Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 27070cea authored by Benedict Wong's avatar Benedict Wong Committed by Automerger Merge Worker
Browse files

Merge "Update MODP groups for IKEv2/IPsec VPNs" am: da820447 am: 928b1e73 am: c0c67eea 

Change-Id: I5015dfabc132b2e5cd75ae35ec6e213164130023
parents 4c190a8d c0c67eea

services/core/java/com/android/server/connectivity/VpnIkev2Utils.java

+8 −2
Original line number Diff line number Diff line
@@ -17,7 +17,6 @@ 
package com.android.server.connectivity;



import static android.net.ConnectivityManager.NetworkCallback;

import static android.net.ipsec.ike.SaProposal.DH_GROUP_1024_BIT_MODP;

import static android.net.ipsec.ike.SaProposal.DH_GROUP_2048_BIT_MODP;

import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_CBC;

import static android.net.ipsec.ike.SaProposal.ENCRYPTION_ALGORITHM_AES_GCM_12;
@@ -85,6 +84,12 @@ import java.util.List; 
public class VpnIkev2Utils {

    private static final String TAG = VpnIkev2Utils.class.getSimpleName();



    // TODO: Use IKE library exposed constants when @SystemApi is updated.

    /** IANA-defined 3072 group for use in IKEv2 */

    private static final int DH_GROUP_3072_BIT_MODP = 15;

    /** IANA-defined 4096 group for use in IKEv2 */

    private static final int DH_GROUP_4096_BIT_MODP = 16;



    static IkeSessionParams buildIkeSessionParams(

            @NonNull Context context, @NonNull Ikev2VpnProfile profile, @NonNull Network network) {

        final IkeIdentification localId = parseIkeIdentification(profile.getUserIdentity());
@@ -177,8 +182,9 @@ public class VpnIkev2Utils { 


        // Add dh, prf for both builders

        for (final IkeSaProposal.Builder builder : Arrays.asList(normalModeBuilder, aeadBuilder)) {

            builder.addDhGroup(DH_GROUP_4096_BIT_MODP);

            builder.addDhGroup(DH_GROUP_3072_BIT_MODP);

            builder.addDhGroup(DH_GROUP_2048_BIT_MODP);

            builder.addDhGroup(DH_GROUP_1024_BIT_MODP);

            builder.addPseudorandomFunction(PSEUDORANDOM_FUNCTION_AES128_XCBC);

            builder.addPseudorandomFunction(PSEUDORANDOM_FUNCTION_HMAC_SHA1);

        }