Security Patches :D

libs/WifiTrackerLib/src/com/android/wifitrackerlib/WifiEntry.java

@@ -28,6 +28,7 @@
 import android.net.NetworkInfo;
 import android.net.NetworkUtils;
 import android.net.RouteInfo;
+import android.net.wifi.ScanResult;
 import android.net.wifi.WifiConfiguration;
 import android.net.wifi.WifiInfo;
 import android.net.wifi.WifiManager;
@@ -371,6 +372,7 @@ public static class ConnectedInfo {
         public List<String> ipv6Addresses = new ArrayList<>();
         public String gateway;
         public String subnetMask;
+        public int wifiStandard = ScanResult.WIFI_STANDARD_UNKNOWN;
     }
 
     // User actions on a network
@@ -648,6 +650,7 @@ && connectionInfoMatches(wifiInfo, networkInfo)) {
                 }
                 mConnectedInfo.frequencyMhz = wifiInfo.getFrequency();
                 mConnectedInfo.linkSpeedMbps = wifiInfo.getLinkSpeed();
+                mConnectedInfo.wifiStandard = wifiInfo.getWifiStandard();
             }
         } else { // Connection info doesn't matched, so this network is disconnected
             mNetworkInfo = null;

service/java/com/android/server/wifi/ClientModeImpl.java

@@ -3515,6 +3515,10 @@ public boolean processMessage(Message message) {
                     mTemporarilyDisconnectWifi = (message.arg1 == 1);
                     replyToMessage(message, WifiP2pServiceImpl.DISCONNECT_WIFI_RESPONSE);
                     break;
+                case WifiP2pServiceImpl.SET_MIRACAST_MODE:
+                    if (mVerboseLoggingEnabled) logd("SET_MIRACAST_MODE: " + (int)message.arg1);
+                    mWifiConnectivityManager.saveMiracastMode((int)message.arg1);
+                    break;
                 /* Link configuration (IP address, DNS, ...) changes notified via netlink */
                 case CMD_UPDATE_LINKPROPERTIES:
                     updateLinkProperties((LinkProperties) message.obj);

service/java/com/android/server/wifi/WifiConfigManager.java

@@ -1387,7 +1387,7 @@ private boolean removeNetworkInternal(WifiConfiguration config, int uid) {
         // will remove the enterprise keys when provider is uninstalled. Suggestion enterprise
         // networks will remove the enterprise keys when suggestion is removed.
         if (!config.fromWifiNetworkSuggestion && !config.isPasspoint() && config.isEnterprise()) {
-            mWifiKeyStore.removeKeys(config.enterpriseConfig);
+            mWifiKeyStore.removeKeys(config.enterpriseConfig, false);
         }
 
         removeConnectChoiceFromAllNetworks(config.getKey());

service/java/com/android/server/wifi/WifiConfigurationUtil.java

@@ -413,7 +413,8 @@ private static boolean validateBssid(String bssid) {
         return true;
     }
 
-    private static boolean validatePassword(String password, boolean isAdd, boolean isSae) {
+    private static boolean validatePassword(String password, boolean isAdd, boolean isSae,
+            boolean isWapi) {
         if (isAdd) {
             if (password == null) {
                 Log.e(TAG, "validatePassword: null string");
@@ -454,8 +455,14 @@ private static boolean validatePassword(String password, boolean isAdd, boolean
                 return false;
             }
         } else {
-            // HEX PSK string
-            if (password.length() != PSK_SAE_HEX_LEN) {
+            if (isWapi) {
+                // Protect system against malicious actors injecting arbitrarily large passwords.
+                if (password.length() > 100) {
+                    Log.e(TAG, "validatePassword failed: WAPI hex string too long: "
+                            + password.length());
+                    return false;
+                }
+            } else if (password.length() != PSK_SAE_HEX_LEN) {
                 Log.e(TAG, "validatePassword failed: hex string size mismatch: "
                         + password.length());
                 return false;
@@ -600,7 +607,11 @@ public static boolean validate(WifiConfiguration config, boolean isAdd) {
             return false;
         }
         if (config.allowedKeyManagement.get(WifiConfiguration.KeyMgmt.WPA_PSK)
-                && !validatePassword(config.preSharedKey, isAdd, false)) {
+                && !validatePassword(config.preSharedKey, isAdd, false, false)) {
+            return false;
+        }
+        if (config.allowedKeyManagement.get(WifiConfiguration.KeyMgmt.WAPI_PSK)
+                && !validatePassword(config.preSharedKey, isAdd, false, true)) {
             return false;
         }
         if (config.allowedKeyManagement.get(WifiConfiguration.KeyMgmt.OWE)) {
@@ -616,7 +627,7 @@ public static boolean validate(WifiConfiguration config, boolean isAdd) {
                 Log.e(TAG, "PMF must be enabled for SAE networks");
                 return false;
             }
-            if (!validatePassword(config.preSharedKey, isAdd, true)) {
+            if (!validatePassword(config.preSharedKey, isAdd, true, false)) {
                 return false;
             }
         }
@@ -761,7 +772,7 @@ public static boolean validateNetworkSpecifier(WifiNetworkSpecifier specifier) {
             return false;
         }
         if (config.allowedKeyManagement.get(WifiConfiguration.KeyMgmt.WPA_PSK)
-                && !validatePassword(config.preSharedKey, true, false)) {
+                && !validatePassword(config.preSharedKey, true, false, false)) {
             return false;
         }
         if (config.allowedKeyManagement.get(WifiConfiguration.KeyMgmt.OWE)) {
@@ -775,7 +786,7 @@ public static boolean validateNetworkSpecifier(WifiNetworkSpecifier specifier) {
             if (!config.requirePmf) {
                 return false;
             }
-            if (!validatePassword(config.preSharedKey, true, true)) {
+            if (!validatePassword(config.preSharedKey, true, true, false)) {
                 return false;
             }
         }

