| /* |
| * Copyright (C) 2019 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package android.net.ipsec.ike; |
| |
| import static com.android.internal.net.ipsec.ike.message.IkeConfigPayload.CONFIG_ATTR_APPLICATION_VERSION; |
| import static com.android.internal.net.ipsec.ike.message.IkeConfigPayload.CONFIG_ATTR_IP4_PCSCF; |
| import static com.android.internal.net.ipsec.ike.message.IkeConfigPayload.CONFIG_ATTR_IP6_PCSCF; |
| |
| import android.annotation.IntDef; |
| import android.annotation.NonNull; |
| import android.annotation.Nullable; |
| import android.annotation.SuppressLint; |
| import android.annotation.SystemApi; |
| import android.net.eap.EapInfo; |
| |
| import com.android.internal.net.ipsec.ike.message.IkeConfigPayload; |
| import com.android.internal.net.ipsec.ike.message.IkeConfigPayload.ConfigAttribute; |
| import com.android.internal.net.ipsec.ike.message.IkeConfigPayload.ConfigAttributeAppVersion; |
| import com.android.internal.net.ipsec.ike.message.IkeConfigPayload.ConfigAttributeIpv4Pcscf; |
| import com.android.internal.net.ipsec.ike.message.IkeConfigPayload.ConfigAttributeIpv6Pcscf; |
| |
| import java.lang.annotation.Retention; |
| import java.lang.annotation.RetentionPolicy; |
| import java.net.InetAddress; |
| import java.util.ArrayList; |
| import java.util.Collections; |
| import java.util.HashSet; |
| import java.util.List; |
| import java.util.Objects; |
| import java.util.Set; |
| |
| /** |
| * IkeSessionConfiguration represents the negotiated configuration for a {@link IkeSession}. |
| * |
| * <p>Configurations include remote application version and enabled IKE extensions. |
| */ |
| public final class IkeSessionConfiguration { |
| /** @hide */ |
| @Retention(RetentionPolicy.SOURCE) |
| @IntDef({EXTENSION_TYPE_FRAGMENTATION, EXTENSION_TYPE_MOBIKE}) |
| public @interface ExtensionType {} |
| |
| /** IKE Message Fragmentation */ |
| public static final int EXTENSION_TYPE_FRAGMENTATION = 1; |
| /** IKEv2 Mobility and Multihoming Protocol */ |
| public static final int EXTENSION_TYPE_MOBIKE = 2; |
| |
| private static final int VALID_EXTENSION_MIN = EXTENSION_TYPE_FRAGMENTATION; |
| private static final int VALID_EXTENSION_MAX = EXTENSION_TYPE_MOBIKE; |
| |
| private final String mRemoteApplicationVersion; |
| private final IkeSessionConnectionInfo mIkeConnInfo; |
| private final List<InetAddress> mPcscfServers = new ArrayList<>(); |
| private final List<byte[]> mRemoteVendorIds = new ArrayList<>(); |
| private final Set<Integer> mEnabledExtensions = new HashSet<>(); |
| private final EapInfo mEapInfo; |
| |
| /** |
| * Construct an instance of {@link IkeSessionConfiguration}. |
| * |
| * <p>IkeSessionConfigurations may contain negotiated configuration information that is included |
| * in a Configure(Reply) Payload. Thus the input configPayload should always be a |
| * Configure(Reply), and never be a Configure(Request). |
| * |
| * @hide |
| */ |
| public IkeSessionConfiguration( |
| IkeSessionConnectionInfo ikeConnInfo, |
| IkeConfigPayload configPayload, |
| List<byte[]> remoteVendorIds, |
| List<Integer> enabledExtensions, |
| EapInfo eapInfo) { |
| mIkeConnInfo = ikeConnInfo; |
| mRemoteVendorIds.addAll(remoteVendorIds); |
| mEnabledExtensions.addAll(enabledExtensions); |
| mEapInfo = eapInfo; |
| |
| String appVersion = ""; |
| if (configPayload != null) { |
| if (configPayload.configType != IkeConfigPayload.CONFIG_TYPE_REPLY) { |
| throw new IllegalArgumentException( |
| "Cannot build IkeSessionConfiguration with configuration type: " |
| + configPayload.configType); |
| } |
| |
| for (ConfigAttribute attr : configPayload.recognizedAttributeList) { |
| if (attr.isEmptyValue()) continue; |
| switch (attr.attributeType) { |
| case CONFIG_ATTR_APPLICATION_VERSION: |
| ConfigAttributeAppVersion appVersionAttr = (ConfigAttributeAppVersion) attr; |
| appVersion = appVersionAttr.applicationVersion; |
| break; |
| case CONFIG_ATTR_IP4_PCSCF: |
| ConfigAttributeIpv4Pcscf ip4Pcscf = (ConfigAttributeIpv4Pcscf) attr; |
| mPcscfServers.add(ip4Pcscf.getAddress()); |
| break; |
| case CONFIG_ATTR_IP6_PCSCF: |
| ConfigAttributeIpv6Pcscf ip6Pcscf = (ConfigAttributeIpv6Pcscf) attr; |
| mPcscfServers.add(ip6Pcscf.getAddress()); |
| break; |
| default: |
| // Not relevant to IKE session |
