arno/etesync-android
1
0
Fork 0
mirror of https://github.com/etesync/android synced 2025-01-23 14:10:54 +00:00
Code Issues Releases Wiki Activity

Enable SSL_RSA_WITH_3DES_EDE_CBC_SHA for all Android versions

Browse Source 
* refactor cipher selection
This commit is contained in:
Ricki Hirner 2017-03-25 19:51:11 +01:00 committed by Tom Hacohen
parent c2e7914290
commit 3a0c112fad
2 changed files with 37 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/build.gradle
View File

@ -135,7 +135,7 @@ dependencies {
compile group: 'com.madgag.spongycastle', name: 'prov', version: '1.54.0.0' compile group: 'com.madgag.spongycastle', name: 'prov', version: '1.54.0.0'
compile group: 'com.google.code.gson', name: 'gson', version: '1.7.2' compile group: 'com.google.code.gson', name: 'gson', version: '1.7.2'
compile 'com.squareup.okhttp3:logging-interceptor:3.6.0' compile 'com.squareup.okhttp3:logging-interceptor:3.6.0'
provided 'org.projectlombok:lombok:1.16.14' provided 'org.projectlombok:lombok:1.16.16'
// for tests // for tests
androidTestCompile('com.android.support.test:runner:0.5') { androidTestCompile('com.android.support.test:runner:0.5') {

73
app/src/main/java/com/etesync/syncadapter/SSLSocketFactoryCompat.java
View File

@ -52,46 +52,45 @@ public class SSLSocketFactoryCompat extends SSLSocketFactory {
SSLSocketFactoryCompat.protocols = protocols.toArray(new String[protocols.size()]); SSLSocketFactoryCompat.protocols = protocols.toArray(new String[protocols.size()]);
/* set up reasonable cipher suites */ /* set up reasonable cipher suites */
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) { // choose known secure cipher suites
// choose known secure cipher suites List<String> allowedCiphers = Arrays.asList(
List<String> allowedCiphers = Arrays.asList( // TLS 1.2
// TLS 1.2 "TLS_RSA_WITH_AES_256_GCM_SHA384",
"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // maximum interoperability
// maximum interoperability "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA", "SSL_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA",
// additionally // additionally
"TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"); "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
List<String> availableCiphers = Arrays.asList(socket.getSupportedCipherSuites()); );
App.log.info("Available cipher suites: " + TextUtils.join(", ", availableCiphers)); List<String> availableCiphers = Arrays.asList(socket.getSupportedCipherSuites());
App.log.info("Cipher suites enabled by default: " + TextUtils.join(", ", socket.getEnabledCipherSuites())); App.log.info("Available cipher suites: " + TextUtils.join(", ", availableCiphers));
// take all allowed ciphers that are available and put them into preferredCiphers /* For maximum security, preferredCiphers should *replace* enabled ciphers (thus
HashSet<String> preferredCiphers = new HashSet<>(allowedCiphers); * disabling ciphers which are enabled by default, but have become unsecure), but for
preferredCiphers.retainAll(availableCiphers); * the security level of DAVdroid and maximum compatibility, disabling of insecure
* ciphers should be a server-side task */
/* For maximum security, preferredCiphers should *replace* enabled ciphers (thus disabling // for the final set of enabled ciphers, take the ciphers enabled by default, ...
* ciphers which are enabled by default, but have become unsecure), but I guess for HashSet<String> enabledCiphers = new HashSet<>(Arrays.asList(socket.getEnabledCipherSuites()));
* the security level of DAVdroid and maximum compatibility, disabling of insecure App.log.info("Cipher suites enabled by default: " + TextUtils.join(", ", enabledCiphers));
* ciphers should be a server-side task */ // ... add explicitly allowed ciphers ...
enabledCiphers.addAll(allowedCiphers);
// ... and keep only those which are actually available
enabledCiphers.retainAll(availableCiphers);
// add preferred ciphers to enabled ciphers App.log.info("Enabling (only) those TLS ciphers: " + TextUtils.join(", ", enabledCiphers));
HashSet<String> enabledCiphers = preferredCiphers; SSLSocketFactoryCompat.cipherSuites = enabledCiphers.toArray(new String[enabledCiphers.size()]);
enabledCiphers.addAll(new HashSet<>(Arrays.asList(socket.getEnabledCipherSuites())));
App.log.info("Enabling (only) those TLS ciphers: " + TextUtils.join(", ", enabledCiphers));
SSLSocketFactoryCompat.cipherSuites = enabledCiphers.toArray(new String[enabledCiphers.size()]);
}
} }
} catch (IOException e) { } catch (IOException e) {
App.log.severe("Couldn't determine default TLS settings"); App.log.severe("Couldn't determine default TLS settings");