Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | package android.net; |
| 17 | |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 18 | import static android.net.IpSecManager.INVALID_RESOURCE_ID; |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 19 | |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 20 | import static com.android.internal.util.Preconditions.checkNotNull; |
| 21 | |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 22 | import android.annotation.IntDef; |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 23 | import android.annotation.NonNull; |
Benedict Wong | e265d5f | 2018-11-08 19:45:34 -0800 | [diff] [blame] | 24 | import android.annotation.RequiresFeature; |
Nathan Harold | 5a920ca | 2018-02-02 18:34:25 -0800 | [diff] [blame] | 25 | import android.annotation.RequiresPermission; |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 26 | import android.annotation.SystemApi; |
| 27 | import android.content.Context; |
Benedict Wong | e265d5f | 2018-11-08 19:45:34 -0800 | [diff] [blame] | 28 | import android.content.pm.PackageManager; |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 29 | import android.os.Binder; |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 30 | import android.os.Handler; |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 31 | import android.os.IBinder; |
| 32 | import android.os.RemoteException; |
| 33 | import android.os.ServiceManager; |
Nathan Harold | ddeb90a | 2018-04-03 16:13:19 -0700 | [diff] [blame] | 34 | import android.os.ServiceSpecificException; |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 35 | import android.util.Log; |
Nathan Harold | d999d22 | 2017-09-11 19:53:33 -0700 | [diff] [blame] | 36 | |
ludi | 1a06aa7 | 2017-05-12 09:15:00 -0700 | [diff] [blame] | 37 | import com.android.internal.annotations.VisibleForTesting; |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 38 | import com.android.internal.util.Preconditions; |
Nathan Harold | d999d22 | 2017-09-11 19:53:33 -0700 | [diff] [blame] | 39 | |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 40 | import dalvik.system.CloseGuard; |
Nathan Harold | d999d22 | 2017-09-11 19:53:33 -0700 | [diff] [blame] | 41 | |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 42 | import java.io.IOException; |
| 43 | import java.lang.annotation.Retention; |
| 44 | import java.lang.annotation.RetentionPolicy; |
| 45 | import java.net.InetAddress; |
| 46 | |
| 47 | /** |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 48 | * This class represents a transform, which roughly corresponds to an IPsec Security Association. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 49 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 50 | * <p>Transforms are created using {@link IpSecTransform.Builder}. Each {@code IpSecTransform} |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 51 | * object encapsulates the properties and state of an IPsec security association. That includes, |
| 52 | * but is not limited to, algorithm choice, key material, and allocated system resources. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 53 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 54 | * @see <a href="https://tools.ietf.org/html/rfc4301">RFC 4301, Security Architecture for the |
Jonathan Basseri | 5fb9290 | 2017-11-16 10:58:01 -0800 | [diff] [blame] | 55 | * Internet Protocol</a> |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 56 | */ |
| 57 | public final class IpSecTransform implements AutoCloseable { |
| 58 | private static final String TAG = "IpSecTransform"; |
| 59 | |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 60 | /** @hide */ |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 61 | public static final int MODE_TRANSPORT = 0; |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 62 | |
| 63 | /** @hide */ |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 64 | public static final int MODE_TUNNEL = 1; |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 65 | |
| 66 | /** @hide */ |
| 67 | public static final int ENCAP_NONE = 0; |
| 68 | |
