1# 2# Copyright 2018 - The Android Open Source Project 3# 4# Licensed under the Apache License, Version 2.0 (the "License"); 5# you may not use this file except in compliance with the License. 6# You may obtain a copy of the License at 7# 8# http://www.apache.org/licenses/LICENSE-2.0 9# 10# Unless required by applicable law or agreed to in writing, software 11# distributed under the License is distributed on an "AS IS" BASIS, 12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13# See the License for the specific language governing permissions and 14# limitations under the License. 15 16import time 17 18from acts import asserts 19from acts.controllers.openwrt_ap import MOBLY_CONTROLLER_CONFIG_NAME as OPENWRT 20from acts.test_decorators import test_tracker_info 21from acts_contrib.test_utils.net import connectivity_const as cconst 22from acts_contrib.test_utils.net import connectivity_test_utils as cutils 23from acts_contrib.test_utils.net import net_test_utils as nutils 24from acts_contrib.test_utils.tel.tel_ims_utils import set_wfc_mode 25from acts_contrib.test_utils.net.net_test_utils import start_tcpdump 26from acts_contrib.test_utils.net.net_test_utils import stop_tcpdump 27from acts_contrib.test_utils.tel.tel_defines import WFC_MODE_DISABLED 28from acts_contrib.test_utils.tel.tel_test_utils import get_operator_name 29from acts_contrib.test_utils.wifi import wifi_test_utils as wutils 30from acts_contrib.test_utils.wifi.WifiBaseTest import WifiBaseTest 31from scapy.all import rdpcap 32from scapy.all import Scapy_Exception 33from scapy.all import TCP 34from scapy.all import UDP 35 36 37RST = 0x04 38SSID = wutils.WifiEnums.SSID_KEY 39 40 41class DnsOverTlsTest(WifiBaseTest): 42 """Tests for DNS-over-TLS.""" 43 44 def setup_class(self): 45 """Setup devices for DNS-over-TLS test and unpack params.""" 46 47 self.dut = self.android_devices[0] 48 if len(self.android_devices) > 1: 49 self.dut_b = self.android_devices[1] 50 for ad in self.android_devices: 51 ad.droid.setPrivateDnsMode(True) 52 if OPENWRT not in self.user_params: 53 nutils.verify_lte_data_and_tethering_supported(ad) 54 set_wfc_mode(self.log, ad, WFC_MODE_DISABLED) 55 req_params = ("ping_hosts",) 56 opt_params = ("ipv4_only_network", "ipv4_ipv6_network", 57 "dns_name", "configure_OpenWrt", "wifi_network") 58 self.unpack_userparams(req_param_names=req_params, 59 opt_param_names=opt_params) 60 61 if OPENWRT in self.user_params: 62 self.openwrt = self.access_points[0] 63 if hasattr(self, "configure_OpenWrt") and self.configure_OpenWrt == "skip": 64 self.dut.log.info("Skip configure Wifi interface due to config setup.") 65 else: 66 self.configure_openwrt_ap_and_start(wpa_network=True) 67 self.wifi_network = self.openwrt.get_wifi_network() 68 self.private_dns_servers = [self.dns_name] 69 self.openwrt.network_setting.setup_dns_server(self.dns_name) 70 else: 71 self.private_dns_servers = [cconst.DNS_GOOGLE_HOSTNAME, 72 cconst.DNS_QUAD9_HOSTNAME, 73 cconst.DNS_CLOUDFLARE_HOSTNAME] 74 self.tcpdump_pid = None 75 76 def teardown_test(self): 77 wutils.reset_wifi(self.dut) 78 79 def teardown_class(self): 80 for ad in self.android_devices: 81 ad.droid.setPrivateDnsMode(True) 82 83 if OPENWRT in self.user_params: 84 self.openwrt.network_setting.remove_dns_server() 85 86 def on_fail(self, test_name, begin_time): 87 self.dut.take_bug_report(test_name, begin_time) 88 89 def get_wifi_network(self, ipv6_supported): 90 if OPENWRT in self.user_params: 91 if ipv6_supported: 92 self.openwrt.network_setting.enable_ipv6() 93 else: 94 self.openwrt.network_setting.disable_ipv6() 95 return self.openwrt.get_wifi_network() 96 if ipv6_supported: 97 