hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/DelegatedCertInstallerTest.java - platform/cts - Git at Google

 /*
  * Copyright (C) 2015 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 package com.android.cts.deviceandprofileowner;

 import static android.app.admin.DevicePolicyManager.DELEGATION_CERT_INSTALL;

 import static com.google.common.truth.Truth.assertThat;

 import android.app.admin.DevicePolicyManager;
 import android.content.BroadcastReceiver;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.os.Build;
 import android.os.Process;
 import android.security.KeyChainException;
 import android.test.MoreAsserts;

 import com.android.cts.devicepolicy.TestCertificates;

 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateFactory;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.Semaphore;
 import java.util.concurrent.TimeUnit;

 /**
  * Exercise delegated cert installer APIs in {@link DevicePolicyManager} by setting the test app
  * (CtsCertInstallerApp) as a delegated cert installer and then asking it to invoke various
  * cert-related APIs. The expected certificate changes are validated both remotely and locally.
  */
 public class DelegatedCertInstallerTest extends BaseDeviceAdminTest {

     private static final String CERT_INSTALLER_PACKAGE = "com.android.cts.certinstaller";
     private static final String NOT_EXIST_CERT_INSTALLER_PACKAGE
             = "com.android.cts.certinstaller.not_exist";

     private static final String ACTION_INSTALL_CERT = "com.android.cts.certinstaller.install_cert";
     private static final String ACTION_REMOVE_CERT = "com.android.cts.certinstaller.remove_cert";
     private static final String ACTION_VERIFY_CERT = "com.android.cts.certinstaller.verify_cert";
     private static final String ACTION_INSTALL_KEYPAIR =
             "com.android.cts.certinstaller.install_keypair";
     private static final String ACTION_CERT_OPERATION_DONE = "com.android.cts.certinstaller.done";
     private static final String ACTION_READ_ENROLLMENT_SPECIFIC_ID =
             "com.android.cts.certinstaller.read_esid";

     private static final String EXTRA_CERT_DATA = "extra_cert_data";
     private static final String EXTRA_KEY_DATA = "extra_key_data";
     private static final String EXTRA_KEY_ALIAS = "extra_key_alias";
     private static final String EXTRA_RESULT_VALUE = "extra_result_value";
     private static final String EXTRA_RESULT_EXCEPTION = "extra_result_exception";
     // package name of receiver has to be specified explicitly as the receiver is registered in
     // manifest
     private static final ComponentName CERT_INSTALLER_COMPONENT = new ComponentName(
             CERT_INSTALLER_PACKAGE, "com.android.cts.certinstaller.CertInstallerReceiver");

     private static final List<String> CERT_INSTALL_SCOPES = Arrays.asList(DELEGATION_CERT_INSTALL);

     private volatile boolean mReceivedResult;
     private volatile Exception mReceivedException;
     private Semaphore mAvailableResultSemaphore;

     private final BroadcastReceiver receiver = new BroadcastReceiver() {
         @Override
         public void onReceive(Context context, Intent intent) {
             if (ACTION_CERT_OPERATION_DONE.equals(intent.getAction())) {
                 synchronized (DelegatedCertInstallerTest.this) {
                     mReceivedResult = intent.getBooleanExtra(EXTRA_RESULT_VALUE, false);
                     mReceivedException =
                             (Exception) intent.getSerializableExtra(EXTRA_RESULT_EXCEPTION);
                     mAvailableResultSemaphore.release();
                 }
             }
         }
     };

     @Override
     public void setUp() throws Exception {
         super.setUp();

         mAvailableResultSemaphore = new Semaphore(0);
         mReceivedResult = false;
         mReceivedException = null;
         IntentFilter filter = new IntentFilter();
         filter.addAction(ACTION_CERT_OPERATION_DONE);
         mContext.registerReceiver(receiver, filter);
     }

     @Override
     public void tearDown() throws Exception {
         mContext.unregisterReceiver(receiver);
         mDevicePolicyManager.uninstallCaCert(ADMIN_RECEIVER_COMPONENT,
                 TestCertificates.TEST_CA.getBytes());
         // Installed private key pair will be removed once the lockscreen password is cleared,
         // which is done in the hostside test.
         mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);
         super.tearDown();
     }

     public void testCaCertsOperations() throws InterruptedException, GeneralSecurityException,
            KeyStoreException, IOException {
         final byte[] cert = TestCertificates.TEST_CA.getBytes();
         final Certificate caCert = CertificateFactory.getInstance("X.509")
                 .generateCertificate(new ByteArrayInputStream(cert));


         mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT,
                 CERT_INSTALLER_PACKAGE);
         assertEquals(CERT_INSTALLER_PACKAGE,
                 mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT));

