Enable TLS 1.1 and TLS 1.2 on Android 4.1-4.4

[fkoester]

This is a proposed patch for issue #7192.

Android 4.1-4.4 has support for TLS 1.1 and 1.2 but it is disabled by default. Because of the known security issues and more and more servers switching to TLS 1.2 only, it would be nice for react-native to enable this support.

I demonstrated a demo application which showcases the problem and can be used to test this patch. All sources and documentation for it can be found here:

https://github.com/bringnow/react-native-tls-test

Credits to Alex Gotev (@gotev) for the nice implementation.

[gotev]

I've done some tests and the same issue also happens on some Samsung devices with API 21. Solved by applying the solution also for API 21

[ghost]

By analyzing the blame information on this pull request, we identified @AndrewJack to be a potential reviewer.

[ghost]

Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. In order for us to review and merge your code, please sign up at https://code.facebook.com/cla - and if you have received this in error or have any questions, please drop us a line at cla@fb.com. Thanks!

[fkoester]

I've done some tests and the same issue also happens on some Samsung devices with API 21. Solved by applying the solution also for API 21

@gotev That's strange, since API 20 it should not be necessary. But maybe Samsung tampered a lot with their Android implementation. So maybe we should then drop the patches API check? Currently it is:

if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 20) 

[ghost]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Facebook open source project. Thanks!

[gotev]

@fkoester that's true for stock Android roms. I thought that all the other vendors were aligned, but maybe I was wrong, since the same problem arises on a Samsung rom with API 21. To solve that I simply changed the if statement:

if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 22)

[facebook-github-bot]

It's been a while since the last commit was reviewed and the labels show this pull request needs review. Based on the blame information for the files in this pull request we identified @AndrewJack as a potential reviewer. Could you take a look please or cc someone with more context?

[duataud]

Please merge. Stripe api don't acept tls < 1.2 anymore

[alexter42]

Same issue Stripe do not accept tls < 1.2. Does anyone else have the same issue?

[AndrewJack]

cc @bestander or @mkonicek could you review this?

[AndrewJack]

Few suggestions

[AndrewJack]

Use com.facebook.common.logging.FLog instead.

[fkoester]

Done.

[AndrewJack]

Use Build.VERSION_CODES for api levels

Build.VERSION_CODES.JELLY_BEAN == 16
Build.VERSION_CODES.KITKAT_WATCH == 20 - maybe use KITKAT (v19) with a <= for readability

[fkoester]

Good idea!

[AndrewJack]

do we need this link?

[fkoester]

Probably not, I removed it.

[bestander]

It looks reasonable to me considering that it is off by default.
A few points:

• Do we need a unit test for this case?
• Do we need to add anything to docs http://facebook.github.io/react-native/docs/network.html or let users figure it out through code?

[fkoester]

I implemented the suggestions made by @AndrewJack and rebased the PR to latest master.

[bestander]

Andrew, shipit when ready

[lacker]

@facebook-github-bot shipit

[facebook-github-bot]

@lacker has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

[ThaJay]

I don't understand:
The issue is marked as resolved: #7192
The code from this merge request is in master, but it does not work for me. Our servers don't accept tls v1 any more and now api <20 is broken, we have test devices to check old versions of android running 4.4 and now they can't do api requests any more.

Also, this comment #7192 (comment) does not seem to work for me. Maybe it is only for api 16? We want to support 4.4 (api 19) and up.