| 69 | /** |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 70 | * IPsec traffic will be encapsulated within UDP, but with 8 zero-value bytes between the UDP |
| 71 | * header and payload. This prevents traffic from being interpreted as ESP or IKEv2. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 72 | * |
| 73 | * @hide |
| 74 | */ |
Nathan Harold | 8dc1fd0 | 2017-04-04 19:37:48 -0700 | [diff] [blame] | 75 | public static final int ENCAP_ESPINUDP_NON_IKE = 1; |
| 76 | |
| 77 | /** |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 78 | * IPsec traffic will be encapsulated within UDP as per |
| 79 | * <a href="https://tools.ietf.org/html/rfc3948">RFC 3498</a>. |
Nathan Harold | 8dc1fd0 | 2017-04-04 19:37:48 -0700 | [diff] [blame] | 80 | * |
| 81 | * @hide |
| 82 | */ |
| 83 | public static final int ENCAP_ESPINUDP = 2; |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 84 | |
| 85 | /** @hide */ |
Nathan Harold | 8dc1fd0 | 2017-04-04 19:37:48 -0700 | [diff] [blame] | 86 | @IntDef(value = {ENCAP_NONE, ENCAP_ESPINUDP, ENCAP_ESPINUDP_NON_IKE}) |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 87 | @Retention(RetentionPolicy.SOURCE) |
| 88 | public @interface EncapType {} |
| 89 | |
Benedict Wong | 9dd3a38 | 2018-02-06 20:43:21 -0800 | [diff] [blame] | 90 | /** @hide */ |
| 91 | @VisibleForTesting |
| 92 | public IpSecTransform(Context context, IpSecConfig config) { |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 93 | mContext = context; |
Benedict Wong | 9dd3a38 | 2018-02-06 20:43:21 -0800 | [diff] [blame] | 94 | mConfig = new IpSecConfig(config); |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 95 | mResourceId = INVALID_RESOURCE_ID; |
| 96 | } |
| 97 | |
| 98 | private IIpSecService getIpSecService() { |
| 99 | IBinder b = ServiceManager.getService(android.content.Context.IPSEC_SERVICE); |
| 100 | if (b == null) { |
| 101 | throw new RemoteException("Failed to connect to IpSecService") |
| 102 | .rethrowAsRuntimeException(); |
| 103 | } |
| 104 | |
| 105 | return IIpSecService.Stub.asInterface(b); |
| 106 | } |
| 107 | |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 108 | /** |
Jonathan Basseri | 5fb9290 | 2017-11-16 10:58:01 -0800 | [diff] [blame] | 109 | * Checks the result status and throws an appropriate exception if the status is not Status.OK. |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 110 | */ |
| 111 | private void checkResultStatus(int status) |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 112 | throws IOException, IpSecManager.ResourceUnavailableException, |
| 113 | IpSecManager.SpiUnavailableException { |
| 114 | switch (status) { |
| 115 | case IpSecManager.Status.OK: |
| 116 | return; |
| 117 | // TODO: Pass Error string back from bundle so that errors can be more specific |
| 118 | case IpSecManager.Status.RESOURCE_UNAVAILABLE: |
| 119 | throw new IpSecManager.ResourceUnavailableException( |
| 120 | "Failed to allocate a new IpSecTransform"); |
| 121 | case IpSecManager.Status.SPI_UNAVAILABLE: |
| 122 | Log.wtf(TAG, "Attempting to use an SPI that was somehow not reserved"); |
| 123 | // Fall through |
| 124 | default: |
| 125 | throw new IllegalStateException( |
| 126 | "Failed to Create a Transform with status code " + status); |
| 127 | } |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 128 | } |
| 129 | |
| 130 | private IpSecTransform activate() |
| 131 | throws IOException, IpSecManager.ResourceUnavailableException, |
| 132 | IpSecManager.SpiUnavailableException { |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 133 | synchronized (this) { |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 134 | try { |
| 135 | IIpSecService svc = getIpSecService(); |
Nathan Harold | 592dadb | 2018-03-15 18:06:06 -0700 | [diff] [blame] | 136 | IpSecTransformResponse result = svc.createTransform( |
| 137 | mConfig, new Binder(), mContext.getOpPackageName()); |
Nathan Harold | 8dc1fd0 | 2017-04-04 19:37:48 -0700 | [diff] [blame] | 138 | int status = result.status; |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 139 | checkResultStatus(status); |