return self.ipv4_ipv6_network 98 return self.ipv4_only_network 99 100 def _start_tcp_dump(self, ad): 101 """Start tcpdump on the given dut. 102 103 Args: 104 ad: dut to run tcpdump on 105 """ 106 self.tcpdump_pid = start_tcpdump(ad, self.test_name) 107 108 def _stop_tcp_dump(self, ad): 109 """Stop tcpdump and pull it to the test run logs. 110 111 Args: 112 ad: dut to pull tcpdump from 113 """ 114 return stop_tcpdump(ad, self.tcpdump_pid, self.test_name) 115 116 def _verify_dns_queries_over_tls(self, pcap_file, tls=True): 117 """Verify if DNS queries were over TLS or not. 118 119 Args: 120 pcap_file: tcpdump file 121 tls: if queries should be over TLS or port 853 122 """ 123 try: 124 packets = rdpcap(pcap_file) 125 except Scapy_Exception: 126 asserts.fail("Not a valid pcap file") 127 for pkt in packets: 128 summary = "%s" % pkt.summary() 129 for host in self.ping_hosts: 130 host = host.split(".")[-2] 131 if tls and UDP in pkt and pkt[UDP].dport == 53 and \ 132 host in summary: 133 asserts.fail("Found query to port 53: %s" % summary) 134 elif not tls and TCP in pkt and pkt[TCP].dport == 853 and \ 135 not pkt[TCP].flags: 136 asserts.fail("Found query to port 853: %s" % summary) 137 138 def _verify_no_rst_packets_port_853(self, pcap_file): 139 """Verify if RST packets are found in the pcap file. 140 141 Args: 142 pcap_file: full path of tcpdump file 143 """ 144 packets = rdpcap(pcap_file) 145 for pkt in packets: 146 if TCP in pkt and pkt[TCP].flags == RST and pkt[TCP].dport == 853: 147 asserts.fail("Found RST packets: %s" % pkt.summary()) 148 149 def _test_private_dns_mode(self, ad, net, dns_mode, use_tls, hostname=None): 150 """Test private DNS mode. 151 152 Args: 153 ad: android device object 154 net: wifi network to connect to, LTE network if None 155 dns_mode: private DNS mode 156 use_tls: if True, the DNS packets should be encrypted 157 hostname: private DNS hostname to set to 158 """ 159 160 # set private dns mode 161 if dns_mode: 162 cutils.set_private_dns(self.dut, dns_mode, hostname) 163 164 # connect to wifi 165 if net: 166 wutils.start_wifi_connection_scan_and_ensure_network_found( 167 self.dut, net[SSID]) 168 wutils.wifi_connect(self.dut, net) 169 170 # start tcpdump on the device 171 self._start_tcp_dump(self.dut) 172 173 # ping hosts should pass 174 for host in self.ping_hosts: 175 self.log.info("Pinging %s" % host) 176 status = wutils.validate_connection(self.dut, host) 177 asserts.assert_true(status, "Failed to ping host %s" % host) 178 self.log.info("Ping successful") 179 180 # stop tcpdump 181 pcap_file = self._stop_tcp_dump(self.dut) 182 183 # verify DNS queries 184 self._verify_dns_queries_over_tls(pcap_file, use_tls) 185 186 # reset wifi 187 wutils.reset_wifi(self.dut) 188 189 def _test_invalid_private_dns(self, net, dns_mode, dns_hostname): 190 """Test private DNS with invalid hostname, which should failed the ping. 191 192 :param net: Wi-Fi network to connect to 193 :param dns_mode: private DNS mode 194 :param dns_hostname: private DNS hostname 195 :return: 196 """ 197 198 cutils.set_private_dns(self.dut, dns_mode, dns_hostname) 199 if net: 200 wutils.start_wifi_connection_scan_and_ensure_network_found( 201 self.dut, net[SSID]) 202 wutils.wifi_connect( 203 self.dut, net, assert_on_fail=False, check_connectivity=False) 204 205 self._start_tcp_dump(self.dut) 206 207 # ping hosts should NOT pass 208 ping_result = False 209 for host in self.ping_hosts: 210 self.log.info("Pinging %s" % host) 211 try: 212 ping_result = self.dut.droid.httpPing(host) 213 except: 214 pass 215 # Ping result should keep negative with invalid DNS, 216 # so once it's positive we should break, and the test should fail 217 if ping_result: 218 break 219 220 pcap_file = self._stop_tcp_dump(self.dut) 221 self._verify_dns_queries_over_tls(pcap_file, True) 222 wutils.reset_wifi(self.dut) 223 return ping_result 224 225 @test_tracker_info(uuid="2957e61c-d333-45fb-9ff9-2250c9c8535a") 226 def test_private_dns_mode_off_wifi_ipv4_only_network(self): 227 """Verify private dns mode off on ipv4 only network. 