<?xml version="1.0" encoding="utf-8"?>

<!--
  ~ Copyright (C) 2022 The Android Open Source Project
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~      http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<network-security-config>
  <base-config>
    <trust-anchors>
      <certificates src="@raw/quicroot"/>
      <certificates src="system"/>
    </trust-anchors>
  </base-config>
  <!-- Since Android 9 (API 28) cleartext support is disabled by default, this
       causes some of our tests to fail (see crbug/1220357).
       The following configs allow http requests for the domains used in these
       tests.

       TODO(stefanoduo): Figure out if we really need to use http for these tests
  -->
  <domain-config cleartextTrafficPermitted="true">
    <!-- Used as the base URL by native test server (net::EmbeddedTestServer) -->
    <domain includeSubdomains="true">127.0.0.1</domain>
    <!-- Used by CronetHttpURLConnectionTest#testIOExceptionInterruptRethrown -->
    <domain includeSubdomains="true">localhost</domain>
    <!-- Used by CronetHttpURLConnectionTest#testBadIP -->
    <domain includeSubdomains="true">0.0.0.0</domain>
    <!-- Used by CronetHttpURLConnectionTest#testSetUseCachesFalse -->
    <domain includeSubdomains="true">host-cache-test-host</domain>
    <!-- Used by CronetHttpURLConnectionTest#testBadHostname -->
    <domain includeSubdomains="true">this-weird-host-name-does-not-exist</domain>
    <!-- Used by CronetUrlRequestContextTest#testHostResolverRules -->
    <domain includeSubdomains="true">some-weird-hostname</domain>
  </domain-config>
</network-security-config>