Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove UdpEncapsulationSocket references in VPNs

Browse Source 
This is a clean cherry-pick from aosp/1237527

This changes the IkeSessionParams generation to set a specific Network,
and no longer passes a UDP encapsulation socket.

Bug: 149356682
Test: FrameworksNetTests passing.
Change-Id: I69f184762490b1dd3d3261d00c81fd32bbebddfc
This commit is contained in:
Benedict Wong
2020-02-17 16:36:18 -08:00
committed by evitayan
parent a2668e55dc
commit 818dca1aad
2 changed files with 5 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/core/java/com/android/server/connectivity/Vpn.java
View File

@@ -52,7 +52,6 @@ import android.net.Ikev2VpnProfile;
import android.net.IpPrefix;
import android.net.IpSecManager;
import android.net.IpSecManager.IpSecTunnelInterface;
import android.net.IpSecManager.UdpEncapsulationSocket;
import android.net.IpSecTransform;
import android.net.LinkAddress;
import android.net.LinkProperties;
@@ -2201,7 +2200,6 @@ public class Vpn {
/** Signal to ensure shutdown is honored even if a new Network is connected. */
private boolean mIsRunning = true;
@Nullable private UdpEncapsulationSocket mEncapSocket;
@Nullable private IpSecTunnelInterface mTunnelIface;
@Nullable private IkeSession mSession;
@Nullable private Network mActiveNetwork;
@@ -2352,12 +2350,8 @@ public class Vpn {
resetIkeState();
mActiveNetwork = network;
// TODO(b/149356682): Update this based on new IKE API
mEncapSocket = mIpSecManager.openUdpEncapsulationSocket();
// TODO(b/149356682): Update this based on new IKE API
final IkeSessionParams ikeSessionParams =
VpnIkev2Utils.buildIkeSessionParams(mProfile, mEncapSocket);
VpnIkev2Utils.buildIkeSessionParams(mContext, mProfile, network);
final ChildSessionParams childSessionParams =
VpnIkev2Utils.buildChildSessionParams();
@@ -2370,11 +2364,6 @@ public class Vpn {
network);
mNetd.setInterfaceUp(mTunnelIface.getInterfaceName());
// Socket must be bound to prevent network switches from causing
// the IKE teardown to fail/timeout.
// TODO(b/149356682): Update this based on new IKE API
network.bindSocket(mEncapSocket.getFileDescriptor());
mSession = mIkev2SessionCreator.createIkeSession(
mContext,
ikeSessionParams,
@@ -2459,16 +2448,6 @@ public class Vpn {
mSession.kill(); // Kill here to make sure all resources are released immediately
mSession = null;
}
// TODO(b/149356682): Update this based on new IKE API
if (mEncapSocket != null) {
try {
mEncapSocket.close();
} catch (IOException e) {
Log.e(TAG, "Failed to close encap socket", e);
}
mEncapSocket = null;
}
}
/**

8
services/core/java/com/android/server/connectivity/VpnIkev2Utils.java
View File

@@ -35,10 +35,10 @@ import static android.net.ipsec.ike.SaProposal.PSEUDORANDOM_FUNCTION_AES128_XCBC
import static android.net.ipsec.ike.SaProposal.PSEUDORANDOM_FUNCTION_HMAC_SHA1;
import android.annotation.NonNull;
import android.content.Context;
import android.net.Ikev2VpnProfile;
import android.net.InetAddresses;
import android.net.IpPrefix;
import android.net.IpSecManager.UdpEncapsulationSocket;
import android.net.IpSecTransform;
import android.net.Network;
import android.net.RouteInfo;
@@ -84,7 +84,7 @@ import java.util.List;
*/
public class VpnIkev2Utils {
static IkeSessionParams buildIkeSessionParams(
@NonNull Ikev2VpnProfile profile, @NonNull UdpEncapsulationSocket socket) {
@NonNull Context context, @NonNull Ikev2VpnProfile profile, @NonNull Network network) {
// TODO(b/149356682): Update this based on new IKE API. Only numeric addresses supported
// until then. All others throw IAE (caught by caller).
final InetAddress serverAddr = InetAddresses.parseNumericAddress(profile.getServerAddr());
@@ -93,9 +93,9 @@ public class VpnIkev2Utils {
// TODO(b/149356682): Update this based on new IKE API.
final IkeSessionParams.Builder ikeOptionsBuilder =
new IkeSessionParams.Builder()
new IkeSessionParams.Builder(context)
.setServerAddress(serverAddr)
.setUdpEncapsulationSocket(socket)
.setNetwork(network)
.setLocalIdentification(localId)
.setRemoteIdentification(remoteId);
setIkeAuth(profile, ikeOptionsBuilder);