Nathan Harold | 8dc1fd0 | 2017-04-04 19:37:48 -0700 | [diff] [blame] | 140 | mResourceId = result.resourceId; |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 141 | Log.d(TAG, "Added Transform with Id " + mResourceId); |
| 142 | mCloseGuard.open("build"); |
Nathan Harold | ddeb90a | 2018-04-03 16:13:19 -0700 | [diff] [blame] | 143 | } catch (ServiceSpecificException e) { |
| 144 | throw IpSecManager.rethrowUncheckedExceptionFromServiceSpecificException(e); |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 145 | } catch (RemoteException e) { |
| 146 | throw e.rethrowAsRuntimeException(); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 147 | } |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 148 | } |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 149 | |
| 150 | return this; |
| 151 | } |
| 152 | |
| 153 | /** |
Chalard Jean | 9c0ff1b | 2019-05-30 17:11:14 +0900 | [diff] [blame] | 154 | * Standard equals. |
Benedict Wong | 9dd3a38 | 2018-02-06 20:43:21 -0800 | [diff] [blame] | 155 | */ |
Chalard Jean | 9c0ff1b | 2019-05-30 17:11:14 +0900 | [diff] [blame] | 156 | public boolean equals(Object other) { |
| 157 | if (this == other) return true; |
| 158 | if (!(other instanceof IpSecTransform)) return false; |
| 159 | final IpSecTransform rhs = (IpSecTransform) other; |
| 160 | return getConfig().equals(rhs.getConfig()) && mResourceId == rhs.mResourceId; |
Benedict Wong | 9dd3a38 | 2018-02-06 20:43:21 -0800 | [diff] [blame] | 161 | } |
| 162 | |
| 163 | /** |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 164 | * Deactivate this {@code IpSecTransform} and free allocated resources. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 165 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 166 | * <p>Deactivating a transform while it is still applied to a socket will result in errors on |
| 167 | * that socket. Make sure to remove transforms by calling {@link |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 168 | * IpSecManager#removeTransportModeTransforms}. Note, removing an {@code IpSecTransform} from a |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 169 | * socket will not deactivate it (because one transform may be applied to multiple sockets). |
| 170 | * |
| 171 | * <p>It is safe to call this method on a transform that has already been deactivated. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 172 | */ |
| 173 | public void close() { |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 174 | Log.d(TAG, "Removing Transform with Id " + mResourceId); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 175 | |
| 176 | // Always safe to attempt cleanup |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 177 | if (mResourceId == INVALID_RESOURCE_ID) { |
| 178 | mCloseGuard.close(); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 179 | return; |
| 180 | } |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 181 | try { |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 182 | IIpSecService svc = getIpSecService(); |
Benedict Wong | f33f0313 | 2018-01-18 14:38:16 -0800 | [diff] [blame] | 183 | svc.deleteTransform(mResourceId); |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 184 | stopNattKeepalive(); |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 185 | } catch (RemoteException e) { |
| 186 | throw e.rethrowAsRuntimeException(); |
Nathan Harold | ddeb90a | 2018-04-03 16:13:19 -0700 | [diff] [blame] | 187 | } catch (Exception e) { |
| 188 | // On close we swallow all random exceptions since failure to close is not |
| 189 | // actionable by the user. |
| 190 | Log.e(TAG, "Failed to close " + this + ", Exception=" + e); |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 191 | } finally { |
| 192 | mResourceId = INVALID_RESOURCE_ID; |
| 193 | mCloseGuard.close(); |
| 194 | } |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 195 | } |
| 196 | |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 197 | /** Check that the transform was closed properly. */ |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 198 | @Override |
| 199 | protected void finalize() throws Throwable { |
| 200 | if (mCloseGuard != null) { |
| 201 | mCloseGuard.warnIfOpen(); |