         // Exercise installCaCert()
         KeyStore keyStore = KeyStore.getInstance("AndroidCAStore");
         keyStore.load(null, null);
         assertNull(keyStore.getCertificateAlias(caCert));
         installCaCert(cert);
         assertResult("installCaCert", true);
         assertTrue("Certificate is not installed properly", mDevicePolicyManager.hasCaCertInstalled(
                 ADMIN_RECEIVER_COMPONENT, cert));

         // Exercise getInstalledCaCerts()
         verifyCaCert(cert);
         assertResult("getInstalledCaCerts()", true);

         // Verify that the CA cert was marked as installed by the Device Owner / Profile Owner.
         final String alias = keyStore.getCertificateAlias(caCert);
         assertNotNull(alias);
         verifyOwnerInstalledStatus(alias, true);

         // Exercise uninstallCaCert()
         removeCaCert(cert);
         assertResult("uninstallCaCert()", true);
         assertFalse("Certificate is not removed properly", mDevicePolicyManager.hasCaCertInstalled(
                 ADMIN_RECEIVER_COMPONENT, cert));

         // Verify that the CA cert is no longer reported as installed by the Device Owner / Profile
         // Owner.
         verifyOwnerInstalledStatus(alias, false);

         // Clear delegated cert installer.
         // Tests after this are expected to fail.
         mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);

         installCaCert(cert);
         assertResult("installCaCert", false);
     }

     public void testInstallKeyPair() throws InterruptedException, KeyChainException {
         final String alias = "delegated-cert-installer-test-key";

         // Clear delegated cert installer.
         mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);
         // The app is not the cert installer , it shouldn't have have privilege to call
         // installKeyPair().
         installKeyPair(TestCertificates.TEST_KEY, TestCertificates.TEST_CERT, alias);
         assertResult("installKeyPair", false);

         // Set the app to be cert installer.
         mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT,
                 CERT_INSTALLER_PACKAGE);
         assertEquals(CERT_INSTALLER_PACKAGE,
                 mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT));

         // Exercise installKeyPair()
         installKeyPair(TestCertificates.TEST_KEY, TestCertificates.TEST_CERT, alias);
         assertResult("installKeyPair", true);
     }

     /**
      * If DPC is targeting N+, @{link IllegalArgumentException } should be thrown if the package
      * is missing.
      */
     public void testSetNotExistCertInstallerPackage() throws Exception {
         boolean shouldThrowException = getTargetApiLevel() >= Build.VERSION_CODES.N;
         try {
             mDevicePolicyManager.setCertInstallerPackage(
                     ADMIN_RECEIVER_COMPONENT, NOT_EXIST_CERT_INSTALLER_PACKAGE);
             if (shouldThrowException) {
                 fail("Did not throw IllegalArgumentException");
             }
         } catch (IllegalArgumentException ex) {
             if (!shouldThrowException) {
                 fail("Should not throw exception");
             }
             MoreAsserts.assertContainsRegex("is not installed on the current user",
                         ex.getMessage());
         }
         if (!shouldThrowException) {
             assertTrue("Cert install delegate was not set on uninstalled package",
                     NOT_EXIST_CERT_INSTALLER_PACKAGE.equals(
                             mDevicePolicyManager
                                     .getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT)));
         }
     }

     public void testSettingDelegatedCertInstallerAPICompatibility_oldSetNewGet() {
         // Set a delegated cert installer using the deprecated API and verify that the same
         // package is considered as the delegated cert installer using the new API.
         mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT,
                 CERT_INSTALLER_PACKAGE);
         assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT))
                 .isEqualTo(CERT_INSTALLER_PACKAGE);
         assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
                 DELEGATION_CERT_INSTALL)).containsExactly(CERT_INSTALLER_PACKAGE);