228 229 Steps: 230 1. Set private dns mode off 231 2. Connect to wifi network. DNS server supports DNS/TLS 232 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 233 4. Verify ping works to differnt hostnames 234 5. Verify that all queries go to port 53 235 """ 236 self._test_private_dns_mode(self.dut, 237 self.get_wifi_network(False), 238 cconst.PRIVATE_DNS_MODE_OFF, 239 False) 240 241 @test_tracker_info(uuid="ea036d22-25af-4df0-b6cc-0027bc1efbe9") 242 def test_private_dns_mode_off_wifi_ipv4_ipv6_network(self): 243 """Verify private dns mode off on ipv4-ipv6 network. 244 245 Steps: 246 1. Set private dns mode off 247 2. Connect to wifi network. DNS server supports DNS/TLS 248 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 249 4. Verify ping works to differnt hostnames 250 5. Verify that all queries go to port 53 251 """ 252 self._test_private_dns_mode(self.dut, 253 self.get_wifi_network(True), 254 cconst.PRIVATE_DNS_MODE_OFF, 255 False) 256 257 @test_tracker_info(uuid="4227abf4-0a75-4b4d-968c-dfc63052f5db") 258 def test_private_dns_mode_opportunistic_wifi_ipv4_only_network(self): 259 """Verify private dns mode opportunistic on ipv4 only network. 260 261 Steps: 262 1. Set private dns to opportunistic mode 263 2. Connect to wifi network. DNS server supports DNS/TLS 264 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 265 4. Verify ping works to differnt hostnames 266 5. Verify that all queries go to port 853 and encrypted 267 """ 268 self._test_private_dns_mode(self.dut, 269 self.get_wifi_network(False), 270 cconst.PRIVATE_DNS_MODE_OPPORTUNISTIC, 271 True) 272 273 @test_tracker_info(uuid="0c97cfef-4313-4346-b05b-395de63c5c3f") 274 def test_private_dns_mode_opportunistic_wifi_ipv4_ipv6_network(self): 275 """Verify private dns mode opportunistic on ipv4-ipv6 network. 276 277 Steps: 278 1. Set private dns to opportunistic mode 279 2. Connect to wifi network. DNS server supports DNS/TLS 280 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 281 4. Verify ping works to differnt hostnames 282 5. Verify that all queries go to port 853 283 """ 284 self._test_private_dns_mode(self.dut, 285 self.get_wifi_network(True), 286 cconst.PRIVATE_DNS_MODE_OPPORTUNISTIC, 287 True) 288 289 @test_tracker_info(uuid="b70569f1-2613-49d0-be49-fd3464dde305") 290 def test_private_dns_mode_strict_wifi_ipv4_only_network(self): 291 """Verify private dns mode strict on ipv4 only network. 292 293 Steps: 294 1. Set private dns to strict mode 295 2. Connect to wifi network. DNS server supports DNS/TLS 296 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 297 4. Verify ping works to differnt hostnames 298 5. Verify that all queries go to port 853 and encrypted 299 """ 300 for dns in self.private_dns_servers: 301 self._test_private_dns_mode(self.dut, 302 self.get_wifi_network(False), 303 cconst.PRIVATE_DNS_MODE_STRICT, 304 True, 305 dns) 306 307 @test_tracker_info(uuid="85738b52-823b-4c59-a0d5-219e2fab2929") 308 def test_private_dns_mode_strict_wifi_ipv4_ipv6_network(self): 309 """Verify private dns mode strict on ipv4-ipv6 network. 