LineageOS/android_packages_modules_Connectivity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disallow Reserved SPI Allocation

Browse Source 
Disallow the allocation of SPIs in the range
reserved for future use by RFC 4303.

Bug: 77205120
Test: runtest frameworks-net
Change-Id: I05e26ed34b5871f1a07d5bd7b58b79a64cd74b67
This commit is contained in:
Nathan Harold
2018-03-28 08:52:51 -07:00
committed by nharold
parent a6cf27f302
commit c37f6f6b89
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/net/IpSecManager.java
View File

@@ -274,7 +274,8 @@ public final class IpSecManager {
* *
* @param destinationAddress the destination address for traffic bearing the requested SPI. * @param destinationAddress the destination address for traffic bearing the requested SPI.
* For inbound traffic, the destination should be an address currently assigned on-device. * For inbound traffic, the destination should be an address currently assigned on-device.
* @param requestedSpi the requested SPI, or '0' to allocate a random SPI * @param requestedSpi the requested SPI, or '0' to allocate a random SPI. The range 1-255 is
* reserved and may not be used. See RFC 4303 Section 2.1.
* @return the reserved SecurityParameterIndex * @return the reserved SecurityParameterIndex
* @throws {@link #ResourceUnavailableException} indicating that too many SPIs are * @throws {@link #ResourceUnavailableException} indicating that too many SPIs are
* currently allocated for this user * currently allocated for this user

5
services/core/java/com/android/server/IpSecService.java
View File

@@ -1065,7 +1065,10 @@ public class IpSecService extends IIpSecService.Stub {
public synchronized IpSecSpiResponse allocateSecurityParameterIndex( public synchronized IpSecSpiResponse allocateSecurityParameterIndex(
String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException { String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException {
checkInetAddress(destinationAddress); checkInetAddress(destinationAddress);
/* requestedSpi can be anything in the int range, so no check is needed. */ // RFC 4303 Section 2.1 - 0=local, 1-255=reserved.
if (requestedSpi > 0 && requestedSpi < 256) {
throw new IllegalArgumentException("ESP SPI must not be in the range of 0-255.");
}
checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex"); checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex");
UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid()); UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());