         // Remove a delegate using the old API, make sure no delegates are found using
         // the new API.
         mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);
         assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT)).isNull();
         assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
                 DELEGATION_CERT_INSTALL)).isEmpty();
     }

     public void testSettingDelegatedCertInstallerAPICompatibility_newSetOldGet() {
         // Set a delegate using the new API, verify that the deprecated API returns the same
         // delegate.
         setDelegatedScopes(CERT_INSTALLER_PACKAGE, CERT_INSTALL_SCOPES);
         assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
                 DELEGATION_CERT_INSTALL)).containsExactly(CERT_INSTALLER_PACKAGE);
         assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT))
                 .isEqualTo(CERT_INSTALLER_PACKAGE);

         // Remove the delegate using the new API, verify that the deprecated API returns null
         // as the current delegated cert installer.
         setDelegatedScopes(CERT_INSTALLER_PACKAGE, Arrays.asList());
         assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
                 DELEGATION_CERT_INSTALL)).isEmpty();
         assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT)).isNull();
     }

     public void testCanReadEnrollmentSpecificId() throws InterruptedException {
         // Set the organization ID only if not already set, to avoid potential conflict
         // with other tests.
         if (mDevicePolicyManager.getEnrollmentSpecificId().isEmpty()) {
             mDevicePolicyManager.setOrganizationId("SOME_ID");
         }
         setDelegatedScopes(CERT_INSTALLER_PACKAGE, CERT_INSTALL_SCOPES);

         readEnrollmentId();
         assertResult("testCanReadEnrollmentSpecificId", true);
     }

     private void installCaCert(byte[] cert) {
         Intent intent = new Intent();
         intent.setAction(ACTION_INSTALL_CERT);
         intent.setComponent(CERT_INSTALLER_COMPONENT);
         intent.putExtra(EXTRA_CERT_DATA, cert);
         intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
         mContext.sendBroadcast(intent);
     }

     private void removeCaCert(byte[] cert) {
         Intent intent = new Intent();
         intent.setAction(ACTION_REMOVE_CERT);
         intent.setComponent(CERT_INSTALLER_COMPONENT);
         intent.putExtra(EXTRA_CERT_DATA, cert);
         intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
         mContext.sendBroadcast(intent);
     }

     private void verifyCaCert(byte[] cert) {
         Intent intent = new Intent();
         intent.setAction(ACTION_VERIFY_CERT);
         intent.setComponent(CERT_INSTALLER_COMPONENT);
         intent.putExtra(EXTRA_CERT_DATA, cert);
         intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
         mContext.sendBroadcast(intent);
     }

     private void verifyOwnerInstalledStatus(String alias, boolean expectOwnerInstalled) {
         final List<String> ownerInstalledCerts =
                 mDevicePolicyManager.getOwnerInstalledCaCerts(Process.myUserHandle());
         assertNotNull(ownerInstalledCerts);
         assertEquals(expectOwnerInstalled, ownerInstalledCerts.contains(alias));
     }

     private void assertResult(String testName, Boolean expectSuccess) throws InterruptedException {
         assertTrue("Cert installer did not respond in time.",
                 mAvailableResultSemaphore.tryAcquire(180, TimeUnit.SECONDS));
         synchronized (this) {
             if (expectSuccess) {
                 assertTrue(testName + " failed unexpectedly.", mReceivedResult);
                 assertNull(testName + " raised exception", mReceivedException);
             } else {
                 assertFalse(testName + " succeeded unexpectedly.", mReceivedResult);
                 assertTrue(testName + " did not raise SecurityException",
                         mReceivedException != null &&
                         mReceivedException instanceof SecurityException);
             }
         }
     }

     private void installKeyPair(String key, String cert, String alias) {
         Intent intent = new Intent();
         intent.setAction(ACTION_INSTALL_KEYPAIR);
         intent.setComponent(CERT_INSTALLER_COMPONENT);
         intent.putExtra(EXTRA_CERT_DATA, cert);
         intent.putExtra(EXTRA_KEY_DATA, key);
         intent.putExtra(EXTRA_KEY_ALIAS, alias);
         intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
         mContext.sendBroadcast(intent);
     }

     private void readEnrollmentId() {
         Intent intent = new Intent();
         intent.setAction(ACTION_READ_ENROLLMENT_SPECIFIC_ID);
         intent.setComponent(CERT_INSTALLER_COMPONENT);
         intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
         mContext.sendBroadcast(intent);
     }
 }
	/*
	* Copyright (C) 2015 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	package com.android.cts.deviceandprofileowner;

	import static android.app.admin.DevicePolicyManager.DELEGATION_CERT_INSTALL;

	import static com.google.common.truth.Truth.assertThat;