| 202 | } |
| 203 | close(); |
| 204 | } |
| 205 | |
| 206 | /* Package */ |
| 207 | IpSecConfig getConfig() { |
| 208 | return mConfig; |
| 209 | } |
| 210 | |
| 211 | private final IpSecConfig mConfig; |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 212 | private int mResourceId; |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 213 | private final Context mContext; |
| 214 | private final CloseGuard mCloseGuard = CloseGuard.get(); |
| 215 | private ConnectivityManager.PacketKeepalive mKeepalive; |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 216 | private Handler mCallbackHandler; |
| 217 | private final ConnectivityManager.PacketKeepaliveCallback mKeepaliveCallback = |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 218 | new ConnectivityManager.PacketKeepaliveCallback() { |
| 219 | |
| 220 | @Override |
| 221 | public void onStarted() { |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 222 | synchronized (this) { |
| 223 | mCallbackHandler.post(() -> mUserKeepaliveCallback.onStarted()); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 224 | } |
| 225 | } |
| 226 | |
| 227 | @Override |
| 228 | public void onStopped() { |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 229 | synchronized (this) { |
| 230 | mKeepalive = null; |
| 231 | mCallbackHandler.post(() -> mUserKeepaliveCallback.onStopped()); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 232 | } |
| 233 | } |
| 234 | |
| 235 | @Override |
| 236 | public void onError(int error) { |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 237 | synchronized (this) { |
| 238 | mKeepalive = null; |
| 239 | mCallbackHandler.post(() -> mUserKeepaliveCallback.onError(error)); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 240 | } |
| 241 | } |
| 242 | }; |
| 243 | |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 244 | private NattKeepaliveCallback mUserKeepaliveCallback; |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 245 | |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 246 | /** @hide */ |
| 247 | @VisibleForTesting |
| 248 | public int getResourceId() { |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 249 | return mResourceId; |
| 250 | } |
| 251 | |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 252 | /** |
| 253 | * A callback class to provide status information regarding a NAT-T keepalive session |
| 254 | * |
| 255 | * <p>Use this callback to receive status information regarding a NAT-T keepalive session |
| 256 | * by registering it when calling {@link #startNattKeepalive}. |
| 257 | * |
| 258 | * @hide |
| 259 | */ |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 260 | public static class NattKeepaliveCallback { |
| 261 | /** The specified {@code Network} is not connected. */ |
| 262 | public static final int ERROR_INVALID_NETWORK = 1; |
| 263 | /** The hardware does not support this request. */ |
| 264 | public static final int ERROR_HARDWARE_UNSUPPORTED = 2; |
| 265 | /** The hardware returned an error. */ |
| 266 | public static final int ERROR_HARDWARE_ERROR = 3; |
| 267 | |
| 268 | /** The requested keepalive was successfully started. */ |
| 269 | public void onStarted() {} |
| 270 | /** The keepalive was successfully stopped. */ |
| 271 | public void onStopped() {} |
| 272 | /** An error occurred. */ |
| 273 | public void onError(int error) {} |
| 274 | } |
| 275 | |
| 276 | /** |
| 277 | * Start a NAT-T keepalive session for the current transform. |
| 278 | * |
| 279 | * For a transform that is using UDP encapsulated IPv4, NAT-T offloading provides |
| 280 | * a power efficient mechanism of sending NAT-T packets at a specified interval. |
| 281 | * |
| 282 | * @param userCallback a {@link #NattKeepaliveCallback} to receive asynchronous status |
| 283 | * information about the requested NAT-T keepalive session. |
| 284 | * @param intervalSeconds the interval between NAT-T keepalives being sent. The |
| 285 | * the allowed range is between 20 and 3600 seconds. |
| 286 | * @param handler a handler on which to post callbacks when received. |
| 287 | * |
| 288 | * @hide |
| 289 | */ |