service/java/com/android/server/wifi/WifiConnectivityManager.java

@@ -23,6 +23,7 @@
 import android.app.AlarmManager;
 import android.content.Context;
 import android.net.MacAddress;
+import android.net.wifi.p2p.WifiP2pManager;
 import android.net.wifi.ScanResult;
 import android.net.wifi.SupplicantState;
 import android.net.wifi.WifiConfiguration;
@@ -160,6 +161,7 @@ public class WifiConnectivityManager {
     private boolean mAutoJoinEnabled = false; // disabled by default, enabled by external triggers
     private boolean mRunning = false;
     private boolean mScreenOn = false;
+    private int mMiracastMode = WifiP2pManager.MIRACAST_DISABLED;
     private int mWifiState = WIFI_STATE_UNKNOWN;
     private int mInitialScanState = INITIAL_SCAN_STATE_COMPLETE;
     private boolean mAutoJoinEnabledExternal = true; // enabled by default
@@ -175,6 +177,7 @@ public class WifiConnectivityManager {
     private boolean mPnoScanStarted = false;
     private boolean mPeriodicScanTimerSet = false;
     private boolean mDelayedPartialScanTimerSet = false;
+    private boolean mWatchdogScanTimerSet = false;
 
     // Used for Initial Scan metrics
     private boolean mFailedInitialPartialScan = false;
@@ -1255,6 +1258,17 @@ private void periodicScanTimerHandler() {
 
     // Start a single scan
     private void startForcedSingleScan(boolean isFullBandScan, WorkSource workSource) {
+        // Any scans will impact wifi performance including WFD performance,
+        // So at least ignore scans triggered internally by ConnectivityManager
+        // when WFD session is active. We still allow connectivity scans initiated
+        // by other work source.
+        if (WIFI_WORK_SOURCE.equals(workSource) &&
+                (mMiracastMode == WifiP2pManager.MIRACAST_SOURCE ||
+                mMiracastMode == WifiP2pManager.MIRACAST_SINK)) {
+            localLog("Ignore connectivity scan, MiracastMode:" + mMiracastMode);
+            return;
+        }
+
         mPnoScanListener.resetLowRssiNetworkRetryDelay();
 
         ScanSettings settings = new ScanSettings();
@@ -1466,6 +1480,15 @@ private void scheduleWatchdogTimer() {
                             mClock.getElapsedSinceBootMillis() + WATCHDOG_INTERVAL_MS,
                             WATCHDOG_TIMER_TAG,
                             mWatchdogListener, mEventHandler);
+        mWatchdogScanTimerSet = true;
+    }
+
+    // Cancel the watchdog scan timer.
+    private void cancelWatchdogScan() {
+        if (mWatchdogScanTimerSet) {
+            mAlarmManager.cancel(mWatchdogListener);
+            mWatchdogScanTimerSet = false;
+        }
     }
 
     // Schedules a delayed partial scan, which will scan the frequencies in mCachedWifiCandidates.
@@ -1585,6 +1608,15 @@ public void handleScreenStateChanged(boolean screenOn) {
         startConnectivityScan(SCAN_ON_SCHEDULE);
     }
 
