GitLab

This clarifies several points and adds sample code.

(cherry picked from commit 7ac13e03)

Bug: 15073623
Change-Id: I6d8cf195cbc7eb4528760145f62f3e3e7b8507f5

Unlike the previous CL, this uses reflection for android.os.Process and
android.util.EventLog throughout.

(cherry picked from commit 35b1f354)

Bug: 15452942
Change-Id: I34b9eaedf1f1e450b1f8004887bb0482601d789e

OpenSSL's RC4 mutates the given key. AES/CTR mutates the IV. We must
store these values locally to enable "doFinal" to cause the Cipher
instance to be reset to what it was right after "init".

Note that resetting and encrypting with the same key or IV breaks
semantic security.

(cherry picked from commit 084e3086)

Bug: 16298401
Bug: https://code.google.com/p/android/issues/detail?id=73339
Change-Id: Ie7e4dcb6cf6cc33ddad31d6b47066dc1b34e6894

(cherry picked from commit e08f2385)

Bug: 16352665
Change-Id: Idc78204b7077fb367b64e1867c807cd39f596f98

Fix "Buffers were not large enough" exception by directly using the
destination buffers.

Corrections around bytesProduced and bytesConsumed behavior.

Return BUFFER_OVERFLOW if a zero length destination is provided to
unwrap.

(cherry picked from commit bdfcc189)

Bug: 16352665
Change-Id: I1f1e9b72cd6968ed4f3c3c0edccbccebc33d6790

This enables TLS-PSK cipher suites by default iff SSLContext is
initialized with a PSKKeyManager. For consistency, X.509 based
cipher suites are no longer enabled by default at all times -- they
are now only enabled by default iff SSLContext is initialized with a
X509KeyManager or a X509TrustManager.

When both X.509 and PSK cipher suites need to be enabled, PSK cipher
suites are given higher priority in the resulting list of cipher
suites. This is based on the assumption that in most cases users of
TLS/SSL who enable TLS-PSK would prefer TLS-PSK to be used when the
peer supports TLS-PSK.

Bug: 15073623

(cherry picked from commit 8f9ac1af)

Change-Id: Icd7fe066147a6b2fc64d807204cc99f6af821313

Change-Id: I39ab275cd9744ba442fee7db9038107b4603526f

* commit 'fe4a6df5':
  Remove

* commit 'a3284927':
  Remove

(cherry picked from commit b860016f)

Change-Id: I4302ea4e0200ac80a0b9f3b953d58270b65b3d0c

Change-Id: Iea7c633eb68df576bf72314ff5ce31bc8094d9ce

This reverts commit b1599520.

Some build targets (e.g. git_dalvik-dev) do not have API-1 Android APIs available, like android.os.Process and android.util.EventLog. Investigating.

Change-Id: Iddce3f445be0502d1afa4f8244a7b8867721613e

Bug: 15452942
Change-Id: I49e7bad6a65c70e113324c02fc23315cff168f5b

* commit 'dbc347b9':
  Remove direct reference to PROVIDER_NAME

* commit 'd704c478':
  Assert that the padding extension is enabled by default.

* commit '35f7742c':
  Make setEnabledProtocols/CipherSuites copy their inputs.

It's unnecessary and this is the only code that does it like this. It
casuses problems with unbundling since the PROVIDER_NAME can change when
used unbundled.

Bug: 15771893
Change-Id: I1450cf7033b0629e7b79616c3660ec12b8afb8d6

* commit '8f471e15':
  Remove direct reference to PROVIDER_NAME

It's unnecessary and this is the only code that does it like this. It
casuses problems with unbundling since the PROVIDER_NAME can change when
used unbundled.

(cherry-picked from commit c59af1c1)

Bug: 15771893
Change-Id: I1450cf7033b0629e7b79616c3660ec12b8afb8d6

* commit '4f59b745':
  Assert that the padding extension is enabled by default.

* commit '13f0c44c':
  Make setEnabledProtocols/CipherSuites copy their inputs.

SSLSocket, SSLServerSocket, and SSLEngine offer setEnabledProtocols
and setEnabledCipherSuites methods which take an array of protocols
or cipher suites as input. If these methods store references to the
input arrays, then the internal state (lists of enabled protocols and
cipher suites) of SSLSocket, SSLServerSocket, and SSLEngine could be
modified without going through the setter methods of these classes.

Bug: 15753142
Change-Id: Ia5248050d81320ed1da99892278bd60872605f52

* commit 'c961c78c':
  Remove unnecessary comments in SSLParametersImpl.

* commit 'f17361e7':
  Remove unnecessary comments in SSLParametersImpl.

This is a follow-up cleanup requested during the code review of
ae2ecac0.

Change-Id: I6c8ac2392c5f88ee732f5aa204e20cc1ee7e32d8

* commit 'a906b5cc':
  Adjust the list of supported ECDHE-PSK cipher suites.

* commit 'b2713e36':
  Adjust the list of supported ECDHE-PSK cipher suites.

am 54e5afb0: am 8a624688: Merge "SSLParametersImpl is the source of enabled cipher suites and protocols."

* commit '54e5afb0':
  SSLParametersImpl is the source of enabled cipher suites and protocols.

Change-Id: I1c8aa589e3274bfd3a5fc66c3e948828903c1966

* commit '8a624688':
  SSLParametersImpl is the source of enabled cipher suites and protocols.

* commit 'bf877901':
  Switch from core to core-libart

* commit 'ecd29abc':
  Switch from core to core-libart

Bug: 14298175
Change-Id: I5035075f2453b692f86fff8fe852c954698e40ed