Nathan Harold | 5a920ca | 2018-02-02 18:34:25 -0800 | [diff] [blame] | 290 | @RequiresPermission(anyOf = { |
Nathan Harold | 1597884 | 2018-03-21 15:32:42 -0700 | [diff] [blame] | 291 | android.Manifest.permission.MANAGE_IPSEC_TUNNELS, |
Nathan Harold | 5a920ca | 2018-02-02 18:34:25 -0800 | [diff] [blame] | 292 | android.Manifest.permission.PACKET_KEEPALIVE_OFFLOAD |
| 293 | }) |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 294 | public void startNattKeepalive(@NonNull NattKeepaliveCallback userCallback, |
| 295 | int intervalSeconds, @NonNull Handler handler) throws IOException { |
| 296 | checkNotNull(userCallback); |
| 297 | if (intervalSeconds < 20 || intervalSeconds > 3600) { |
| 298 | throw new IllegalArgumentException("Invalid NAT-T keepalive interval"); |
| 299 | } |
| 300 | checkNotNull(handler); |
| 301 | if (mResourceId == INVALID_RESOURCE_ID) { |
| 302 | throw new IllegalStateException( |
| 303 | "Packet keepalive cannot be started for an inactive transform"); |
| 304 | } |
| 305 | |
| 306 | synchronized (mKeepaliveCallback) { |
| 307 | if (mKeepaliveCallback != null) { |
| 308 | throw new IllegalStateException("Keepalive already active"); |
| 309 | } |
| 310 | |
| 311 | mUserKeepaliveCallback = userCallback; |
| 312 | ConnectivityManager cm = (ConnectivityManager) mContext.getSystemService( |
| 313 | Context.CONNECTIVITY_SERVICE); |
| 314 | mKeepalive = cm.startNattKeepalive( |
| 315 | mConfig.getNetwork(), intervalSeconds, mKeepaliveCallback, |
| 316 | NetworkUtils.numericToInetAddress(mConfig.getSourceAddress()), |
| 317 | 4500, // FIXME urgently, we need to get the port number from the Encap socket |
| 318 | NetworkUtils.numericToInetAddress(mConfig.getDestinationAddress())); |
| 319 | mCallbackHandler = handler; |
| 320 | } |
| 321 | } |
| 322 | |
| 323 | /** |
| 324 | * Stop an ongoing NAT-T keepalive session. |
| 325 | * |
| 326 | * Calling this API will request that an ongoing NAT-T keepalive session be terminated. |
| 327 | * If this API is not called when a Transform is closed, the underlying NAT-T session will |
| 328 | * be terminated automatically. |
| 329 | * |
| 330 | * @hide |
| 331 | */ |
Nathan Harold | 5a920ca | 2018-02-02 18:34:25 -0800 | [diff] [blame] | 332 | @RequiresPermission(anyOf = { |
Nathan Harold | 1597884 | 2018-03-21 15:32:42 -0700 | [diff] [blame] | 333 | android.Manifest.permission.MANAGE_IPSEC_TUNNELS, |
Nathan Harold | 5a920ca | 2018-02-02 18:34:25 -0800 | [diff] [blame] | 334 | android.Manifest.permission.PACKET_KEEPALIVE_OFFLOAD |
| 335 | }) |
Nathan Harold | c43e89f | 2017-12-06 19:12:28 -0800 | [diff] [blame] | 336 | public void stopNattKeepalive() { |
| 337 | synchronized (mKeepaliveCallback) { |
| 338 | if (mKeepalive == null) { |
| 339 | Log.e(TAG, "No active keepalive to stop"); |
| 340 | return; |
| 341 | } |
| 342 | mKeepalive.stop(); |
| 343 | } |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 344 | } |
| 345 | |
Jonathan Basseri | 5fb9290 | 2017-11-16 10:58:01 -0800 | [diff] [blame] | 346 | /** This class is used to build {@link IpSecTransform} objects. */ |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 347 | public static class Builder { |
| 348 | private Context mContext; |
| 349 | private IpSecConfig mConfig; |
| 350 | |
| 351 | /** |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 352 | * Set the encryption algorithm. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 353 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 354 | * <p>Encryption is mutually exclusive with authenticated encryption. |
Benedict Wong | 0febe5e | 2017-08-22 21:42:33 -0700 | [diff] [blame] | 355 | * |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 356 | * @param algo {@link IpSecAlgorithm} specifying the encryption to be applied. |
| 357 | */ |
Nathan Harold | 5cd64cc | 2018-03-16 17:27:30 -0700 | [diff] [blame] | 358 | @NonNull |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 359 | public IpSecTransform.Builder setEncryption(@NonNull IpSecAlgorithm algo) { |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 360 | // TODO: throw IllegalArgumentException if algo is not an encryption algorithm. |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 361 | Preconditions.checkNotNull(algo); |