	import android.app.admin.DevicePolicyManager;
	import android.content.BroadcastReceiver;
	import android.content.ComponentName;
	import android.content.Context;
	import android.content.Intent;
	import android.content.IntentFilter;
	import android.os.Build;
	import android.os.Process;
	import android.security.KeyChainException;
	import android.test.MoreAsserts;

	import com.android.cts.devicepolicy.TestCertificates;

	import java.io.ByteArrayInputStream;
	import java.io.IOException;
	import java.security.GeneralSecurityException;
	import java.security.KeyStore;
	import java.security.KeyStoreException;
	import java.security.cert.Certificate;
	import java.security.cert.CertificateFactory;
	import java.util.Arrays;
	import java.util.List;
	import java.util.concurrent.Semaphore;
	import java.util.concurrent.TimeUnit;

	/**
	* Exercise delegated cert installer APIs in {@link DevicePolicyManager} by setting the test app
	* (CtsCertInstallerApp) as a delegated cert installer and then asking it to invoke various
	* cert-related APIs. The expected certificate changes are validated both remotely and locally.
	*/
	public class DelegatedCertInstallerTest extends BaseDeviceAdminTest {

	private static final String CERT_INSTALLER_PACKAGE = "com.android.cts.certinstaller";
	private static final String NOT_EXIST_CERT_INSTALLER_PACKAGE
	= "com.android.cts.certinstaller.not_exist";

	private static final String ACTION_INSTALL_CERT = "com.android.cts.certinstaller.install_cert";
	private static final String ACTION_REMOVE_CERT = "com.android.cts.certinstaller.remove_cert";
	private static final String ACTION_VERIFY_CERT = "com.android.cts.certinstaller.verify_cert";
	private static final String ACTION_INSTALL_KEYPAIR =
	"com.android.cts.certinstaller.install_keypair";
	private static final String ACTION_CERT_OPERATION_DONE = "com.android.cts.certinstaller.done";
	private static final String ACTION_READ_ENROLLMENT_SPECIFIC_ID =
	"com.android.cts.certinstaller.read_esid";

	private static final String EXTRA_CERT_DATA = "extra_cert_data";
	private static final String EXTRA_KEY_DATA = "extra_key_data";
	private static final String EXTRA_KEY_ALIAS = "extra_key_alias";
	private static final String EXTRA_RESULT_VALUE = "extra_result_value";
	private static final String EXTRA_RESULT_EXCEPTION = "extra_result_exception";
	// package name of receiver has to be specified explicitly as the receiver is registered in
	// manifest
	private static final ComponentName CERT_INSTALLER_COMPONENT = new ComponentName(
	CERT_INSTALLER_PACKAGE, "com.android.cts.certinstaller.CertInstallerReceiver");

	private static final List<String> CERT_INSTALL_SCOPES = Arrays.asList(DELEGATION_CERT_INSTALL);

	private volatile boolean mReceivedResult;
	private volatile Exception mReceivedException;
	private Semaphore mAvailableResultSemaphore;

	private final BroadcastReceiver receiver = new BroadcastReceiver() {
	@Override
	public void onReceive(Context context, Intent intent) {
	if (ACTION_CERT_OPERATION_DONE.equals(intent.getAction())) {
	synchronized (DelegatedCertInstallerTest.this) {
	mReceivedResult = intent.getBooleanExtra(EXTRA_RESULT_VALUE, false);
	mReceivedException =
	(Exception) intent.getSerializableExtra(EXTRA_RESULT_EXCEPTION);
	mAvailableResultSemaphore.release();
	}
	}
	}
	};

	@Override
	public void setUp() throws Exception {
	super.setUp();

	mAvailableResultSemaphore = new Semaphore(0);
	mReceivedResult = false;
	mReceivedException = null;
	IntentFilter filter = new IntentFilter();
	filter.addAction(ACTION_CERT_OPERATION_DONE);
	mContext.registerReceiver(receiver, filter);
	}

	@Override
	public void tearDown() throws Exception {
	mContext.unregisterReceiver(receiver);
	mDevicePolicyManager.uninstallCaCert(ADMIN_RECEIVER_COMPONENT,
	TestCertificates.TEST_CA.getBytes());
	// Installed private key pair will be removed once the lockscreen password is cleared,
	// which is done in the hostside test.
	mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);
	super.tearDown();
	}

	public void testCaCertsOperations() throws InterruptedException, GeneralSecurityException,
	KeyStoreException, IOException {
	final byte[] cert = TestCertificates.TEST_CA.getBytes();
	final Certificate caCert = CertificateFactory.getInstance("X.509")
	.generateCertificate(new ByteArrayInputStream(cert));


	mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT,
	CERT_INSTALLER_PACKAGE);
	assertEquals(CERT_INSTALLER_PACKAGE,
	mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT));

