From 90147e3222c243cad21521a83a493f78130066da Mon Sep 17 00:00:00 2001 From: Hai Shalom Date: Mon, 18 Mar 2019 15:37:19 -0700 Subject: [PATCH] [WPA3] Initialize Suite-B ciphers correctly based on the CA cert type Initialize Suite-B ciphers correctly based on the CA cert type. Read the cert type from key store, parse it and get the signature algorithm. Enforce SHA384, and initialize AllowedSuiteBCiphers based on the certificate type: RSA or ECSDA. Bug: 128861164 Test: Verify Suite-B initialized correctly with RSA and ECDSA certs. Test: Associate to SUITE_B_192 AP. Test: atest WifiNetworkSuggestionTest Change-Id: Ia9b8460caa586f695ed7aab3507ddeb4ecb8c3f3 --- wifi/java/android/net/wifi/WifiConfiguration.java | 4 ++-- .../src/android/net/wifi/WifiNetworkSuggestionTest.java | 6 ++---- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/wifi/java/android/net/wifi/WifiConfiguration.java b/wifi/java/android/net/wifi/WifiConfiguration.java index 476330052dcfd..bdb9cfa7cf14f 100644 --- a/wifi/java/android/net/wifi/WifiConfiguration.java +++ b/wifi/java/android/net/wifi/WifiConfiguration.java @@ -413,8 +413,8 @@ public class WifiConfiguration implements Parcelable { allowedKeyManagement.set(WifiConfiguration.KeyMgmt.SUITE_B_192); allowedGroupCiphers.set(WifiConfiguration.GroupCipher.GCMP_256); allowedGroupManagementCiphers.set(WifiConfiguration.GroupMgmtCipher.BIP_GMAC_256); - allowedSuiteBCiphers.set(WifiConfiguration.SuiteBCipher.ECDHE_ECDSA); - allowedSuiteBCiphers.set(WifiConfiguration.SuiteBCipher.ECDHE_RSA); + // Note: allowedSuiteBCiphers bitset will be set by the service once the + // certificates are attached to this profile requirePMF = true; break; case SECURITY_TYPE_OWE: diff --git a/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java b/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java index 2b0c7732e7ae7..4dfa96b8c6062 100644 --- a/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java +++ b/wifi/tests/src/android/net/wifi/WifiNetworkSuggestionTest.java @@ -179,12 +179,10 @@ public class WifiNetworkSuggestionTest { .get(WifiConfiguration.GroupCipher.GCMP_256)); assertTrue(suggestion.wifiConfiguration.allowedGroupManagementCiphers .get(WifiConfiguration.GroupMgmtCipher.BIP_GMAC_256)); - assertTrue(suggestion.wifiConfiguration.allowedSuiteBCiphers - .get(WifiConfiguration.SuiteBCipher.ECDHE_ECDSA)); - assertTrue(suggestion.wifiConfiguration.allowedSuiteBCiphers - .get(WifiConfiguration.SuiteBCipher.ECDHE_RSA)); assertTrue(suggestion.wifiConfiguration.requirePMF); assertNull(suggestion.wifiConfiguration.preSharedKey); + // allowedSuiteBCiphers are set according to the loaded certificate and cannot be tested + // here. } /**