diff options
| author | Remi NGUYEN VAN <reminv@google.com> | 2022-02-28 18:02:27 +0900 |
|---|---|---|
| committer | mosimchah <mosimchah@gmail.com> | 2022-06-14 12:05:32 -0400 |
| commit | 1f21fd89914a94940ac21e44dea5d796dd6a303b (patch) | |
| tree | 23eff75eb91af4a93e0ed1c18196b70dd0fce856 | |
| parent | 6e13c1104bbca796cd5b7dabfddd98c98e183629 (diff) | |
Disallow PAP authentication when MPPE is requestedr11.1
MPPE cannot work if PAP is used as authentication, so it is not useful
to allow PAP authentication when MPPE is enforced: establishing the
tunnel would fail anyway with "MPPE required, but MS-CHAP[v2] auth not
performed".
Also users enforcing MPPE may assume that this means PAP will not be
used for authentication, so without this change MPPE enforcement gives a
false sense of security, as PAP uses plain-text credentials.
Bug: 201660636
Test: atest VpnTest
Merged-In: Ie318d45fe44294e97cf38da7f1834cf014cb4417
Change-Id: Ie318d45fe44294e97cf38da7f1834cf014cb4417
(cherry picked from commit 997a4a39268b4f3af7ccc388269b5eb1972d3624)
(cherry picked from commit 4f319df8ff5a4b9f2bc62cb17df972e40b57fc81)
Merged-In: Ie318d45fe44294e97cf38da7f1834cf014cb4417
| -rw-r--r-- | services/core/java/com/android/server/connectivity/Vpn.java | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/services/core/java/com/android/server/connectivity/Vpn.java b/services/core/java/com/android/server/connectivity/Vpn.java index 9edb0e440baa..8f9b5ca26e1b 100644 --- a/services/core/java/com/android/server/connectivity/Vpn.java +++ b/services/core/java/com/android/server/connectivity/Vpn.java @@ -2157,6 +2157,13 @@ public class Vpn { "usepeerdns", "idle", "1800", "mtu", "1400", "mru", "1400", (profile.mppe ? "+mppe" : "nomppe"), }; + if (profile.mppe) { + // Disallow PAP authentication when MPPE is requested, as MPPE cannot work + // with PAP anyway, and users may not expect PAP (plain text) to be used when + // MPPE was requested. + mtpd = Arrays.copyOf(mtpd, mtpd.length + 1); + mtpd[mtpd.length - 1] = "-pap"; + } break; case VpnProfile.TYPE_L2TP_IPSEC_PSK: case VpnProfile.TYPE_L2TP_IPSEC_RSA: |