Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disallow PAP authentication when MPPE is requested

Browse Source 
MPPE cannot work if PAP is used as authentication, so it is not useful
to allow PAP authentication when MPPE is enforced: establishing the
tunnel would fail anyway with "MPPE required, but MS-CHAP[v2] auth not
performed".
Also users enforcing MPPE may assume that this means PAP will not be
used for authentication, so without this change MPPE enforcement gives a
false sense of security, as PAP uses plain-text credentials.

Bug: 201660636
Test: atest VpnTest
Merged-In: Ie318d45fe44294e97cf38da7f1834cf014cb4417
Change-Id: Ie318d45fe44294e97cf38da7f1834cf014cb4417
(cherry picked from commit 997a4a3926)
This commit is contained in:
Remi NGUYEN VAN
2022-02-28 18:02:27 +09:00
parent 74f9b7f432
commit 4f319df8ff
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
services/core/java/com/android/server/connectivity/Vpn.java
View File

@@ -2023,6 +2023,13 @@ public class Vpn {
"usepeerdns", "idle", "1800", "mtu", "1400", "mru", "1400", "usepeerdns", "idle", "1800", "mtu", "1400", "mru", "1400",
(profile.mppe ? "+mppe" : "nomppe"), (profile.mppe ? "+mppe" : "nomppe"),
}; };
if (profile.mppe) {
// Disallow PAP authentication when MPPE is requested, as MPPE cannot work
// with PAP anyway, and users may not expect PAP (plain text) to be used when
// MPPE was requested.
mtpd = Arrays.copyOf(mtpd, mtpd.length + 1);
mtpd[mtpd.length - 1] = "-pap";
}
break; break;
case VpnProfile.TYPE_L2TP_IPSEC_PSK: case VpnProfile.TYPE_L2TP_IPSEC_PSK:
case VpnProfile.TYPE_L2TP_IPSEC_RSA: case VpnProfile.TYPE_L2TP_IPSEC_RSA: