LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disallow Reserved SPI Allocation

Browse Source 
Disallow the allocation of SPIs in the range
reserved for future use by RFC 4303.

Bug: 77205120
Test: runtest frameworks-net
Merged-In: I05e26ed34b5871f1a07d5bd7b58b79a64cd74b67
Change-Id: I05e26ed34b5871f1a07d5bd7b58b79a64cd74b67
(cherry picked from commit 7f606ee8e57d9d8b7c5d0cb2a78421aa02efb385)
This commit is contained in:
Nathan Harold
2018-03-28 08:52:51 -07:00
committed by Benedict Wong
parent ad2615cae5
commit 1b88f0e6ab
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/net/IpSecManager.java
View File

@@ -274,7 +274,8 @@ public final class IpSecManager {
* *
* @param destinationAddress the destination address for traffic bearing the requested SPI. * @param destinationAddress the destination address for traffic bearing the requested SPI.
* For inbound traffic, the destination should be an address currently assigned on-device. * For inbound traffic, the destination should be an address currently assigned on-device.
* @param requestedSpi the requested SPI, or '0' to allocate a random SPI * @param requestedSpi the requested SPI, or '0' to allocate a random SPI. The range 1-255 is
* reserved and may not be used. See RFC 4303 Section 2.1.
* @return the reserved SecurityParameterIndex * @return the reserved SecurityParameterIndex
* @throws {@link #ResourceUnavailableException} indicating that too many SPIs are * @throws {@link #ResourceUnavailableException} indicating that too many SPIs are
* currently allocated for this user * currently allocated for this user

5
services/core/java/com/android/server/IpSecService.java
View File

@@ -1065,7 +1065,10 @@ public class IpSecService extends IIpSecService.Stub {
public synchronized IpSecSpiResponse allocateSecurityParameterIndex( public synchronized IpSecSpiResponse allocateSecurityParameterIndex(
String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException { String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException {
checkInetAddress(destinationAddress); checkInetAddress(destinationAddress);
/* requestedSpi can be anything in the int range, so no check is needed. */ // RFC 4303 Section 2.1 - 0=local, 1-255=reserved.
if (requestedSpi > 0 && requestedSpi < 256) {
throw new IllegalArgumentException("ESP SPI must not be in the range of 0-255.");
}
checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex"); checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex");
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid()); UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());