310 311 Steps: 312 1. Set private dns to strict mode 313 2. Connect to wifi network. DNS server supports DNS/TLS 314 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 315 4. Verify ping works to differnt hostnames 316 5. Verify that all queries go to port 853 and encrypted 317 """ 318 for dns in self.private_dns_servers: 319 self._test_private_dns_mode(self.dut, 320 self.get_wifi_network(True), 321 cconst.PRIVATE_DNS_MODE_STRICT, 322 True, 323 dns) 324 325 @test_tracker_info(uuid="727e280a-d2bd-463f-b2a1-653d4b3f7f29") 326 def test_private_dns_mode_off_vzw_carrier(self): 327 """Verify private dns mode off on VZW network. 328 329 Steps: 330 1. Set private dns mode off 331 2. Connect to wifi network. VZW doesn't support DNS/TLS 332 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 333 4. Verify ping works to differnt hostnames 334 5. Verify that all queries go to port 53 335 """ 336 carrier = get_operator_name(self.log, self.dut_b) 337 asserts.skip_if(carrier != "vzw", "Carrier is not Verizon") 338 self._test_private_dns_mode(self.dut_b, 339 None, 340 cconst.PRIVATE_DNS_MODE_OFF, 341 False) 342 343 @test_tracker_info(uuid="b16f6e2c-a24f-4efe-9003-2bfaf28b8d5e") 344 def test_private_dns_mode_off_tmo_carrier(self): 345 """Verify private dns mode off on TMO network. 346 347 Steps: 348 1. Set private dns to off mode 349 2. Connect to wifi network. TMO supports DNS/TLS 350 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 351 4. Verify ping works to differnt hostnames 352 5. Verify that all queries go to port 53 353 """ 354 carrier = get_operator_name(self.log, self.dut) 355 asserts.skip_if(carrier != "tmo", "Carrier is not T-mobile") 356 self._test_private_dns_mode(self.dut, 357 None, 358 cconst.PRIVATE_DNS_MODE_OFF, 359 False) 360 361 @test_tracker_info(uuid="edfa7bfe-3e52-46b4-9d72-7c6c300b3680") 362 def test_private_dns_mode_opportunistic_vzw_carrier(self): 363 """Verify private dns mode opportunistic on VZW network. 364 365 Steps: 366 1. Set private dns mode opportunistic 367 2. Connect to wifi network. VZW doesn't support DNS/TLS 368 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 369 4. Verify ping works to differnt hostnames 370 5. Verify that all queries go to port 53 371 """ 372 carrier = get_operator_name(self.log, self.dut_b) 373 asserts.skip_if(carrier != "vzw", "Carrier is not Verizon") 374 self._test_private_dns_mode(self.dut_b, 375 None, 376 cconst.PRIVATE_DNS_MODE_OPPORTUNISTIC, 377 False) 378 379 @test_tracker_info(uuid="41c3f2c4-11b7-4bb8-a3c9-fac63f6822f6") 380 def test_private_dns_mode_opportunistic_tmo_carrier(self): 381 """Verify private dns mode opportunistic on TMO network. 382 383 Steps: 384 1. Set private dns mode opportunistic 385 2. Connect to wifi network. TMP supports DNS/TLS 386 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 387 4. Verify ping works to differnt hostnames 388 5. Verify that all queries go to port 853 and encrypted 389 """ 390 carrier = get_operator_name(self.log, self.dut) 391 asserts.skip_if(carrier != "tmo", "Carrier is not T-mobile") 392 self._test_private_dns_mode(self.dut, 393 None, 394 cconst.PRIVATE_DNS_MODE_OPPORTUNISTIC, 395 True) 396 397 @test_tracker_info(uuid="65fd2052-f0c0-4446-b353-7ed2273e6c95") 398 def test_private_dns_mode_strict_vzw_carrier(self): 399 """Verify private dns mode strict on VZW network. 400 401 Steps: 402 1. Set private dns mode strict 403 2. Connect to wifi network. VZW doesn't support DNS/TLS 404 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 405 4. Verify ping works to differnt hostnames 406 5. Verify that all queries go to port 853 and encrypted 407 """ 408 carrier = get_operator_name(self.log, self.dut_b) 409 asserts.skip_if(carrier != "vzw", "Carrier is not Verizon") 410 for dns in self.private_dns_servers: 411 self._test_private_dns_mode(self.dut_b, 412 None, 413 cconst.PRIVATE_DNS_MODE_STRICT, 414 True, 415 dns) 416 417 @test_tracker_info(uuid="bca141f7-06c9-4e44-854e-4bdb9443b2da") 418 def test_private_dns_mode_strict_tmo_carrier(self): 419 """Verify private dns mode strict on TMO network. 