Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4 #9840

fkoester · 2016-09-10T17:48:38Z

This is a proposed patch for issue #7192.

Android 4.1-4.4 has support for TLS 1.1 and 1.2 but it is disabled by default. Because of the known security issues and more and more servers switching to TLS 1.2 only, it would be nice for react-native to enable this support.

I demonstrated a demo application which showcases the problem and can be used to test this patch. All sources and documentation for it can be found here:

https://github.com/bringnow/react-native-tls-test

Credits to Alex Gotev (@gotev) for the nice implementation.

gotev · 2016-09-10T17:52:22Z

I've done some tests and the same issue also happens on some Samsung devices with API 21. Solved by applying the solution also for API 21

ghost · 2016-09-10T17:52:46Z

By analyzing the blame information on this pull request, we identified @AndrewJack to be a potential reviewer.

ghost · 2016-09-10T17:52:47Z

Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. In order for us to review and merge your code, please sign up at https://code.facebook.com/cla - and if you have received this in error or have any questions, please drop us a line at cla@fb.com. Thanks!

fkoester · 2016-09-11T09:01:13Z

I've done some tests and the same issue also happens on some Samsung devices with API 21. Solved by applying the solution also for API 21

@gotev That's strange, since API 20 it should not be necessary. But maybe Samsung tampered a lot with their Android implementation. So maybe we should then drop the patches API check? Currently it is:

if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 20)

ghost · 2016-09-11T09:33:21Z

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Facebook open source project. Thanks!

gotev · 2016-09-11T09:38:07Z

@fkoester that's true for stock Android roms. I thought that all the other vendors were aligned, but maybe I was wrong, since the same problem arises on a Samsung rom with API 21. To solve that I simply changed the if statement:

if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 22)

facebook-github-bot · 2016-10-11T17:01:54Z

It's been a while since the last commit was reviewed and the labels show this pull request needs review. Based on the blame information for the files in this pull request we identified @AndrewJack as a potential reviewer. Could you take a look please or cc someone with more context?

duataud · 2016-10-21T23:38:19Z

Please merge. Stripe api don't acept tls < 1.2 anymore

alexter42 · 2016-10-21T23:40:19Z

Same issue Stripe do not accept tls < 1.2. Does anyone else have the same issue?

AndrewJack · 2016-10-22T09:00:53Z

cc @bestander or @mkonicek could you review this?

AndrewJack

Few suggestions

AndrewJack · 2016-10-22T09:01:23Z

ReactAndroid/src/main/java/com/facebook/react/modules/network/OkHttpClientProvider.java

+
+        client.connectionSpecs(specs);
+      } catch (Exception exc) {
+        Log.e("OkHttpClientProvider", "Error while enabling TLS 1.2", exc);


Use com.facebook.common.logging.FLog instead.

AndrewJack · 2016-10-22T09:05:09Z

ReactAndroid/src/main/java/com/facebook/react/modules/network/OkHttpClientProvider.java

+    See also https://github.com/facebook/react-native/issues/7192
+   */
+  public static OkHttpClient.Builder enableTls12OnPreLollipop(OkHttpClient.Builder client) {
+    if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 20) {


Use Build.VERSION_CODES for api levels

Build.VERSION_CODES.JELLY_BEAN == 16
Build.VERSION_CODES.KITKAT_WATCH == 20 - maybe use KITKAT (v19) with a <= for readability

AndrewJack · 2016-10-22T09:07:33Z

ReactAndroid/src/main/java/com/facebook/react/modules/network/OkHttpClientProvider.java

+    available but not enabled by default. The following method
+    enables it.
+
+    See also https://github.com/facebook/react-native/issues/7192


do we need this link?

Probably not, I removed it.

bestander · 2016-10-22T12:07:29Z

It looks reasonable to me considering that it is off by default.
A few points:

Do we need a unit test for this case?
Do we need to add anything to docs http://facebook.github.io/react-native/docs/network.html or let users figure it out through code?

@gotev

Credits to Alex Gotev (@gotev) for the nice implementation.

fkoester · 2016-10-22T14:03:54Z

I implemented the suggestions made by @AndrewJack and rebased the PR to latest master.

bestander · 2016-10-22T14:27:34Z

Andrew, shipit when ready

lacker · 2016-10-28T23:19:31Z

@facebook-github-bot shipit

facebook-github-bot · 2016-10-28T23:20:15Z

@lacker has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

Summary: This is a proposed patch for issue facebook#7192. Android 4.1-4.4 has support for TLS 1.1 and 1.2 but it is disabled by default. Because of the known security issues and more and more servers switching to TLS 1.2 only, it would be nice for react-native to enable this support. I demonstrated a demo application which showcases the problem and can be used to test this patch. All sources and documentation for it can be found here: https://github.com/bringnow/react-native-tls-test Credits to Alex Gotev (gotev) for the nice implementation. Closes facebook#9840 Differential Revision: D4099446 Pulled By: lacker fbshipit-source-id: 94db320dce6d27f98169e63f834562360c00eef7

… in facebook/react-native#9840

ThaJay · 2019-02-28T12:25:08Z

I don't understand:
The issue is marked as resolved: #7192
The code from this merge request is in master, but it does not work for me. Our servers don't accept tls v1 any more and now api <20 is broken, we have test devices to check old versions of android running 4.4 and now they can't do api requests any more.

