.forEach(s -> assertFalse(usbRegexs.contains(s)));
+        wifiRegexs.forEach(s -> assertFalse(btRegexs.contains(s)));
+        usbRegexs.forEach(s -> assertFalse(btRegexs.contains(s)));
+
+        mTM.unregisterTetheringEventCallback(tetherEventCallback);
+    }
+
+    private class EntitlementResultListener implements OnTetheringEntitlementResultListener {
+        private final CompletableFuture<Integer> future = new CompletableFuture<>();
+
+        @Override
+        public void onTetheringEntitlementResult(int result) {
+            future.complete(result);
+        }
+
+        public int get(long timeout, TimeUnit unit) throws Exception {
+            return future.get(timeout, unit);
+        }
+
+    }
+
+    private void assertEntitlementResult(final Consumer<EntitlementResultListener> functor,
+            final int expect) throws Exception {
+        final EntitlementResultListener listener = new EntitlementResultListener();
+        functor.accept(listener);
+
+        assertEquals(expect, listener.get(DEFAULT_TIMEOUT_MS, TimeUnit.MILLISECONDS));
+    }
+
+    @Test
+    public void testRequestLatestEntitlementResult() throws Exception {
+        // Verify that requestLatestTetheringEntitlementResult() can get entitlement
+        // result(TETHER_ERROR_ENTITLEMENT_UNKNOWN due to invalid downstream type) via listener.
+        assertEntitlementResult(listener -> mTM.requestLatestTetheringEntitlementResult(
+                TETHERING_WIFI_P2P, false, c -> c.run(), listener),
+                TETHER_ERROR_ENTITLEMENT_UNKNOWN);
+
+        // Verify that requestLatestTetheringEntitlementResult() can get entitlement
+        // result(TETHER_ERROR_ENTITLEMENT_UNKNOWN due to invalid downstream type) via receiver.
+        assertEntitlementResult(listener -> mTM.requestLatestTetheringEntitlementResult(
+                TETHERING_WIFI_P2P,
+                new ResultReceiver(null /* handler */) {
+                    @Override
+                    public void onReceiveResult(int resultCode, Bundle resultData) {
+                        listener.onTetheringEntitlementResult(resultCode);
+                    }
+                }, false),
+                TETHER_ERROR_ENTITLEMENT_UNKNOWN);
+
+        // Verify that null listener will cause IllegalArgumentException.
+        try {
+            mTM.requestLatestTetheringEntitlementResult(
+                    TETHERING_WIFI, false, c -> c.run(), null);
+        } catch (IllegalArgumentException expect) { }
+    }
 }