	// Exercise installCaCert()
	KeyStore keyStore = KeyStore.getInstance("AndroidCAStore");
	keyStore.load(null, null);
	assertNull(keyStore.getCertificateAlias(caCert));
	installCaCert(cert);
	assertResult("installCaCert", true);
	assertTrue("Certificate is not installed properly", mDevicePolicyManager.hasCaCertInstalled(
	ADMIN_RECEIVER_COMPONENT, cert));

	// Exercise getInstalledCaCerts()
	verifyCaCert(cert);
	assertResult("getInstalledCaCerts()", true);

	// Verify that the CA cert was marked as installed by the Device Owner / Profile Owner.
	final String alias = keyStore.getCertificateAlias(caCert);
	assertNotNull(alias);
	verifyOwnerInstalledStatus(alias, true);

	// Exercise uninstallCaCert()
	removeCaCert(cert);
	assertResult("uninstallCaCert()", true);
	assertFalse("Certificate is not removed properly", mDevicePolicyManager.hasCaCertInstalled(
	ADMIN_RECEIVER_COMPONENT, cert));

	// Verify that the CA cert is no longer reported as installed by the Device Owner / Profile
	// Owner.
	verifyOwnerInstalledStatus(alias, false);

	// Clear delegated cert installer.
	// Tests after this are expected to fail.
	mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);

	installCaCert(cert);
	assertResult("installCaCert", false);
	}

	public void testInstallKeyPair() throws InterruptedException, KeyChainException {
	final String alias = "delegated-cert-installer-test-key";

	// Clear delegated cert installer.
	mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);
	// The app is not the cert installer , it shouldn't have have privilege to call
	// installKeyPair().
	installKeyPair(TestCertificates.TEST_KEY, TestCertificates.TEST_CERT, alias);
	assertResult("installKeyPair", false);

	// Set the app to be cert installer.
	mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT,
	CERT_INSTALLER_PACKAGE);
	assertEquals(CERT_INSTALLER_PACKAGE,
	mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT));

	// Exercise installKeyPair()
	installKeyPair(TestCertificates.TEST_KEY, TestCertificates.TEST_CERT, alias);
	assertResult("installKeyPair", true);
	}

	/**
	* If DPC is targeting N+, @{link IllegalArgumentException } should be thrown if the package
	* is missing.
	*/
	public void testSetNotExistCertInstallerPackage() throws Exception {
	boolean shouldThrowException = getTargetApiLevel() >= Build.VERSION_CODES.N;
	try {
	mDevicePolicyManager.setCertInstallerPackage(
	ADMIN_RECEIVER_COMPONENT, NOT_EXIST_CERT_INSTALLER_PACKAGE);
	if (shouldThrowException) {
	fail("Did not throw IllegalArgumentException");
	}
	} catch (IllegalArgumentException ex) {
	if (!shouldThrowException) {
	fail("Should not throw exception");
	}
	MoreAsserts.assertContainsRegex("is not installed on the current user",
	ex.getMessage());
	}
	if (!shouldThrowException) {
	assertTrue("Cert install delegate was not set on uninstalled package",
	NOT_EXIST_CERT_INSTALLER_PACKAGE.equals(
	mDevicePolicyManager
	.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT)));
	}
	}

	public void testSettingDelegatedCertInstallerAPICompatibility_oldSetNewGet() {
	// Set a delegated cert installer using the deprecated API and verify that the same
	// package is considered as the delegated cert installer using the new API.
	mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT,
	CERT_INSTALLER_PACKAGE);
	assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT))
	.isEqualTo(CERT_INSTALLER_PACKAGE);
	assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
	DELEGATION_CERT_INSTALL)).containsExactly(CERT_INSTALLER_PACKAGE);