Also, this comment #7192 (comment) does not seem to work for me. Maybe it is only for api 16? We want to support 4.4 (api 19) and up.

ghost added the GH Review: review-needed label Sep 10, 2016

fkoester changed the title ~~Enable TLS 1.2 on Android 4.1-4.4 (See Issue #7192)~~ Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4 Sep 11, 2016

ghost added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 11, 2016

facebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Oct 11, 2016

AndrewJack suggested changes Oct 22, 2016

View reviewed changes

fkoester force-pushed the enable-tls-1.2 branch from 2b5b494 to 67ee28e Compare October 22, 2016 14:00

Enable TLS 1.2 on Android 4.1-4.4 (See Issue facebook#7192)

fc7d451

Credits to Alex Gotev (@gotev) for the nice implementation.

fkoester force-pushed the enable-tls-1.2 branch from 67ee28e to fc7d451 Compare October 22, 2016 14:01

facebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Oct 23, 2016

facebook-github-bot added GH Review: accepted Import Started This pull request has been imported. This does not imply the PR has been approved. and removed GH Review: review-needed labels Oct 28, 2016

facebook-github-bot closed this in 55ebb89 Oct 29, 2016

marcopar mentioned this pull request Feb 11, 2017

Support for HTTPS TLS connections on older devices muzei/muzei#332

Merged

marcopar added a commit to marcopar/SDOViewer that referenced this pull request Feb 11, 2017

Rework OkHttpClientFactory to support TLS1.1, simlar to the work done…

f1b50d7

… in facebook/react-native#9840

minhtc mentioned this pull request May 18, 2017

Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4 for web socket connection #14042

Closed

jhellman mentioned this pull request Jul 13, 2017

Add support for TLS 1.2 when running Android 4 wkh237/react-native-fetch-blob#430

Merged

shergin mentioned this pull request Sep 23, 2017

Adding TLSv1 support for custom SSL socket factory #14245

Closed

ThaJay mentioned this pull request Feb 28, 2019

OkHttpClientProvider for Android 4 does not support TLSv1 #14244

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4 #9840

Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4 #9840

fkoester commented Sep 10, 2016

gotev commented Sep 10, 2016

ghost commented Sep 10, 2016

ghost commented Sep 10, 2016

fkoester commented Sep 11, 2016

ghost commented Sep 11, 2016

gotev commented Sep 11, 2016

facebook-github-bot commented Oct 11, 2016

duataud commented Oct 21, 2016

alexter42 commented Oct 21, 2016

AndrewJack commented Oct 22, 2016

AndrewJack left a comment

AndrewJack Oct 22, 2016

fkoester Oct 22, 2016

AndrewJack Oct 22, 2016 •

edited

fkoester Oct 22, 2016

AndrewJack Oct 22, 2016

fkoester Oct 22, 2016 •

edited

bestander commented Oct 22, 2016

fkoester commented Oct 22, 2016

bestander commented Oct 22, 2016

lacker commented Oct 28, 2016

facebook-github-bot commented Oct 28, 2016

ThaJay commented Feb 28, 2019 •

edited

Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4 #9840

Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4 #9840

Conversation

fkoester commented Sep 10, 2016

gotev commented Sep 10, 2016

ghost commented Sep 10, 2016

ghost commented Sep 10, 2016

fkoester commented Sep 11, 2016

ghost commented Sep 11, 2016

gotev commented Sep 11, 2016

facebook-github-bot commented Oct 11, 2016

duataud commented Oct 21, 2016

alexter42 commented Oct 21, 2016

AndrewJack commented Oct 22, 2016

AndrewJack left a comment

Choose a reason for hiding this comment

AndrewJack Oct 22, 2016

Choose a reason for hiding this comment

fkoester Oct 22, 2016

Choose a reason for hiding this comment

AndrewJack Oct 22, 2016 • edited

Choose a reason for hiding this comment

fkoester Oct 22, 2016

Choose a reason for hiding this comment

AndrewJack Oct 22, 2016

Choose a reason for hiding this comment

fkoester Oct 22, 2016 • edited

Choose a reason for hiding this comment

bestander commented Oct 22, 2016

fkoester commented Oct 22, 2016

bestander commented Oct 22, 2016

lacker commented Oct 28, 2016

facebook-github-bot commented Oct 28, 2016

ThaJay commented Feb 28, 2019 • edited

AndrewJack Oct 22, 2016 •

edited

fkoester Oct 22, 2016 •

edited

ThaJay commented Feb 28, 2019 •

edited