Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7f606ee8 authored by Nathan Harold's avatar Nathan Harold Committed by nharold
Browse files

Disallow Reserved SPI Allocation

Disallow the allocation of SPIs in the range
reserved for future use by RFC 4303.

Bug: 77205120
Test: runtest frameworks-net
Change-Id: I05e26ed34b5871f1a07d5bd7b58b79a64cd74b67
parent f8b537d7
Loading
Loading
Loading
Loading
+2 −1
Original line number Diff line number Diff line
@@ -274,7 +274,8 @@ public final class IpSecManager {
     *
     * @param destinationAddress the destination address for traffic bearing the requested SPI.
     *     For inbound traffic, the destination should be an address currently assigned on-device.
     * @param requestedSpi the requested SPI, or '0' to allocate a random SPI
     * @param requestedSpi the requested SPI, or '0' to allocate a random SPI. The range 1-255 is
     *     reserved and may not be used. See RFC 4303 Section 2.1.
     * @return the reserved SecurityParameterIndex
     * @throws {@link #ResourceUnavailableException} indicating that too many SPIs are
     *     currently allocated for this user
+4 −1
Original line number Diff line number Diff line
@@ -1065,7 +1065,10 @@ public class IpSecService extends IIpSecService.Stub {
    public synchronized IpSecSpiResponse allocateSecurityParameterIndex(
            String destinationAddress, int requestedSpi, IBinder binder) throws RemoteException {
        checkInetAddress(destinationAddress);
        /* requestedSpi can be anything in the int range, so no check is needed. */
        // RFC 4303 Section 2.1 - 0=local, 1-255=reserved.
        if (requestedSpi > 0 && requestedSpi < 256) {
            throw new IllegalArgumentException("ESP SPI must not be in the range of 0-255.");
        }
        checkNotNull(binder, "Null Binder passed to allocateSecurityParameterIndex");

        UserRecord userRecord = mUserResourceTracker.getUserRecord(Binder.getCallingUid());