420 421 Steps: 422 1. Set private dns mode strict 423 2. Connect to wifi network. TMO supports DNS/TLS 424 3. Run HTTP ping to amazon.com, facebook.com, netflix.com 425 4. Verify ping works to differnt hostnames 426 5. Verify that all queries go to port 853 and encrypted 427 """ 428 carrier = get_operator_name(self.log, self.dut) 429 asserts.skip_if(carrier != "tmo", "Carrier is not T-mobile") 430 for dns in self.private_dns_servers: 431 self._test_private_dns_mode(self.dut, 432 None, 433 cconst.PRIVATE_DNS_MODE_STRICT, 434 True, 435 dns) 436 437 @test_tracker_info(uuid="7d977987-d9e3-4be1-b8fc-e5a84050ed48") 438 def test_private_dns_mode_opportunistic_connectivity_toggle_networks(self): 439 """Verify private DNS opportunistic mode connectivity by toggling networks. 440 441 Steps: 442 1. Set private DNS opportunistic mode 443 2. DUT is connected to mobile network 444 3. Verify connectivity and DNS queries going to port 853 for TMO 445 and port 53 for VZW 446 4. Switch to wifi network set with private DNS server 447 5. Verify connectivity and DNS queries going to port 853 448 6. Switch back to mobile network 449 7. Verify connectivity and DNS queries going to port 853 for TMO 450 and port 53 for VZW 451 8. Repeat steps 1-7 for TMO, VZW and different private DNS servers 452 """ 453 for ad in self.android_devices: 454 carrier = get_operator_name(self.log, ad) 455 self.log.info("Carrier is: %s" % carrier) 456 use_tls = True if carrier == "tmo" else False 457 for dns in self.private_dns_servers: 458 self.log.info("Setting opportunistic private dns mode") 459 # set private dns mode 460 cutils.set_private_dns(ad, cconst.PRIVATE_DNS_MODE_OPPORTUNISTIC) 461 462 # verify dns over tls on mobile network 463 self._test_private_dns_mode( 464 self.dut, None, None, use_tls, dns) 465 466 # verify dns over tls on wifi network 467 self._test_private_dns_mode( 468 self.dut, self.ipv4_ipv6_network, None, True, dns) 469 470 # verify dns over tls on mobile network 471 wutils.reset_wifi(self.dut) 472 self._test_private_dns_mode( 473 self.dut, None, None, use_tls, dns) 474 475 @test_tracker_info(uuid="bc2f228f-e288-4539-a4b9-c02968209985") 476 def test_private_dns_mode_strict_connectivity_toggle_networks(self): 477 """Verify private DNS strict mode connectivity by toggling networks. 478 479 Steps: 480 1. Set private DNS strict mode 481 2. DUT is connected to mobile network 482 3. Verify connectivity and DNS queries going to port 853 483 4. Switch to wifi network 484 5. Verify connectivity and DNS queries going to port 853 485 6. Switch back to mobile network 486 7. Verify connectivity and DNS queries going to port 853 487 8. Repeat steps 1-7 for TMO, VZW and different private DNS servers 488 """ 489 for ad in self.android_devices: 490 self.log.info("Carrier is: %s" % get_operator_name(self.log, ad)) 491 for dns in self.private_dns_servers: 492 self.log.info("Setting strict mode private dns: %s" % dns) 493 # set private dns mode 494 cutils.set_private_dns(ad, cconst.PRIVATE_DNS_MODE_STRICT, dns) 495 496 # verify dns over tls on mobile network 497 self._test_private_dns_mode( 498 self.dut, None, None, True, dns) 499 500 # verify dns over tls on wifi network 501 self._test_private_dns_mode( 502 self.dut, self.ipv4_ipv6_network, None, True, dns) 503 504 # verify dns over tls on mobile network 505 wutils.reset_wifi(self.dut) 506 