LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge "Disallow Reserved SPI Allocation" into pi-dev

Browse Source
This commit is contained in:
Benedict Wong
2018-03-30 22:29:26 +00:00
committed by Android (Google) Code Review
parent cafd11d598 1b88f0e6ab
commit 97e1f5b953
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/net/IpSecManager.java
View File

@@ -274,7 +274,8 @@ public final class IpSecManager {
* *
* @param destinationAddress the destination address for traffic bearing the requested SPI. * @param destinationAddress the destination address for traffic bearing the requested SPI.
* For inbound traffic, the destination should be an address currently assigned on-device. * For inbound traffic, the destination should be an address currently assigned on-device.
* @param requestedSpi the requested SPI, or '0' to allocate a random SPI * @param requestedSpi the requested SPI, or '0' to allocate a random SPI. The range 1-255 is
* reserved and may not be used. See RFC 4303 Section 2.1.
* @return the reserved SecurityParameterIndex * @return the reserved SecurityParameterIndex
* @throws {@link #ResourceUnavailableException} indicating that too many SPIs are * @throws {@link #ResourceUnavailableException} indicating that too many SPIs are
* currently allocated for this user * currently allocated for this user

5
services/core/java/com/android/server/IpSecService.java
View File

@@ -1065,7 +1065,10 @@ public class IpSecService extends IIpSecService.Stub {
public synchronized IpSecSpiResponse allocateSecurityParameterIndex( public synchronized IpSecSpiResponse allocateSecurityParameterIndex(
String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException { String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException {
checkInetAddress(destinationAddress); checkInetAddress(destinationAddress);
/* requestedSpi can be anything in the int range, so no check is needed. */ // RFC 4303 Section 2.1 - 0=local, 1-255=reserved.
if (requestedSpi > 0 && requestedSpi < 256) {
throw new IllegalArgumentException("ESP SPI must not be in the range of 0-255.");
}
checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex"); checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex");
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid()); UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());