[TOFU] Implement a secure TOFU flow
Implement a secure TOFU flow for supporting devices, and
notifications about insecure connections in non-supporting
devices, when insecure configurations are not allowed.
Handle the case where insecure enterprise configurations are
allowed in the new and secure TOFU flow. In this mode, do not
disconnect the network, do not load certificates, and do not
notify the user about anything.
Display the correct certificate information in the dialog,
remove the email and 8-octet signature from the TOFU dialog, and
replace with user verifiable information: certificate expiration
date (locale adjusted) and a SHA-256 fingerprint of the server
certificate which is locally generated.
Network admins can calculate the fingerprint of their server
certificate and publish the result to their users, using:
openssl x509 -in server-cert.pem -noout -fingerprint -sha256
Updated-Overlayable: TRUE
Updated-PDD: TRUE
Bug: 267633332
Bug: 251910611
Bug: 250574778
Test: atest ClientModeImplTest InsecureEapNetworkHandlerTest
Test: atest WifiConfigManagerTest
Test: Integration test on R, and T devices with overlay setting
of insecure networks allowed and not allowed, and with new
configs and insecure (Do not validate) configs made with R.
Test: Functional test, UI verification with multiple locales
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:a5227527411bc24e6e2c6276f16559c7305b6783)
Merged-In: I5cac12cd8c52a8a9425e98dad0fb90893f53e374
Change-Id: I5cac12cd8c52a8a9425e98dad0fb90893f53e374
13 files changed
