From 95e63a9cd490b0c8de3fa218e7ffd1da12447e8e Mon Sep 17 00:00:00 2001 From: n8fr8 Date: Wed, 3 Feb 2016 16:43:39 -0500 Subject: [PATCH] fixes #728 and #718 by disabling unsupport cipher suites --- .../otr/app/im/plugin/xmpp/XMPPCertPins.java | 24 +++++++++---------- .../app/im/plugin/xmpp/XmppConnection.java | 22 +++++++++++------ 2 files changed, 27 insertions(+), 19 deletions(-) diff --git a/src/info/guardianproject/otr/app/im/plugin/xmpp/XMPPCertPins.java b/src/info/guardianproject/otr/app/im/plugin/xmpp/XMPPCertPins.java index 577d246ed..fbdc45eb0 100644 --- a/src/info/guardianproject/otr/app/im/plugin/xmpp/XMPPCertPins.java +++ b/src/info/guardianproject/otr/app/im/plugin/xmpp/XMPPCertPins.java @@ -35,13 +35,13 @@ public class XMPPCertPins "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_DHE_DSS_WITH_AES_128_CBC_SHA", - "TLS_DHE_DSS_WITH_AES_256_CBC_SHA", +// "TLS_DHE_DSS_WITH_AES_128_CBC_SHA", //not support in Android 6 + // "TLS_DHE_DSS_WITH_AES_256_CBC_SHA", - "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA", - "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA", - "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA", +// "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA", + // "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA", +// "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA", +// "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA", @@ -56,13 +56,13 @@ public class XMPPCertPins "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_DHE_DSS_WITH_AES_128_CBC_SHA", - "TLS_DHE_DSS_WITH_AES_256_CBC_SHA", + // "TLS_DHE_DSS_WITH_AES_128_CBC_SHA", + // "TLS_DHE_DSS_WITH_AES_256_CBC_SHA", - "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA", - "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA", - "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA", + // "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA", + // "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA", + //"TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA", + // "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA", diff --git a/src/info/guardianproject/otr/app/im/plugin/xmpp/XmppConnection.java b/src/info/guardianproject/otr/app/im/plugin/xmpp/XmppConnection.java index 4045ed6f7..72df9fd8a 100644 --- a/src/info/guardianproject/otr/app/im/plugin/xmpp/XmppConnection.java +++ b/src/info/guardianproject/otr/app/im/plugin/xmpp/XmppConnection.java @@ -1183,16 +1183,24 @@ else if (domain.contains("google.com")||domain.contains("gmail.com")) //if not g sslContext.init(null, new javax.net.ssl.TrustManager[] { trustManager }, secureRandom); - sslContext.getDefaultSSLParameters().getCipherSuites(); - - if (Build.VERSION.SDK_INT >= 20) { - - sslContext.getDefaultSSLParameters().setCipherSuites(XMPPCertPins.SSL_IDEAL_CIPHER_SUITES_API_20); + try + { + sslContext.getDefaultSSLParameters().getCipherSuites(); + if (Build.VERSION.SDK_INT >= 20) { + + sslContext.getDefaultSSLParameters().setCipherSuites(XMPPCertPins.SSL_IDEAL_CIPHER_SUITES_API_20); + } + else + { + sslContext.getDefaultSSLParameters().setCipherSuites(XMPPCertPins.SSL_IDEAL_CIPHER_SUITES); + } } - else + catch (Exception e) { - sslContext.getDefaultSSLParameters().setCipherSuites(XMPPCertPins.SSL_IDEAL_CIPHER_SUITES); + //this can happen if the cipher suites aren't available on the devices + debug(TAG, "Error setting ideal cipher suites: " + e); + }