| 362 | mConfig.setEncryption(algo); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 363 | return this; |
| 364 | } |
| 365 | |
| 366 | /** |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 367 | * Set the authentication (integrity) algorithm. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 368 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 369 | * <p>Authentication is mutually exclusive with authenticated encryption. |
Benedict Wong | 0febe5e | 2017-08-22 21:42:33 -0700 | [diff] [blame] | 370 | * |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 371 | * @param algo {@link IpSecAlgorithm} specifying the authentication to be applied. |
| 372 | */ |
Nathan Harold | 5cd64cc | 2018-03-16 17:27:30 -0700 | [diff] [blame] | 373 | @NonNull |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 374 | public IpSecTransform.Builder setAuthentication(@NonNull IpSecAlgorithm algo) { |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 375 | // TODO: throw IllegalArgumentException if algo is not an authentication algorithm. |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 376 | Preconditions.checkNotNull(algo); |
| 377 | mConfig.setAuthentication(algo); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 378 | return this; |
| 379 | } |
| 380 | |
| 381 | /** |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 382 | * Set the authenticated encryption algorithm. |
Benedict Wong | 0febe5e | 2017-08-22 21:42:33 -0700 | [diff] [blame] | 383 | * |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 384 | * <p>The Authenticated Encryption (AE) class of algorithms are also known as |
| 385 | * Authenticated Encryption with Associated Data (AEAD) algorithms, or Combined mode |
| 386 | * algorithms (as referred to in |
| 387 | * <a href="https://tools.ietf.org/html/rfc4301">RFC 4301</a>). |
Benedict Wong | 0febe5e | 2017-08-22 21:42:33 -0700 | [diff] [blame] | 388 | * |
| 389 | * <p>Authenticated encryption is mutually exclusive with encryption and authentication. |
| 390 | * |
Benedict Wong | 0febe5e | 2017-08-22 21:42:33 -0700 | [diff] [blame] | 391 | * @param algo {@link IpSecAlgorithm} specifying the authenticated encryption algorithm to |
| 392 | * be applied. |
| 393 | */ |
Nathan Harold | 5cd64cc | 2018-03-16 17:27:30 -0700 | [diff] [blame] | 394 | @NonNull |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 395 | public IpSecTransform.Builder setAuthenticatedEncryption(@NonNull IpSecAlgorithm algo) { |
| 396 | Preconditions.checkNotNull(algo); |
| 397 | mConfig.setAuthenticatedEncryption(algo); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 398 | return this; |
| 399 | } |
| 400 | |
| 401 | /** |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 402 | * Add UDP encapsulation to an IPv4 transform. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 403 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 404 | * <p>This allows IPsec traffic to pass through a NAT. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 405 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 406 | * @see <a href="https://tools.ietf.org/html/rfc3948">RFC 3948, UDP Encapsulation of IPsec |
Jonathan Basseri | 5fb9290 | 2017-11-16 10:58:01 -0800 | [diff] [blame] | 407 | * ESP Packets</a> |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 408 | * @see <a href="https://tools.ietf.org/html/rfc7296#section-2.23">RFC 7296 section 2.23, |
Jonathan Basseri | 5fb9290 | 2017-11-16 10:58:01 -0800 | [diff] [blame] | 409 | * NAT Traversal of IKEv2</a> |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 410 | * @param localSocket a socket for sending and receiving encapsulated traffic |
| 411 | * @param remotePort the UDP port number of the remote host that will send and receive |
| 412 | * encapsulated traffic. In the case of IKEv2, this should be port 4500. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 413 | */ |
