summaryrefslogtreecommitdiff
path: root/core/java
diff options
context:
space:
mode:
Diffstat (limited to 'core/java')
-rw-r--r--core/java/android/net/Ikev2VpnProfile.java41
-rw-r--r--core/java/com/android/internal/net/VpnProfile.java46
2 files changed, 56 insertions, 31 deletions
diff --git a/core/java/android/net/Ikev2VpnProfile.java b/core/java/android/net/Ikev2VpnProfile.java
index cc1312bac180..b18e9be28eb5 100644
--- a/core/java/android/net/Ikev2VpnProfile.java
+++ b/core/java/android/net/Ikev2VpnProfile.java
@@ -16,6 +16,16 @@
package android.net;
+import static android.net.IpSecAlgorithm.AUTH_AES_CMAC;
+import static android.net.IpSecAlgorithm.AUTH_AES_XCBC;
+import static android.net.IpSecAlgorithm.AUTH_CRYPT_AES_GCM;
+import static android.net.IpSecAlgorithm.AUTH_CRYPT_CHACHA20_POLY1305;
+import static android.net.IpSecAlgorithm.AUTH_HMAC_SHA256;
+import static android.net.IpSecAlgorithm.AUTH_HMAC_SHA384;
+import static android.net.IpSecAlgorithm.AUTH_HMAC_SHA512;
+import static android.net.IpSecAlgorithm.CRYPT_AES_CBC;
+import static android.net.IpSecAlgorithm.CRYPT_AES_CTR;
+
import static com.android.internal.annotations.VisibleForTesting.Visibility;
import static com.android.internal.util.Preconditions.checkStringNotEmpty;
import static com.android.net.module.util.NetworkStackConstants.IPV6_MIN_MTU;
@@ -70,13 +80,28 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
private static final String EMPTY_CERT = "";
/** @hide */
- public static final List<String> DEFAULT_ALGORITHMS =
- Collections.unmodifiableList(Arrays.asList(
- IpSecAlgorithm.CRYPT_AES_CBC,
- IpSecAlgorithm.AUTH_HMAC_SHA256,
- IpSecAlgorithm.AUTH_HMAC_SHA384,
- IpSecAlgorithm.AUTH_HMAC_SHA512,
- IpSecAlgorithm.AUTH_CRYPT_AES_GCM));
+ public static final List<String> DEFAULT_ALGORITHMS;
+
+ private static void addAlgorithmIfSupported(List<String> algorithms, String ipSecAlgoName) {
+ if (IpSecAlgorithm.getSupportedAlgorithms().contains(ipSecAlgoName)) {
+ algorithms.add(ipSecAlgoName);
+ }
+ }
+
+ static {
+ final List<String> algorithms = new ArrayList<>();
+ addAlgorithmIfSupported(algorithms, CRYPT_AES_CBC);
+ addAlgorithmIfSupported(algorithms, CRYPT_AES_CTR);
+ addAlgorithmIfSupported(algorithms, AUTH_HMAC_SHA256);
+ addAlgorithmIfSupported(algorithms, AUTH_HMAC_SHA384);
+ addAlgorithmIfSupported(algorithms, AUTH_HMAC_SHA512);
+ addAlgorithmIfSupported(algorithms, AUTH_AES_XCBC);
+ addAlgorithmIfSupported(algorithms, AUTH_AES_CMAC);
+ addAlgorithmIfSupported(algorithms, AUTH_CRYPT_AES_GCM);
+ addAlgorithmIfSupported(algorithms, AUTH_CRYPT_CHACHA20_POLY1305);
+
+ DEFAULT_ALGORITHMS = Collections.unmodifiableList(algorithms);
+ }
@NonNull private final String mServerAddr;
@NonNull private final String mUserIdentity;
@@ -195,8 +220,6 @@ public final class Ikev2VpnProfile extends PlatformVpnProfile {
* @param allowedAlgorithms The list to be validated
*/
private static void validateAllowedAlgorithms(@NonNull List<String> algorithmNames) {
- VpnProfile.validateAllowedAlgorithms(algorithmNames);
-
// First, make sure no insecure algorithms were proposed.