| } |
| } |
| } |
| mRemoteApplicationVersion = appVersion; |
| validateOrThrow(); |
| } |
| |
| /** |
| * Construct an instance of {@link IkeSessionConfiguration}. |
| * |
| * @hide |
| */ |
| private IkeSessionConfiguration( |
| IkeSessionConnectionInfo ikeConnInfo, |
| List<InetAddress> pcscfServers, |
| List<byte[]> remoteVendorIds, |
| Set<Integer> enabledExtensions, |
| String remoteApplicationVersion, |
| EapInfo eapInfo) { |
| mIkeConnInfo = ikeConnInfo; |
| mPcscfServers.addAll(pcscfServers); |
| mRemoteVendorIds.addAll(remoteVendorIds); |
| mEnabledExtensions.addAll(enabledExtensions); |
| mRemoteApplicationVersion = remoteApplicationVersion; |
| mEapInfo = eapInfo; |
| |
| validateOrThrow(); |
| } |
| |
| private void validateOrThrow() { |
| String errMsg = " was null"; |
| Objects.requireNonNull(mIkeConnInfo, "ikeConnInfo" + errMsg); |
| Objects.requireNonNull(mPcscfServers, "pcscfServers" + errMsg); |
| Objects.requireNonNull(mRemoteVendorIds, "remoteVendorIds" + errMsg); |
| Objects.requireNonNull(mRemoteApplicationVersion, "remoteApplicationVersion" + errMsg); |
| Objects.requireNonNull(mRemoteVendorIds, "remoteVendorIds" + errMsg); |
| } |
| |
| /** |
| * Gets remote (server) version information. |
| * |
| * @return application version of the remote server, or an empty string if the remote server did |
| * not provide the application version. |
| */ |
| @NonNull |
| public String getRemoteApplicationVersion() { |
| return mRemoteApplicationVersion; |
| } |
| |
| /** |
| * Returns remote vendor IDs received during IKE Session setup. |
| * |
| * <p>According to the IKEv2 specification (RFC 7296), a vendor ID may indicate the sender is |
| * capable of accepting certain extensions to the protocol, or it may simply identify the |
| * implementation as an aid in debugging. |
| * |
| * @return the vendor IDs of the remote server, or an empty list if no vendor ID is received |
| * during IKE Session setup. |
| */ |
| @NonNull |
| public List<byte[]> getRemoteVendorIds() { |
| return Collections.unmodifiableList(mRemoteVendorIds); |
| } |
| |
| /** |
| * Checks if an IKE extension is enabled. |
| * |
| * <p>An IKE extension is enabled when both sides can support it. This negotiation always |
| * happens in IKE initial exchanges (IKE INIT and IKE AUTH). |
| * |
| * @param extensionType the extension type. |
| * @return {@code true} if this extension is enabled. |
| */ |
| public boolean isIkeExtensionEnabled(@ExtensionType int extensionType) { |
| return mEnabledExtensions.contains(extensionType); |
| } |
| |
| /** |
| * Returns the assigned P_CSCF servers. |
| * |
| * @return the assigned P_CSCF servers, or an empty list when no servers are assigned by the |
| * remote IKE server. |
| * @hide |
| */ |
| @SystemApi |
| @NonNull |
| public List<InetAddress> getPcscfServers() { |
| return Collections.unmodifiableList(mPcscfServers); |
| } |
| |
| /** |
| * Returns the connection information. |
| * |
| * @return the IKE Session connection information. |
| */ |
| @NonNull |
| public IkeSessionConnectionInfo getIkeSessionConnectionInfo() { |
| return mIkeConnInfo; |
| } |
| |
| /** |
| * Retrieves the EAP information. |
| * |
| * @return the EAP information provided by the server during EAP authentication (e.g. next |
| * re-authentication ID), or null if the server did not provide any information that will be |
| * useful after the authentication. |
| */ |
| @Nullable |
| public EapInfo getEapInfo() { |
| return mEapInfo; |
| } |
| |
| /** |
| * This class can be used to incrementally construct a {@link IkeSessionConfiguration}. |
| * |
| * <p>Except for testing, IKE library users normally do not instantiate {@link |
| * IkeSessionConfiguration} themselves but instead get a reference via {@link |
| * IkeSessionCallback} |
| */ |
| public static final class Builder { |
| private final IkeSessionConnectionInfo mIkeConnInfo; |
| private final List<InetAddress> mPcscfServers = new ArrayList<>(); |
| private final List<byte[]> mRemoteVendorIds = new ArrayList<>(); |
| private final Set<Integer> mEnabledExtensions = new HashSet<>(); |
| private String mRemoteApplicationVersion = ""; |
| private EapInfo mEapInfo; |
| |
| /** |
| * Constructs a Builder. |
| * |
| * @param ikeConnInfo the connection information |
| */ |
