diff --git a/AndroidManifest.xml b/AndroidManifest.xml index f7843d5c..204c7d21 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -1,8 +1,8 @@ + android:versionCode="46" + android:versionName="0.6.7.1" android:installLocation="internalOnly"> + android:hint="myaccount@myservice.com"> diff --git a/src/at/bitfire/davdroid/Constants.java b/src/at/bitfire/davdroid/Constants.java index 9349e433..e69af636 100644 --- a/src/at/bitfire/davdroid/Constants.java +++ b/src/at/bitfire/davdroid/Constants.java @@ -9,7 +9,7 @@ package at.bitfire.davdroid; public class Constants { public static final String - APP_VERSION = "0.6.7", + APP_VERSION = "0.6.7.1", ACCOUNT_TYPE = "bitfire.at.davdroid", WEB_URL_HELP = "http://davdroid.bitfire.at/configuration?pk_campaign=davdroid-app", diff --git a/src/at/bitfire/davdroid/syncadapter/QueryServerDialogFragment.java b/src/at/bitfire/davdroid/syncadapter/QueryServerDialogFragment.java index 979542fe..2596cfe0 100644 --- a/src/at/bitfire/davdroid/syncadapter/QueryServerDialogFragment.java +++ b/src/at/bitfire/davdroid/syncadapter/QueryServerDialogFragment.java @@ -113,7 +113,7 @@ public class QueryServerDialogFragment extends DialogFragment implements LoaderC } catch (URISyntaxException e) { serverInfo.setErrorMessage(getContext().getString(R.string.exception_uri_syntax, e.getMessage())); } catch (IOException e) { - serverInfo.setErrorMessage(getContext().getString(R.string.login_exception_io, e.getLocalizedMessage())); + serverInfo.setErrorMessage(getContext().getString(R.string.exception_io, e.getLocalizedMessage())); } catch (HttpException e) { Log.e(TAG, "HTTP error while querying server info", e); serverInfo.setErrorMessage(getContext().getString(R.string.exception_http, e.getLocalizedMessage())); diff --git a/src/at/bitfire/davdroid/webdav/TlsSniSocketFactory.java b/src/at/bitfire/davdroid/webdav/TlsSniSocketFactory.java index 28890953..ce5ec2dd 100644 --- a/src/at/bitfire/davdroid/webdav/TlsSniSocketFactory.java +++ b/src/at/bitfire/davdroid/webdav/TlsSniSocketFactory.java @@ -127,9 +127,13 @@ public class TlsSniSocketFactory implements LayeredConnectionSocketFactory { @SuppressLint("DefaultLocale") private void setReasonableEncryption(SSLSocket ssl) { - // set reasonable SSL/TLS settings before the handshake: + // set reasonable SSL/TLS settings before the handshake - // - enable all supported protocols (enables TLSv1.1 and TLSv1.2 on Android <4.4.3, if available) + // Android 5.0+ (API level21) provides reasonable default settings + // but it still allows SSLv3 + // https://developer.android.com/about/versions/android-5.0-changes.html#ssl + + // - enable all supported protocols (enables TLSv1.1 and TLSv1.2 on Android <5.0, if available) // - remove all SSL versions (especially SSLv3) because they're insecure now List protocols = new LinkedList(); for (String protocol : ssl.getSupportedProtocols()) @@ -138,43 +142,45 @@ public class TlsSniSocketFactory implements LayeredConnectionSocketFactory { Log.v(TAG, "Setting allowed TLS protocols: " + StringUtils.join(protocols, ", ")); ssl.setEnabledProtocols(protocols.toArray(new String[0])); - // choose secure cipher suites - List allowedCiphers = Arrays.asList(new String[] { - // allowed secure ciphers according to NIST.SP.800-52r1.pdf Section 3.3.1 (see docs directory) - // TLS 1.2 - "TLS_RSA_WITH_AES_256_GCM_SHA384", - "TLS_RSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", - "TLS_ECHDE_RSA_WITH_AES_128_GCM_SHA256", - // maximum interoperability - "TLS_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_RSA_WITH_AES_128_CBC_SHA", - // additionally - "TLS_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", - "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", - }); - - List availableCiphers = Arrays.asList(ssl.getSupportedCipherSuites()); - - // preferred ciphers = allowed Ciphers \ availableCiphers - HashSet preferredCiphers = new HashSet(allowedCiphers); - preferredCiphers.retainAll(availableCiphers); - - // add preferred ciphers to enabled ciphers - // for maximum security, preferred ciphers should *replace* enabled ciphers, - // but I guess for the security level of DAVdroid, disabling of insecure - // ciphers should be a server-side task - HashSet enabledCiphers = new HashSet(Arrays.asList(ssl.getEnabledCipherSuites())); - enabledCiphers.addAll(preferredCiphers); - - Log.v(TAG, "Setting allowed TLS ciphers: " + StringUtils.join(enabledCiphers, ", ")); - ssl.setEnabledCipherSuites(enabledCiphers.toArray(new String[0])); + if (android.os.Build.VERSION.SDK_INT < 21) { + // choose secure cipher suites + List allowedCiphers = Arrays.asList(new String[] { + // allowed secure ciphers according to NIST.SP.800-52r1.pdf Section 3.3.1 (see docs directory) + // TLS 1.2 + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", + "TLS_ECHDE_RSA_WITH_AES_128_GCM_SHA256", + // maximum interoperability + "TLS_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_RSA_WITH_AES_128_CBC_SHA", + // additionally + "TLS_RSA_WITH_AES_256_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", + "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", + }); + + List availableCiphers = Arrays.asList(ssl.getSupportedCipherSuites()); + + // preferred ciphers = allowed Ciphers \ availableCiphers + HashSet preferredCiphers = new HashSet(allowedCiphers); + preferredCiphers.retainAll(availableCiphers); + + // add preferred ciphers to enabled ciphers + // for maximum security, preferred ciphers should *replace* enabled ciphers, + // but I guess for the security level of DAVdroid, disabling of insecure + // ciphers should be a server-side task + HashSet enabledCiphers = preferredCiphers; + enabledCiphers.addAll(new HashSet(Arrays.asList(ssl.getEnabledCipherSuites()))); + + Log.v(TAG, "Setting allowed TLS ciphers: " + StringUtils.join(enabledCiphers, ", ")); + ssl.setEnabledCipherSuites(enabledCiphers.toArray(new String[0])); + } } }