Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Update MODP groups for IKEv2/IPsec VPNs" am: da820447b2

Browse Source 
Change-Id: I2a8b8ef4c18176b59a343092b2323472c672f267
This commit is contained in:
Benedict Wong
2020-04-30 17:43:40 +00:00
committed by Automerger Merge Worker
parent 9544c8a20b da820447b2
commit 928b1e7334
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
services/core/java/com/android/server/connectivity/VpnIkev2Utils.java
View File

@@ -17,7 +17,6 @@
package com.android.server.connectivity; package com.android.server.connectivity;
import static android.net.ConnectivityManager.NetworkCallback; import static android.net.ConnectivityManager.NetworkCallback;
import static android.net.ipsec.ike.SaProposal.DH_GROUP_1024_BIT_MODP;
import static android.net.ipsec.ike.SaProposal.DH_GROUP_2048_BIT_MODP; import static android.net.ipsec.ike.SaProposal.DH_GROUP_2048_BIT_MODP;
import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_CBC; import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_CBC;
import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_GCM_12; import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_GCM_12;
@@ -85,6 +84,12 @@ import java.util.List;
public class VpnIkev2Utils { public class VpnIkev2Utils {
private static final String TAG = VpnIkev2Utils.class.getSimpleName(); private static final String TAG = VpnIkev2Utils.class.getSimpleName();
// TODO: Use IKE library exposed constants when @SystemApi is updated.
/** IANA-defined 3072 group for use in IKEv2 */
private static final int DH_GROUP_3072_BIT_MODP = 15;
/** IANA-defined 4096 group for use in IKEv2 */
private static final int DH_GROUP_4096_BIT_MODP = 16;
static IkeSessionParams buildIkeSessionParams( static IkeSessionParams buildIkeSessionParams(
@NonNull Context context, @NonNull Ikev2VpnProfile profile, @NonNull Network network) { @NonNull Context context, @NonNull Ikev2VpnProfile profile, @NonNull Network network) {
final IkeIdentification localId = parseIkeIdentification(profile.getUserIdentity()); final IkeIdentification localId = parseIkeIdentification(profile.getUserIdentity());
@@ -177,8 +182,9 @@ public class VpnIkev2Utils {
// Add dh, prf for both builders // Add dh, prf for both builders
for (final IkeSaProposal.Builder builder : Arrays.asList(normalModeBuilder, aeadBuilder)) { for (final IkeSaProposal.Builder builder : Arrays.asList(normalModeBuilder, aeadBuilder)) {
builder.addDhGroup(DH_GROUP_4096_BIT_MODP);
builder.addDhGroup(DH_GROUP_3072_BIT_MODP);
builder.addDhGroup(DH_GROUP_2048_BIT_MODP); builder.addDhGroup(DH_GROUP_2048_BIT_MODP);
builder.addDhGroup(DH_GROUP_1024_BIT_MODP);
builder.addPseudorandomFunction(PSEUDORANDOM_FUNCTION_AES128_XCBC); builder.addPseudorandomFunction(PSEUDORANDOM_FUNCTION_AES128_XCBC);
builder.addPseudorandomFunction(PSEUDORANDOM_FUNCTION_HMAC_SHA1); builder.addPseudorandomFunction(PSEUDORANDOM_FUNCTION_HMAC_SHA1);
} }