| public Builder(@NonNull IkeSessionConnectionInfo ikeConnInfo) { |
| Objects.requireNonNull(ikeConnInfo, "ikeConnInfo was null"); |
| mIkeConnInfo = ikeConnInfo; |
| } |
| |
| /** |
| * Adds an assigned P_CSCF server for the {@link IkeSessionConfiguration} being built. |
| * |
| * @param pcscfServer an assigned P_CSCF server |
| * @return Builder this, to facilitate chaining |
| * @hide |
| */ |
| @SystemApi |
| @NonNull |
| public Builder addPcscfServer(@NonNull InetAddress pcscfServer) { |
| Objects.requireNonNull(pcscfServer, "pcscfServer was null"); |
| mPcscfServers.add(pcscfServer); |
| return this; |
| } |
| |
| /** |
| * Clear all P_CSCF servers from the {@link IkeSessionConfiguration} being built. |
| * |
| * @return Builder this, to facilitate chaining |
| * @hide |
| */ |
| @SystemApi |
| @NonNull |
| public Builder clearPcscfServers() { |
| mPcscfServers.clear(); |
| return this; |
| } |
| |
| /** |
| * Adds a remote vendor ID for the {@link IkeSessionConfiguration} being built. |
| * |
| * @param remoteVendorId a remote vendor ID |
| * @return Builder this, to facilitate chaining |
| */ |
| @NonNull |
| public Builder addRemoteVendorId(@NonNull byte[] remoteVendorId) { |
| Objects.requireNonNull(remoteVendorId, "remoteVendorId was null"); |
| mRemoteVendorIds.add(remoteVendorId); |
| return this; |
| } |
| |
| /** |
| * Clears all remote vendor IDs from the {@link IkeSessionConfiguration} being built. |
| * |
| * @return Builder this, to facilitate chaining |
| */ |
| @NonNull |
| public Builder clearRemoteVendorIds() { |
| mRemoteVendorIds.clear(); |
| return this; |
| } |
| |
| /** |
| * Sets the remote application version for the {@link IkeSessionConfiguration} being built. |
| * |
| * @param remoteApplicationVersion the remote application version. Defaults to an empty |
| * string. |
| * @return Builder this, to facilitate chaining |
| */ |
| @NonNull |
| public Builder setRemoteApplicationVersion(@NonNull String remoteApplicationVersion) { |
| Objects.requireNonNull(remoteApplicationVersion, "remoteApplicationVersion was null"); |
| mRemoteApplicationVersion = remoteApplicationVersion; |
| return this; |
| } |
| |
| /** |
| * Clears the remote application version from the {@link IkeSessionConfiguration} being |
| * built. |
| * |
| * @return Builder this, to facilitate chaining |
| */ |
| @NonNull |
| public Builder clearRemoteApplicationVersion() { |
| mRemoteApplicationVersion = ""; |
| return this; |
| } |
| |
| private static void validateExtensionOrThrow(@ExtensionType int extensionType) { |
| if (extensionType >= VALID_EXTENSION_MIN && extensionType <= VALID_EXTENSION_MAX) { |
| return; |
| } |
| throw new IllegalArgumentException("Invalid extension type: " + extensionType); |
| } |
| |
| /** |
| * Marks an IKE extension as enabled for the {@link IkeSessionConfiguration} being built. |
| * |
| * @param extensionType the enabled extension |
| * @return Builder this, to facilitate chaining |
| */ |
| // MissingGetterMatchingBuilder: Use #isIkeExtensionEnabled instead of #getIkeExtension |
| // because #isIkeExtensionEnabled allows callers to check the presence of an IKE extension |
| // more easily |
| @SuppressLint("MissingGetterMatchingBuilder") |
| @NonNull |
| public Builder addIkeExtension(@ExtensionType int extensionType) { |
| validateExtensionOrThrow(extensionType); |
| mEnabledExtensions.add(extensionType); |
| return this; |
| } |
| |
| /** |
| * Clear all enabled IKE extensions from the {@link IkeSessionConfiguration} being built. |
| * |
| * @return Builder this, to facilitate chaining |
| */ |
| @NonNull |
| public Builder clearIkeExtensions() { |
| mEnabledExtensions.clear(); |
| return this; |
| } |
| |
| /** |
| * Sets EapInfo for the {@link IkeSessionConfiguration} being built. |
| * |
| * @return Builder this, to facilitate chaining |
| */ |
| @NonNull |
| public Builder setEapInfo(@Nullable EapInfo eapInfo) { |
| mEapInfo = eapInfo; |
| return this; |
| } |
| |
| /** Constructs an {@link IkeSessionConfiguration} instance. */ |
| @NonNull |
| public IkeSessionConfiguration build() { |
| return new IkeSessionConfiguration( |
| mIkeConnInfo, |
| mPcscfServers, |
| mRemoteVendorIds, |
| mEnabledExtensions, |
| mRemoteApplicationVersion, |
| mEapInfo); |
| } |
| } |
| } |
