Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f73d252c authored by Nathan Harold's avatar Nathan Harold
Browse files

IpSec - API Tweak for removeTransportModeTransform 

Because IpSecTransforms are now unidirectional,
and because the only mechanism for removing Transforms
removes it from both directions, the API can no longer
use the Transform parameter to meaningfully validate
that the caller had applied a transform. Since that
functionality was as-yet unimplemented and is now
infeasible, the transform parameter is removed.

Bug: 72079356
Test: cts - IpSecManagerTest; runtest frameworks-net
Change-Id: If19b0d34bdc6daf31a40d6d62bff326dcbca08c0
parent b548d251

api/current.txt

+3 −3
Original line number Original line Diff line number Diff line
@@ -25788,9 +25788,9 @@ package android.net { 
    method public void applyTransportModeTransform(java.io.FileDescriptor, int, android.net.IpSecTransform) throws java.io.IOException;

    method public void applyTransportModeTransform(java.io.FileDescriptor, int, android.net.IpSecTransform) throws java.io.IOException;

    method public android.net.IpSecManager.UdpEncapsulationSocket openUdpEncapsulationSocket(int) throws java.io.IOException, android.net.IpSecManager.ResourceUnavailableException;

    method public android.net.IpSecManager.UdpEncapsulationSocket openUdpEncapsulationSocket(int) throws java.io.IOException, android.net.IpSecManager.ResourceUnavailableException;

    method public android.net.IpSecManager.UdpEncapsulationSocket openUdpEncapsulationSocket() throws java.io.IOException, android.net.IpSecManager.ResourceUnavailableException;

    method public android.net.IpSecManager.UdpEncapsulationSocket openUdpEncapsulationSocket() throws java.io.IOException, android.net.IpSecManager.ResourceUnavailableException;

    method public void removeTransportModeTransforms(java.net.Socket, android.net.IpSecTransform) throws java.io.IOException;

    method public void removeTransportModeTransforms(java.net.Socket) throws java.io.IOException;

    method public void removeTransportModeTransforms(java.net.DatagramSocket, android.net.IpSecTransform) throws java.io.IOException;

    method public void removeTransportModeTransforms(java.net.DatagramSocket) throws java.io.IOException;

    method public void removeTransportModeTransforms(java.io.FileDescriptor, android.net.IpSecTransform) throws java.io.IOException;

    method public void removeTransportModeTransforms(java.io.FileDescriptor) throws java.io.IOException;

    field public static final int DIRECTION_IN = 0; // 0x0

    field public static final int DIRECTION_IN = 0; // 0x0

    field public static final int DIRECTION_OUT = 1; // 0x1

    field public static final int DIRECTION_OUT = 1; // 0x1

  }

  }

core/java/android/net/IIpSecService.aidl

+1 −1
Original line number Original line Diff line number Diff line
@@ -45,5 +45,5 @@ interface IIpSecService 




    void applyTransportModeTransform(in ParcelFileDescriptor socket, int direction, int transformId);

    void applyTransportModeTransform(in ParcelFileDescriptor socket, int direction, int transformId);





    void removeTransportModeTransforms(in ParcelFileDescriptor socket, int transformId);

    void removeTransportModeTransforms(in ParcelFileDescriptor socket);

}
 
}

core/java/android/net/IpSecManager.java

+12 −18
Original line number Original line Diff line number Diff line
@@ -405,62 +405,56 @@ public final class IpSecManager { 
    /**

    /**

     * Remove an IPsec transform from a stream socket.

     * Remove an IPsec transform from a stream socket.

     *

     *

     * <p>Once removed, traffic on the socket will not be encrypted. This operation will succeed

     * <p>Once removed, traffic on the socket will not be encrypted. Removing transforms from a

     * regardless of the state of the transform. Removing a transform from a socket allows the

     * socket allows the socket to be reused for communication in the clear.

     * socket to be reused for communication in the clear.

     *

     *

     * <p>If an {@code IpSecTransform} object applied to this socket was deallocated by calling

     * <p>If an {@code IpSecTransform} object applied to this socket was deallocated by calling

     * {@link IpSecTransform#close()}, then communication on the socket will fail until this method

     * {@link IpSecTransform#close()}, then communication on the socket will fail until this method

     * is called.

     * is called.

     *

     *

     * @param socket a socket that previously had a transform applied to it

     * @param socket a socket that previously had a transform applied to it

     * @param transform the IPsec Transform that was previously applied to the given socket

     * @throws IOException indicating that the transform could not be removed from the socket

     * @throws IOException indicating that the transform could not be removed from the socket

     */

     */

    public void removeTransportModeTransforms(Socket socket, IpSecTransform transform)

    public void removeTransportModeTransforms(Socket socket)

            throws IOException {

            throws IOException {

        removeTransportModeTransforms(socket.getFileDescriptor$(), transform);

        removeTransportModeTransforms(socket.getFileDescriptor$());

    }

    }





    /**

    /**

     * Remove an IPsec transform from a datagram socket.

