{"action":"created","issue":{"url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/635","repository_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore","labels_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/635/labels{/name}","comments_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/635/comments","events_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/635/events","html_url":"https://github.com/microg/android_packages_apps_GmsCore/pull/635","id":368031708,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIxMzAxNjUx","number":635,"title":"Add implementation of ProviderInstallerImpl","user":{"login":"voidstarstar","id":8335186,"node_id":"MDQ6VXNlcjgzMzUxODY=","avatar_url":"https://avatars1.githubusercontent.com/u/8335186?v=4","gravatar_id":"","url":"https://api.github.com/users/voidstarstar","html_url":"https://github.com/voidstarstar","followers_url":"https://api.github.com/users/voidstarstar/followers","following_url":"https://api.github.com/users/voidstarstar/following{/other_user}","gists_url":"https://api.github.com/users/voidstarstar/gists{/gist_id}","starred_url":"https://api.github.com/users/voidstarstar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/voidstarstar/subscriptions","organizations_url":"https://api.github.com/users/voidstarstar/orgs","repos_url":"https://api.github.com/users/voidstarstar/repos","events_url":"https://api.github.com/users/voidstarstar/events{/privacy}","received_events_url":"https://api.github.com/users/voidstarstar/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":21,"created_at":"2018-10-09T03:57:44Z","updated_at":"2019-03-12T18:45:41Z","closed_at":"2019-03-12T02:54:03Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/pulls/635","html_url":"https://github.com/microg/android_packages_apps_GmsCore/pull/635","diff_url":"https://github.com/microg/android_packages_apps_GmsCore/pull/635.diff","patch_url":"https://github.com/microg/android_packages_apps_GmsCore/pull/635.patch"},"body":"This is an implementation of the method `ProviderInstallerImpl` to help protect against SSL exploits.  A new dependency on conscrypt was added and it should be updated periodically.  Minimal testing was done on an unofficial build of CM13, but further testing is welcome.\r\n\r\nFixes #504 and fixes #72.\r\n\r\nI tested Hangouts it no longer appears to crash on startup, even without the workaround https://github.com/microg/android_packages_apps_GmsCore/issues/72#issuecomment-303714674.\r\n\r\nIssue #86 calls this code so it should probably be tested.  I have not tested Gmail Sync, but I suspect this only fixes one of multiple problems with it.\r\n\r\nOther Google and non-Google apps may be affected as well if they attempted to [update the security provider](https://developer.android.com/training/articles/security-gms-provider).\r\n\r\nNote: This is not a full implementation since a couple things are missing, but it seems to be enough to work.  For example, the default `HostnameVerifier` is not set, which I think Google added to prevent certain attack vectors.  Another thing missing is a test for the `conscrypt_gmscore_jni` version.  These should be added in the future for better security and stability."},"comment":{"url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/comments/472132805","html_url":"https://github.com/microg/android_packages_apps_GmsCore/pull/635#issuecomment-472132805","issue_url":"https://api.github.com/repos/microg/android_packages_apps_GmsCore/issues/635","id":472132805,"node_id":"MDEyOklzc3VlQ29tbWVudDQ3MjEzMjgwNQ==","user":{"login":"ale5000-git","id":15793015,"node_id":"MDQ6VXNlcjE1NzkzMDE1","avatar_url":"https://avatars1.githubusercontent.com/u/15793015?v=4","gravatar_id":"","url":"https://api.github.com/users/ale5000-git","html_url":"https://github.com/ale5000-git","followers_url":"https://api.github.com/users/ale5000-git/followers","following_url":"https://api.github.com/users/ale5000-git/following{/other_user}","gists_url":"https://api.github.com/users/ale5000-git/gists{/gist_id}","starred_url":"https://api.github.com/users/ale5000-git/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ale5000-git/subscriptions","organizations_url":"https://api.github.com/users/ale5000-git/orgs","repos_url":"https://api.github.com/users/ale5000-git/repos","events_url":"https://api.github.com/users/ale5000-git/events{/privacy}","received_events_url":"https://api.github.com/users/ale5000-git/received_events","type":"User","site_admin":false},"created_at":"2019-03-12T18:45:41Z","updated_at":"2019-03-12T18:45:41Z","author_association":"CONTRIBUTOR","body":"@mar-v-in: If possible it would be nice to find a way to fix this at microG level (despite the problem affect also Google Play Service).\r\n\r\nLook:\r\n> Calling ProviderInstaller.installIfNeeded\r\n> ...\r\n> Originally, we thought we were done after doing this step. However, after further testing, we noticed something peculiar. Many devices succeeded in updating the security Provider via installIfNeeded, but were still throwing SSLHandshakeExceptions when the server required TLS 1.2!\r\n> \r\n> Our initial understanding of OkHttp’s HTTPS strategy was that it uses the highest-installed version of TLS, and it falls back to older protocols if newer ones are not installed. This is false.\r\n> \r\n> OkHttp’s default behavior is to use an SSLSocketFactory to create SSLSockets with default parameters, and select from protocols that are enabled for a given SSLSocket. Here’s the kicker: The latest protocols installed on a device are not necessarily enabled on its default SSLSockets!\r\n> \r\n> To fix this, we need to override OkHttp’s SSLSocketFactory to enable TLS 1.2 on all SSLSockets\r\n\r\nRef: https://medium.com/tech-quizlet/working-with-tls-1-2-on-android-4-4-and-lower-f4f5205629a"}}
{"actor":{"display_login":"ale5000-git"}}