+    /**
+     * Save current miracast mode, it will be used to ignore
+     * connectivity scan during the time when miracast is enabled.
+     */
+    public void saveMiracastMode(int mode) {
+        localLog("saveMiracastMode: mode=" + mode);
+        mMiracastMode = mode;
+    }
+
     /**
      * Helper function that converts the WIFI_STATE_XXX constants to string
      */
@@ -1893,6 +1925,7 @@ private void stop() {
         if (!mRunning) return;
         mRunning = false;
         stopConnectivityScan();
+        cancelWatchdogScan();
         resetLastPeriodicSingleScanTimeStamp();
         mOpenNetworkNotifier.clearPendingNotification(true /* resetRepeatDelay */);
         mLastConnectionAttemptBssid = null;

service/java/com/android/server/wifi/WifiInjector.java

@@ -855,4 +855,9 @@ public WifiSettingsConfigStore getSettingsConfigStore() {
     public DeviceConfigFacade getDeviceConfigFacade() {
         return mDeviceConfigFacade;
     }
+
+    @NonNull
+    public WifiKeyStore getWifiKeyStore() {
+        return mWifiKeyStore;
+    }
 }

service/java/com/android/server/wifi/WifiKeyStore.java

@@ -201,11 +201,12 @@ public boolean removeEntryFromKeyStore(String alias) {
      * Remove enterprise keys from the network config.
      *
      * @param config Config corresponding to the network.
+     * @param forceRemove remove keys regardless of the key installer.
      */
-    public void removeKeys(WifiEnterpriseConfig config) {
+    public void removeKeys(WifiEnterpriseConfig config, boolean forceRemove) {
         Preconditions.checkNotNull(mKeyStore);
         // Do not remove keys that were manually installed by the user
-        if (config.isAppInstalledDeviceKeyAndCert()) {
+        if (forceRemove || config.isAppInstalledDeviceKeyAndCert()) {
             String client = config.getClientCertificateAlias();
             // a valid client certificate is configured
             if (!TextUtils.isEmpty(client)) {
@@ -219,7 +220,7 @@ public void removeKeys(WifiEnterpriseConfig config) {
         }
 
         // Do not remove CA certs that were manually installed by the user
-        if (config.isAppInstalledCaCert()) {
+        if (forceRemove || config.isAppInstalledCaCert()) {
             String[] aliases = config.getCaCertificateAliases();
             if (aliases == null || aliases.length == 0) {
                 return;

service/java/com/android/server/wifi/WifiNetworkSuggestionsManager.java

@@ -52,6 +52,7 @@
 import android.os.UserHandle;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
+import android.util.EventLog;
 import android.util.Log;
 import android.util.Pair;
 import android.view.WindowManager;
@@ -70,12 +71,14 @@
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
 
@@ -849,7 +852,7 @@ private void updateWifiConfigInWcmIfPresent(
         if (mVerboseLoggingEnabled) {
             Log.v(TAG, "Adding " + networkSuggestions.size() + " networks from " + packageName);
         }
-        if (!validateNetworkSuggestions(networkSuggestions)) {
+        if (!validateNetworkSuggestions(networkSuggestions, uid)) {
             Log.e(TAG, "Invalid suggestion add from app: " + packageName);
             return WifiManager.STATUS_NETWORK_SUGGESTIONS_ERROR_ADD_INVALID;
         }
@@ -966,7 +969,23 @@ private void updateWifiConfigInWcmIfPresent(
         }
         // Update the max size for this app.
         perAppInfo.maxSize = Math.max(perAppInfo.extNetworkSuggestions.size(), perAppInfo.maxSize);
-        saveToStore();
+        try {
+            saveToStore();
+        } catch (OutOfMemoryError e) {
+            Optional<PerAppInfo> appInfo = mActiveNetworkSuggestionsPerApp.values()
+                .stream()
+                .max(Comparator.comparingInt(a -> a.extNetworkSuggestions.size()));
+            if (appInfo.isPresent()) {
+                EventLog.writeEvent(0x534e4554, "245299920", appInfo.get().uid,
+                    "Trying to add large number of suggestion, num="
+                        + appInfo.get().extNetworkSuggestions.size());
+            } else {
+                Log.e(TAG, "serialize out of memory but no app has suggestion!");
+            }
+            // Remove the most recently added suggestions, which should cause the failure.
+            remove(networkSuggestions, uid, packageName);
+            return WifiManager.STATUS_NETWORK_SUGGESTIONS_ERROR_INTERNAL;
+        }
         mWifiMetrics.incrementNetworkSuggestionApiNumModification();
         mWifiMetrics.noteNetworkSuggestionApiListSizeHistogram(getAllMaxSizes());
         return WifiManager.STATUS_NETWORK_SUGGESTIONS_SUCCESS;
@@ -988,7 +1007,8 @@ private boolean isSimBasedSuggestion(ExtendedWifiNetworkSuggestion ewns) {
         }
     }
 