     * Remove an IPsec transform from a datagram socket.

     *

     *

     * <p>Once removed, traffic on the socket will not be encrypted. This operation will succeed

     * <p>Once removed, traffic on the socket will not be encrypted. Removing transforms from a

     * regardless of the state of the transform. Removing a transform from a socket allows the

     * socket allows the socket to be reused for communication in the clear.

     * socket to be reused for communication in the clear.

     *

     *

     * <p>If an {@code IpSecTransform} object applied to this socket was deallocated by calling

     * <p>If an {@code IpSecTransform} object applied to this socket was deallocated by calling

     * {@link IpSecTransform#close()}, then communication on the socket will fail until this method

     * {@link IpSecTransform#close()}, then communication on the socket will fail until this method

     * is called.

     * is called.

     *

     *

     * @param socket a socket that previously had a transform applied to it

     * @param socket a socket that previously had a transform applied to it

     * @param transform the IPsec Transform that was previously applied to the given socket

     * @throws IOException indicating that the transform could not be removed from the socket

     * @throws IOException indicating that the transform could not be removed from the socket

     */

     */

    public void removeTransportModeTransforms(DatagramSocket socket, IpSecTransform transform)

    public void removeTransportModeTransforms(DatagramSocket socket)

            throws IOException {

            throws IOException {

        removeTransportModeTransforms(socket.getFileDescriptor$(), transform);

        removeTransportModeTransforms(socket.getFileDescriptor$());

    }

    }





    /**

    /**

     * Remove an IPsec transform from a socket.

     * Remove an IPsec transform from a socket.

     *

     *

     * <p>Once removed, traffic on the socket will not be encrypted. This operation will succeed

     * <p>Once removed, traffic on the socket will not be encrypted. Removing transforms from a

     * regardless of the state of the transform. Removing a transform from a socket allows the

     * socket allows the socket to be reused for communication in the clear.

     * socket to be reused for communication in the clear.

     *

     *

     * <p>If an {@code IpSecTransform} object applied to this socket was deallocated by calling

     * <p>If an {@code IpSecTransform} object applied to this socket was deallocated by calling

     * {@link IpSecTransform#close()}, then communication on the socket will fail until this method

     * {@link IpSecTransform#close()}, then communication on the socket will fail until this method

     * is called.

     * is called.

     *

     *

     * @param socket a socket that previously had a transform applied to it

     * @param socket a socket that previously had a transform applied to it

     * @param transform the IPsec Transform that was previously applied to the given socket

     * @throws IOException indicating that the transform could not be removed from the socket

     * @throws IOException indicating that the transform could not be removed from the socket

     */

     */

    public void removeTransportModeTransforms(FileDescriptor socket, IpSecTransform transform)

    public void removeTransportModeTransforms(FileDescriptor socket)

            throws IOException {

            throws IOException {

        try (ParcelFileDescriptor pfd = ParcelFileDescriptor.dup(socket)) {

        try (ParcelFileDescriptor pfd = ParcelFileDescriptor.dup(socket)) {

            mService.removeTransportModeTransforms(pfd, transform.getResourceId());

            mService.removeTransportModeTransforms(pfd);

        } catch (RemoteException e) {

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

            throw e.rethrowFromSystemServer();

        }

        }

services/core/java/com/android/server/IpSecService.java

+2 −2
Original line number Original line Diff line number Diff line
@@ -1235,8 +1235,8 @@ public class IpSecService extends IIpSecService.Stub { 
     * reserved for future improved input validation.

     * reserved for future improved input validation.

     */

     */

    @Override

    @Override

    public synchronized void removeTransportModeTransforms(

    public synchronized void removeTransportModeTransforms(ParcelFileDescriptor socket)

            ParcelFileDescriptor socket, int resourceId) throws RemoteException {

            throws RemoteException {

        try {

        try {

            mSrvConfig

            mSrvConfig

                    .getNetdInstance()

                    .getNetdInstance()

tests/net/java/com/android/server/IpSecServiceParameterizedTest.java

+1 −1
Original line number Original line Diff line number Diff line
@@ -353,7 +353,7 @@ public class IpSecServiceParameterizedTest { 
    @Test

    @Test

    public void testRemoveTransportModeTransform() throws Exception {

    public void testRemoveTransportModeTransform() throws Exception {

        ParcelFileDescriptor pfd = ParcelFileDescriptor.fromSocket(new Socket());

        ParcelFileDescriptor pfd = ParcelFileDescriptor.fromSocket(new Socket());

        mIpSecService.removeTransportModeTransforms(pfd, 1);

        mIpSecService.removeTransportModeTransforms(pfd);





        verify(mMockNetd).ipSecRemoveTransportModeTransform(pfd.getFileDescriptor());

        verify(mMockNetd).ipSecRemoveTransportModeTransform(pfd.getFileDescriptor());

    }

    }