Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35147b2d authored by Benedict Wong's avatar Benedict Wong Committed by Android (Google) Code Review
Browse files

Merge "Disallow Reserved SPI Allocation" into pi-dev

parents dbd39fc6 0f8c8bb0

core/java/android/net/IpSecManager.java

+2 −1
Original line number Diff line number Diff line
@@ -274,7 +274,8 @@ public final class IpSecManager { 
     *

     * @param destinationAddress the destination address for traffic bearing the requested SPI.

     *     For inbound traffic, the destination should be an address currently assigned on-device.

     * @param requestedSpi the requested SPI, or '0' to allocate a random SPI

     * @param requestedSpi the requested SPI, or '0' to allocate a random SPI. The range 1-255 is

     *     reserved and may not be used. See RFC 4303 Section 2.1.

     * @return the reserved SecurityParameterIndex

     * @throws {@link #ResourceUnavailableException} indicating that too many SPIs are

     *     currently allocated for this user

services/core/java/com/android/server/IpSecService.java

+4 −1
Original line number Diff line number Diff line
@@ -1065,7 +1065,10 @@ public class IpSecService extends IIpSecService.Stub { 
    public synchronized IpSecSpiResponse allocateSecurityParameterIndex(

            String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException {

        checkInetAddress(destinationAddress);

        /* requestedSpi can be anything in the int range, so no check is needed. */

        // RFC 4303 Section 2.1 - 0=local, 1-255=reserved.

        if (requestedSpi > 0 && requestedSpi < 256) {

            throw new IllegalArgumentException("ESP SPI must not be in the range of 0-255.");

        }

        checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex");



        UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());