Nathan Harold | 5cd64cc | 2018-03-16 17:27:30 -0700 | [diff] [blame] | 414 | @NonNull |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 415 | public IpSecTransform.Builder setIpv4Encapsulation( |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 416 | @NonNull IpSecManager.UdpEncapsulationSocket localSocket, int remotePort) { |
| 417 | Preconditions.checkNotNull(localSocket); |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 418 | mConfig.setEncapType(ENCAP_ESPINUDP); |
Nathan Harold | 6119d8d | 2017-12-13 18:51:35 -0800 | [diff] [blame] | 419 | if (localSocket.getResourceId() == INVALID_RESOURCE_ID) { |
| 420 | throw new IllegalArgumentException("Invalid UdpEncapsulationSocket"); |
| 421 | } |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 422 | mConfig.setEncapSocketResourceId(localSocket.getResourceId()); |
| 423 | mConfig.setEncapRemotePort(remotePort); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 424 | return this; |
| 425 | } |
| 426 | |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 427 | /** |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 428 | * Build a transport mode {@link IpSecTransform}. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 429 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 430 | * <p>This builds and activates a transport mode transform. Note that an active transform |
| 431 | * will not affect any network traffic until it has been applied to one or more sockets. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 432 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 433 | * @see IpSecManager#applyTransportModeTransform |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 434 | * @param sourceAddress the source {@code InetAddress} of traffic on sockets that will use |
| 435 | * this transform; this address must belong to the Network used by all sockets that |
| 436 | * utilize this transform; if provided, then only traffic originating from the |
| 437 | * specified source address will be processed. |
| 438 | * @param spi a unique {@link IpSecManager.SecurityParameterIndex} to identify transformed |
| 439 | * traffic |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 440 | * @throws IllegalArgumentException indicating that a particular combination of transform |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 441 | * properties is invalid |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 442 | * @throws IpSecManager.ResourceUnavailableException indicating that too many transforms |
| 443 | * are active |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 444 | * @throws IpSecManager.SpiUnavailableException indicating the rare case where an SPI |
| 445 | * collides with an existing transform |
| 446 | * @throws IOException indicating other errors |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 447 | */ |
Nathan Harold | 5cd64cc | 2018-03-16 17:27:30 -0700 | [diff] [blame] | 448 | @NonNull |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 449 | public IpSecTransform buildTransportModeTransform( |
| 450 | @NonNull InetAddress sourceAddress, |
| 451 | @NonNull IpSecManager.SecurityParameterIndex spi) |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 452 | throws IpSecManager.ResourceUnavailableException, |
| 453 | IpSecManager.SpiUnavailableException, IOException { |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 454 | Preconditions.checkNotNull(sourceAddress); |
| 455 | Preconditions.checkNotNull(spi); |
| 456 | if (spi.getResourceId() == INVALID_RESOURCE_ID) { |
| 457 | throw new IllegalArgumentException("Invalid SecurityParameterIndex"); |
Nathan Harold | 6119d8d | 2017-12-13 18:51:35 -0800 | [diff] [blame] | 458 | } |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 459 | mConfig.setMode(MODE_TRANSPORT); |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 460 | mConfig.setSourceAddress(sourceAddress.getHostAddress()); |
| 461 | mConfig.setSpiResourceId(spi.getResourceId()); |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 462 | // FIXME: modifying a builder after calling build can change the built transform. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 463 | return new IpSecTransform(mContext, mConfig).activate(); |
| 464 | } |
| 465 | |
| 466 | /** |
