Merge "Add checks around CONTROL_VPN permission during prepare()" am: 04f3dc871d
Original change: https://android-review.googlesource.com/c/platform/packages/modules/Connectivity/+/2624812
Change-Id: Ibf49d8f7bf4912a8192838c3bf2692585b0d1135
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/tests/unit/java/com/android/server/connectivity/VpnTest.java b/tests/unit/java/com/android/server/connectivity/VpnTest.java
index 2d2819c..dc50773 100644
--- a/tests/unit/java/com/android/server/connectivity/VpnTest.java
+++ b/tests/unit/java/com/android/server/connectivity/VpnTest.java
@@ -80,6 +80,7 @@
import static org.mockito.Mockito.doCallRealMethod;
import static org.mockito.Mockito.doNothing;
import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
import static org.mockito.Mockito.inOrder;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
@@ -807,6 +808,32 @@
}
@Test
+ public void testPrepare_legacyVpnWithoutControlVpn()
+ throws Exception {
+ doThrow(new SecurityException("no CONTROL_VPN")).when(mContext)
+ .enforceCallingOrSelfPermission(eq(CONTROL_VPN), any());
+ final Vpn vpn = createVpn();
+ assertThrows(SecurityException.class,
+ () -> vpn.prepare(null, VpnConfig.LEGACY_VPN, VpnManager.TYPE_VPN_SERVICE));
+
+ // CONTROL_VPN can be held by the caller or another system server process - both are
+ // allowed. Just checking for `enforceCallingPermission` may not be sufficient.
+ verify(mContext, never()).enforceCallingPermission(eq(CONTROL_VPN), any());
+ }
+
+ @Test
+ public void testPrepare_legacyVpnWithControlVpn()
+ throws Exception {
+ doNothing().when(mContext).enforceCallingOrSelfPermission(eq(CONTROL_VPN), any());
+ final Vpn vpn = createVpn();
+ assertTrue(vpn.prepare(null, VpnConfig.LEGACY_VPN, VpnManager.TYPE_VPN_SERVICE));
+
+ // CONTROL_VPN can be held by the caller or another system server process - both are
+ // allowed. Just checking for `enforceCallingPermission` may not be sufficient.
+ verify(mContext, never()).enforceCallingPermission(eq(CONTROL_VPN), any());
+ }
+
+ @Test
public void testIsAlwaysOnPackageSupported() throws Exception {
final Vpn vpn = createVpn(PRIMARY_USER.id);