<?xml version="1.0" encoding="utf-8"?>

<!--
Copyright 2016 The Chromium Authors
Use of this source code is governed by a BSD-style license that can be
found in the LICENSE file.
-->

<network-security-config>
  <base-config>
    <trust-anchors>
      <!--
        This should not usually be needed, as the test server code is supposed
        to inject the test certs into X509Util automatically (see e.g.
        EmbeddedTestServer::RegisterTestCerts()). However, there are setups
        in which this approach doesn't work:
         - When tests run against platform HttpEngine (AOSP_PLATFORM), the test
           server code is manipulating the state of the X509Util class on the
           test side, not the one used by the Cronet code under test
           (i.e. the platform code from the bootclasspath).
         - When tests run against the Java/fallback implementation, the code
           under test does not go through X509Util at all.
        We work around this issue by adding the certificates here, in addition
        to the X509Util test certificate injection mechanism.

        Note: this is only supported starting from API 24. In API<24, the
        Java/fallback implementation will sadly not trust the test certificates.
      -->
      <certificates src="@raw/quicroot" />
      <certificates src="@raw/root_ca_cert"/>
      <certificates src="system"/>
    </trust-anchors>
  </base-config>
  <!-- Since Android N (API 24?) it is possible to disable cleartext support.

       This is required to test that we are correctly handling this feature.
  -->
  <domain-config cleartextTrafficPermitted="false">
    <!-- Used by CronetUrlRequestTest#testCleartextTrafficBlocked -->
    <domain includeSubdomains="true">example.com</domain>
  </domain-config>

  <!-- Since Android 9 (API 28) cleartext support is disabled by default, this
       causes some of our tests to fail (see crbug/1220357).
       The following configs allow http requests for the domains used in these
       tests.

       TODO(stefanoduo): Figure out if we really need to use http for these tests
  -->
  <domain-config cleartextTrafficPermitted="true">
    <!-- Used as the base URL by native test server (net::EmbeddedTestServer) -->
    <domain includeSubdomains="true">127.0.0.1</domain>
    <!-- Used by CronetHttpURLConnectionTest#testIOExceptionInterruptRethrown -->
    <domain includeSubdomains="true">localhost</domain>
    <!-- Used by CronetHttpURLConnectionTest#testBadIP -->
    <domain includeSubdomains="true">0.0.0.0</domain>
    <!-- Used by CronetHttpURLConnectionTest#testSetUseCachesFalse -->
    <domain includeSubdomains="true">host-cache-test-host</domain>
    <!-- Used by CronetHttpURLConnectionTest#testBadHostname -->
    <domain includeSubdomains="true">this-weird-host-name-does-not-exist</domain>
    <!-- Used by CronetUrlRequestContextTest#testHostResolverRules -->
    <domain includeSubdomains="true">some-weird-hostname</domain>
    <!-- Used by CronetSystemProxyTest -->
    <domain includeSubdomains="true">test-hostname</domain>
    <!-- Used by HostnameTest -->
    <domain includeSubdomains="true">example-idn-begin-ss-end</domain>
    <domain includeSubdomains="true">xn--example-idn-begin--end-71b</domain>
  </domain-config>
</network-security-config>