| 467 | * Build and return an {@link IpSecTransform} object as a Tunnel Mode Transform. Some |
| 468 | * parameters have interdependencies that are checked at build time. |
| 469 | * |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 470 | * @param sourceAddress the {@link InetAddress} that provides the source address for this |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 471 | * IPsec tunnel. This is almost certainly an address belonging to the {@link Network} |
| 472 | * that will originate the traffic, which is set as the {@link #setUnderlyingNetwork}. |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 473 | * @param spi a unique {@link IpSecManager.SecurityParameterIndex} to identify transformed |
| 474 | * traffic |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 475 | * @throws IllegalArgumentException indicating that a particular combination of transform |
| 476 | * properties is invalid. |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 477 | * @throws IpSecManager.ResourceUnavailableException indicating that too many transforms |
| 478 | * are active |
| 479 | * @throws IpSecManager.SpiUnavailableException indicating the rare case where an SPI |
| 480 | * collides with an existing transform |
| 481 | * @throws IOException indicating other errors |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 482 | * @hide |
| 483 | */ |
Nathan Harold | c47eacc | 2018-01-17 16:09:24 -0800 | [diff] [blame] | 484 | @SystemApi |
Nathan Harold | 5cd64cc | 2018-03-16 17:27:30 -0700 | [diff] [blame] | 485 | @NonNull |
Benedict Wong | e265d5f | 2018-11-08 19:45:34 -0800 | [diff] [blame] | 486 | @RequiresFeature(PackageManager.FEATURE_IPSEC_TUNNELS) |
Nathan Harold | 1597884 | 2018-03-21 15:32:42 -0700 | [diff] [blame] | 487 | @RequiresPermission(android.Manifest.permission.MANAGE_IPSEC_TUNNELS) |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 488 | public IpSecTransform buildTunnelModeTransform( |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 489 | @NonNull InetAddress sourceAddress, |
| 490 | @NonNull IpSecManager.SecurityParameterIndex spi) |
| 491 | throws IpSecManager.ResourceUnavailableException, |
| 492 | IpSecManager.SpiUnavailableException, IOException { |
| 493 | Preconditions.checkNotNull(sourceAddress); |
| 494 | Preconditions.checkNotNull(spi); |
| 495 | if (spi.getResourceId() == INVALID_RESOURCE_ID) { |
| 496 | throw new IllegalArgumentException("Invalid SecurityParameterIndex"); |
Nathan Harold | 6119d8d | 2017-12-13 18:51:35 -0800 | [diff] [blame] | 497 | } |
Nathan Harold | a10003d | 2017-08-23 13:46:33 -0700 | [diff] [blame] | 498 | mConfig.setMode(MODE_TUNNEL); |
Nathan Harold | a252331 | 2018-01-05 19:25:13 -0800 | [diff] [blame] | 499 | mConfig.setSourceAddress(sourceAddress.getHostAddress()); |
| 500 | mConfig.setSpiResourceId(spi.getResourceId()); |
Benedict Wong | b8ef541 | 2018-01-24 15:31:39 -0800 | [diff] [blame] | 501 | return new IpSecTransform(mContext, mConfig).activate(); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 502 | } |
| 503 | |
| 504 | /** |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 505 | * Create a new IpSecTransform.Builder. |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 506 | * |
Jonathan Basseri | c61b70d | 2017-04-21 15:53:51 -0700 | [diff] [blame] | 507 | * @param context current context |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 508 | */ |
Nathan Harold | 93962f3 | 2017-03-07 13:23:36 -0800 | [diff] [blame] | 509 | public Builder(@NonNull Context context) { |
| 510 | Preconditions.checkNotNull(context); |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 511 | mContext = context; |
| 512 | mConfig = new IpSecConfig(); |
| 513 | } |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 514 | } |
Nathan Harold | ddeb90a | 2018-04-03 16:13:19 -0700 | [diff] [blame] | 515 | |
| 516 | @Override |
| 517 | public String toString() { |
| 518 | return new StringBuilder() |
| 519 | .append("IpSecTransform{resourceId=") |
| 520 | .append(mResourceId) |
| 521 | .append("}") |
| 522 | .toString(); |
| 523 | } |
Nathan Harold | 330e108 | 2017-01-12 18:38:57 -0800 | [diff] [blame] | 524 | } |