	// Remove a delegate using the old API, make sure no delegates are found using
	// the new API.
	mDevicePolicyManager.setCertInstallerPackage(ADMIN_RECEIVER_COMPONENT, null);
	assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT)).isNull();
	assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
	DELEGATION_CERT_INSTALL)).isEmpty();
	}

	public void testSettingDelegatedCertInstallerAPICompatibility_newSetOldGet() {
	// Set a delegate using the new API, verify that the deprecated API returns the same
	// delegate.
	setDelegatedScopes(CERT_INSTALLER_PACKAGE, CERT_INSTALL_SCOPES);
	assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
	DELEGATION_CERT_INSTALL)).containsExactly(CERT_INSTALLER_PACKAGE);
	assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT))
	.isEqualTo(CERT_INSTALLER_PACKAGE);

	// Remove the delegate using the new API, verify that the deprecated API returns null
	// as the current delegated cert installer.
	setDelegatedScopes(CERT_INSTALLER_PACKAGE, Arrays.asList());
	assertThat(mDevicePolicyManager.getDelegatePackages(ADMIN_RECEIVER_COMPONENT,
	DELEGATION_CERT_INSTALL)).isEmpty();
	assertThat(mDevicePolicyManager.getCertInstallerPackage(ADMIN_RECEIVER_COMPONENT)).isNull();
	}

	public void testCanReadEnrollmentSpecificId() throws InterruptedException {
	// Set the organization ID only if not already set, to avoid potential conflict
	// with other tests.
	if (mDevicePolicyManager.getEnrollmentSpecificId().isEmpty()) {
	mDevicePolicyManager.setOrganizationId("SOME_ID");
	}
	setDelegatedScopes(CERT_INSTALLER_PACKAGE, CERT_INSTALL_SCOPES);

	readEnrollmentId();
	assertResult("testCanReadEnrollmentSpecificId", true);
	}

	private void installCaCert(byte[] cert) {
	Intent intent = new Intent();
	intent.setAction(ACTION_INSTALL_CERT);
	intent.setComponent(CERT_INSTALLER_COMPONENT);
	intent.putExtra(EXTRA_CERT_DATA, cert);
	intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
	mContext.sendBroadcast(intent);
	}

	private void removeCaCert(byte[] cert) {
	Intent intent = new Intent();
	intent.setAction(ACTION_REMOVE_CERT);
	intent.setComponent(CERT_INSTALLER_COMPONENT);
	intent.putExtra(EXTRA_CERT_DATA, cert);
	intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
	mContext.sendBroadcast(intent);
	}

	private void verifyCaCert(byte[] cert) {
	Intent intent = new Intent();
	intent.setAction(ACTION_VERIFY_CERT);
	intent.setComponent(CERT_INSTALLER_COMPONENT);
	intent.putExtra(EXTRA_CERT_DATA, cert);
	intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
	mContext.sendBroadcast(intent);
	}

	private void verifyOwnerInstalledStatus(String alias, boolean expectOwnerInstalled) {
	final List<String> ownerInstalledCerts =
	mDevicePolicyManager.getOwnerInstalledCaCerts(Process.myUserHandle());
	assertNotNull(ownerInstalledCerts);
	assertEquals(expectOwnerInstalled, ownerInstalledCerts.contains(alias));
	}

	private void assertResult(String testName, Boolean expectSuccess) throws InterruptedException {
	assertTrue("Cert installer did not respond in time.",
	mAvailableResultSemaphore.tryAcquire(180, TimeUnit.SECONDS));
	synchronized (this) {
	if (expectSuccess) {
	assertTrue(testName + " failed unexpectedly.", mReceivedResult);
	assertNull(testName + " raised exception", mReceivedException);
	} else {
	assertFalse(testName + " succeeded unexpectedly.", mReceivedResult);
	assertTrue(testName + " did not raise SecurityException",
	mReceivedException != null &&
	mReceivedException instanceof SecurityException);
	}
	}
	}

	private void installKeyPair(String key, String cert, String alias) {
	Intent intent = new Intent();
	intent.setAction(ACTION_INSTALL_KEYPAIR);
	intent.setComponent(CERT_INSTALLER_COMPONENT);
	intent.putExtra(EXTRA_CERT_DATA, cert);
	intent.putExtra(EXTRA_KEY_DATA, key);
	intent.putExtra(EXTRA_KEY_ALIAS, alias);
	intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
	mContext.sendBroadcast(intent);
	}

	private void readEnrollmentId() {
	Intent intent = new Intent();
	intent.setAction(ACTION_READ_ENROLLMENT_SPECIFIC_ID);
	intent.setComponent(CERT_INSTALLER_COMPONENT);
	intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
	mContext.sendBroadcast(intent);
	}
	}