if (algorithmNames.contains(IpSecAlgorithm.AUTH_HMAC_MD5)
|| algorithmNames.contains(IpSecAlgorithm.AUTH_HMAC_SHA1)) {
diff --git a/core/java/com/android/internal/net/VpnProfile.java b/core/java/com/android/internal/net/VpnProfile.java
index b7170d857da9..6e1d3ce9a297 100644
--- a/core/java/com/android/internal/net/VpnProfile.java
+++ b/core/java/com/android/internal/net/VpnProfile.java
@@ -30,7 +30,10 @@ import android.text.TextUtils;
import com.android.internal.annotations.VisibleForTesting;
import com.android.net.module.util.ProxyUtils;
+import java.io.UnsupportedEncodingException;
import java.net.InetAddress;
+import java.net.URLDecoder;
+import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Arrays;
@@ -74,6 +77,9 @@ public final class VpnProfile implements Cloneable, Parcelable {
private static final String ENCODED_NULL_PROXY_INFO = "\0\0\0\0";
+ /** Default URL encoding. */
+ private static final String DEFAULT_ENCODING = StandardCharsets.UTF_8.name();
+
// Entity fields.
@UnsupportedAppUsage
public final String key; // -1
@@ -129,9 +135,6 @@ public final class VpnProfile implements Cloneable, Parcelable {
/**
* The list of allowable algorithms.
- *
- * <p>This list is validated in the setter to ensure that encoding characters (list, value
- * delimiters) are not present in the algorithm names. See {@link #validateAllowedAlgorithms()}
*/
private List<String> mAllowedAlgorithms = new ArrayList<>(); // 19
public boolean isBypassable = false; // 20
@@ -196,11 +199,8 @@ public final class VpnProfile implements Cloneable, Parcelable {
*
* @param allowedAlgorithms the list of allowable algorithms, as listed in {@link
* IpSecAlgorithm}.
- * @throws IllegalArgumentException if any delimiters are used in algorithm names. See {@link
- * #VALUE_DELIMITER} and {@link LIST_DELIMITER}.
*/
public void setAllowedAlgorithms(List<String> allowedAlgorithms) {
- validateAllowedAlgorithms(allowedAlgorithms);
mAllowedAlgorithms = allowedAlgorithms;
}
@@ -297,7 +297,11 @@ public final class VpnProfile implements Cloneable, Parcelable {
// Either all must be present, or none must be.
if (values.length >= 24) {
- profile.mAllowedAlgorithms = Arrays.asList(values[19].split(LIST_DELIMITER));
+ profile.mAllowedAlgorithms = new ArrayList<>();
+ for (String algo : Arrays.asList(values[19].split(LIST_DELIMITER))) {
+ profile.mAllowedAlgorithms.add(URLDecoder.decode(algo, DEFAULT_ENCODING));
+ }
+
profile.isBypassable = Boolean.parseBoolean(values[20]);
profile.isMetered = Boolean.parseBoolean(values[21]);
profile.maxMtu = Integer.parseInt(values[22]);
@@ -348,7 +352,19 @@ public final class VpnProfile implements Cloneable, Parcelable {
builder.append(ENCODED_NULL_PROXY_INFO);
}
- builder.append(VALUE_DELIMITER).append(String.join(LIST_DELIMITER, mAllowedAlgorithms));
+ final List<String> encodedAlgoNames = new ArrayList<>();
+
+ try {
+ for (String algo : mAllowedAlgorithms) {
+ encodedAlgoNames.add(URLEncoder.encode(algo, DEFAULT_ENCODING));
+ }
+ } catch (UnsupportedEncodingException e) {
+ // Unexpected error
+ throw new IllegalStateException("Failed to encode algorithms.", e);
+ }
+
+ builder.append(VALUE_DELIMITER).append(String.join(LIST_DELIMITER, encodedAlgoNames));
+
builder.append(VALUE_DELIMITER).append(isBypassable);
builder.append(VALUE_DELIMITER).append(isMetered);
builder.append(VALUE_DELIMITER).append(maxMtu);
@@ -425,20 +441,6 @@ public final class VpnProfile implements Cloneable, Parcelable {
return true;
}
- /**
- * Validates that the provided list of algorithms does not contain illegal characters.
- *
- * @param allowedAlgorithms The list to be validated
- */
- public static void validateAllowedAlgorithms(List<String> allowedAlgorithms) {
- for (final String alg : allowedAlgorithms) {
- if (alg.contains(VALUE_DELIMITER) || alg.contains(LIST_DELIMITER)) {
- throw new IllegalArgumentException(
- "Algorithm contained illegal ('\0' or ',') character");
- }
- }
- }
-
/** Generates a hashcode over the VpnProfile. */
@Override
public int hashCode() {
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-08 09:54:04 +0000