-    private boolean validateNetworkSuggestions(List<WifiNetworkSuggestion> networkSuggestions) {
+    private boolean validateNetworkSuggestions(List<WifiNetworkSuggestion> networkSuggestions,
+            int uid) {
         for (WifiNetworkSuggestion wns : networkSuggestions) {
             if (wns == null || wns.wifiConfiguration == null) {
                 return false;
@@ -1006,6 +1026,8 @@ private boolean validateNetworkSuggestions(List<WifiNetworkSuggestion> networkSu
 
             } else {
                 if (!wns.passpointConfiguration.validate()) {
+                    EventLog.writeEvent(0x534e4554, "245299920", uid,
+                            "Trying to add invalid passpoint suggestion");
                     return false;
                 }
             }
@@ -1095,7 +1117,7 @@ private void removeInternal(
                 removeFromPassPointInfoMap(ewns);
             } else {
                 if (ewns.wns.wifiConfiguration.isEnterprise()) {
-                    mWifiKeyStore.removeKeys(ewns.wns.wifiConfiguration.enterpriseConfig);
+                    mWifiKeyStore.removeKeys(ewns.wns.wifiConfiguration.enterpriseConfig, false);
                 }
                 removeFromScanResultMatchInfoMapAndRemoveRelatedScoreCard(ewns);
             }
@@ -1129,7 +1151,7 @@ private void removeInternal(
             Log.v(TAG, "Removing " + networkSuggestions.size() + " networks from " + packageName);
         }
 
-        if (!validateNetworkSuggestions(networkSuggestions)) {
+        if (!validateNetworkSuggestions(networkSuggestions, uid)) {
             Log.e(TAG, "Invalid suggestion remove from app: " + packageName);
             return WifiManager.STATUS_NETWORK_SUGGESTIONS_ERROR_REMOVE_INVALID;
         }

service/java/com/android/server/wifi/WifiServiceImpl.java

@@ -104,6 +104,7 @@
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
+import android.util.EventLog;
 import android.util.Log;
 import android.util.MutableBoolean;
 
@@ -189,7 +190,7 @@ public class WifiServiceImpl extends BaseWifiService {
     private final WifiConfigManager mWifiConfigManager;
     private final PasspointManager mPasspointManager;
     private final WifiLog mLog;
-    private WifiStaStateNotifier mWifiStaStateNotifier;
+    private final WifiStaStateNotifier mWifiStaStateNotifier;
 
     /**
      * Verbose logging flag. Toggled by developer options.
@@ -3452,7 +3453,14 @@ public void factoryReset(String packageName) {
         List<WifiConfiguration> networks = mWifiThreadRunner.call(
                 () -> mWifiConfigManager.getSavedNetworks(Process.WIFI_UID),
                 Collections.emptyList());
+        EventLog.writeEvent(0x534e4554, "231985227", -1,
+                "Remove certs for factory reset");
         for (WifiConfiguration network : networks) {
+            if (network.isEnterprise()) {
+                mWifiThreadRunner.run(() ->
+                        mWifiInjector.getWifiKeyStore()
+                                .removeKeys(network.enterpriseConfig, true));
+            }
             removeNetwork(network.networkId, packageName);
         }
         // Delete all Passpoint configurations
@@ -3463,6 +3471,9 @@ public void factoryReset(String packageName) {
             removePasspointConfigurationInternal(null, config.getUniqueId());
         }
         mWifiThreadRunner.post(() -> {
+            EventLog.writeEvent(0x534e4554, "241927115", -1,
+                    "Reset SoftApConfiguration to default configuration");
+            mWifiApConfigStore.setApConfiguration(null);
             mPasspointManager.clearAnqpRequestsAndFlushCache();
             mWifiConfigManager.clearUserTemporarilyDisabledList();
             mWifiConfigManager.removeAllEphemeralOrPasspointConfiguredNetworks();