self._test_private_dns_mode( 507 self.dut, None, None, True, dns) 508 509 @test_tracker_info(uuid="1426673a-7728-4df7-8de5-dfb3529ada62") 510 def test_dns_server_link_properties_strict_mode(self): 511 """Verify DNS server in the link properties when set in strict mode. 512 513 Steps: 514 1. Set DNS server hostname in Private DNS settings (stict mode) 515 2. Verify that DNS server set in settings is in link properties 516 3. Verify for WiFi as well as LTE 517 """ 518 # start tcpdump on device 519 self._start_tcp_dump(self.dut) 520 521 # set private DNS to strict mode 522 cutils.set_private_dns( 523 self.dut, cconst.PRIVATE_DNS_MODE_STRICT, cconst.DNS_GOOGLE_HOSTNAME) 524 525 # connect DUT to wifi network 526 wutils.start_wifi_connection_scan_and_ensure_network_found( 527 self.dut, self.ipv4_ipv6_network[SSID]) 528 wutils.wifi_connect(self.dut, self.ipv4_ipv6_network) 529 for host in self.ping_hosts: 530 wutils.validate_connection(self.dut, host) 531 532 # DNS server in link properties for wifi network 533 link_prop = self.dut.droid.connectivityGetActiveLinkProperties() 534 wifi_dns_servers = link_prop["PrivateDnsServerName"] 535 self.log.info("Link prop: %s" % wifi_dns_servers) 536 537 # DUT is on LTE data 538 wutils.reset_wifi(self.dut) 539 time.sleep(1) # wait till lte network becomes active 540 for host in self.ping_hosts: 541 wutils.validate_connection(self.dut, host) 542 543 # DNS server in link properties for cell network 544 link_prop = self.dut.droid.connectivityGetActiveLinkProperties() 545 lte_dns_servers = link_prop["PrivateDnsServerName"] 546 self.log.info("Link prop: %s" % lte_dns_servers) 547 548 # stop tcpdump on device 549 pcap_file = self._stop_tcp_dump(self.dut) 550 551 # Verify DNS server in link properties 552 asserts.assert_true(cconst.DNS_GOOGLE_HOSTNAME in wifi_dns_servers, 553 "Hostname not in link properties - wifi network") 554 asserts.assert_true(cconst.DNS_GOOGLE_HOSTNAME in lte_dns_servers, 555 "Hostname not in link properites - cell network") 556 557 @test_tracker_info(uuid="525a6f2d-9751-474e-a004-52441091e427") 558 def test_dns_over_tls_no_reset_packets(self): 559 """Verify there are no TCP packets with RST flags on port 853. 560 561 Steps: 562 1. Enable opportunistic or strict mode 563 2. Ping hosts and verify that there are TCP pkts with RST flags 564 """ 565 # start tcpdump on device 566 self._start_tcp_dump(self.dut) 567 568 # set private DNS to opportunistic mode 569 cutils.set_private_dns(self.dut, cconst.PRIVATE_DNS_MODE_OPPORTUNISTIC) 570 571 # connect DUT to wifi network 572 wutils.start_wifi_connection_scan_and_ensure_network_found( 573 self.dut, self.ipv4_ipv6_network[SSID]) 574 wutils.wifi_connect(self.dut, self.ipv4_ipv6_network) 575 for host in self.ping_hosts: 576 wutils.validate_connection(self.dut, host) 577 578 579 # stop tcpdump on device 580 pcap_file = self._stop_tcp_dump(self.dut) 581 582 # check that there no RST TCP packets 583 self._verify_no_rst_packets_port_853(pcap_file) 584 585 @test_tracker_info(uuid="af6e34f1-3ad5-4ab0-b3b9-53008aa08294") 586 def test_private_dns_mode_strict_invalid_hostnames(self): 587 """Verify that invalid hostnames are not able to ping for strict mode. 588 589 Steps: 590 1. Set private DNS to strict mode with invalid hostname 591 2. Verify that invalid hostname is not saved 592 """ 593 invalid_hostnames = ["!%@&!*", "12093478129", "9.9.9.9", "sdkfjhasdf"] 594 for dns_hostname in invalid_hostnames: 595 ping_result = self._test_invalid_private_dns( 596 self.get_wifi_network(False), 597 cconst.PRIVATE_DNS_MODE_STRICT, 598 dns_hostname) 599 asserts.assert_false(ping_result, "Ping success with invalid DNS.") 600 601