src/java/android/net/ipsec/ike/IkeTrafficSelector.java - platform/packages/modules/IPsec - Git at Google

 /*
  * Copyright (C) 2019 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 package android.net.ipsec.ike;

 import android.annotation.IntDef;
 import android.util.ArraySet;

 import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.net.ipsec.ike.exceptions.InvalidSyntaxException;

 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.net.Inet4Address;
 import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.UnknownHostException;
 import java.nio.BufferOverflowException;
 import java.nio.ByteBuffer;
 import java.util.Objects;

 /**
  * IkeTrafficSelector represents a Traffic Selector of a Child SA.
  *
  * <p>IkeTrafficSelector can be constructed by users for initiating Create Child exchange or be
  * constructed from a decoded inbound Traffic Selector Payload.
  *
  * @see <a href="https://tools.ietf.org/html/rfc7296#section-3.13">RFC 7296, Internet Key Exchange
  *     Protocol Version 2 (IKEv2)</a>
  */
 public final class IkeTrafficSelector {

     // IpProtocolId consists of standard IP Protocol IDs.
     @Retention(RetentionPolicy.SOURCE)
     @IntDef({IP_PROTOCOL_ID_UNSPEC, IP_PROTOCOL_ID_ICMP, IP_PROTOCOL_ID_TCP, IP_PROTOCOL_ID_UDP})
     public @interface IpProtocolId {}

     // Zero value is re-defined by IKE to indicate that all IP protocols are acceptable.
     @VisibleForTesting static final int IP_PROTOCOL_ID_UNSPEC = 0;
     @VisibleForTesting static final int IP_PROTOCOL_ID_ICMP = 1;
     @VisibleForTesting static final int IP_PROTOCOL_ID_TCP = 6;
     @VisibleForTesting static final int IP_PROTOCOL_ID_UDP = 17;

     private static final ArraySet<Integer> IP_PROTOCOL_ID_SET = new ArraySet<>();

     static {
         IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_UNSPEC);
         IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_ICMP);
         IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_TCP);
         IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_UDP);
     }

     /**
      * TrafficSelectorType consists of IKE standard Traffic Selector Types.
      *
      * @see <a
      *     href="https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml">Internet
      *     Key Exchange Version 2 (IKEv2) Parameters</a>
      */
     @Retention(RetentionPolicy.SOURCE)
     @IntDef({TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE, TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE})
     public @interface TrafficSelectorType {}

     public static final int TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE = 7;
     public static final int TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE = 8;

     public static final int PORT_NUMBER_MIN = 0;
     public static final int PORT_NUMBER_MAX = 65535;

     // TODO: Consider defining these constants in a central place in Connectivity.
     private static final int IPV4_ADDR_LEN = 4;
     private static final int IPV6_ADDR_LEN = 16;

     @VisibleForTesting static final int TRAFFIC_SELECTOR_IPV4_LEN = 16;
     @VisibleForTesting static final int TRAFFIC_SELECTOR_IPV6_LEN = 40;

     public final int tsType;
     public final int ipProtocolId;
     public final int selectorLength;
     public final int startPort;
     public final int endPort;
     public final InetAddress startingAddress;
     public final InetAddress endingAddress;

     private IkeTrafficSelector(
             int tsType,
             int ipProtocolId,
             int selectorLength,
             int startPort,
             int endPort,
             InetAddress startingAddress,
             InetAddress endingAddress) {
         this.tsType = tsType;
         this.ipProtocolId = ipProtocolId;
         this.selectorLength = selectorLength;
         this.startPort = startPort;
         this.endPort = endPort;
         this.startingAddress = startingAddress;
         this.endingAddress = endingAddress;
     }

     /**
      * Construct an instance of IkeTrafficSelector for building an outbound IKE message.
      *
      * @param tsType the Traffic Selector type.
      * @param startPort the smallest port number allowed by this Traffic Selector.
      * @param endPort the largest port number allowed by this Traffic Selector.
      * @param startingAddress the smallest address included in this Traffic Selector.
      * @param endingAddress the largest address included in this Traffic Selector.
      */
     public IkeTrafficSelector(
             @TrafficSelectorType int tsType,
             int startPort,
             int endPort,
             InetAddress startingAddress,
             InetAddress endingAddress) {

         this.tsType = tsType;
         this.ipProtocolId = IP_PROTOCOL_ID_UNSPEC;

         switch (tsType) {
             case TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE:
                 this.selectorLength = TRAFFIC_SELECTOR_IPV4_LEN;

                 if (!(startingAddress instanceof Inet4Address)
                         || !(endingAddress instanceof Inet4Address)) {
                     throw new IllegalArgumentException(
                             "Invalid address range: TS_IPV4_ADDR_RANGE requires IPv4 addresses.");
                 }

                 break;
             case TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE:
                 throw new UnsupportedOperationException("Do not support IPv6 Traffic Selector.");
                 // TODO: Support IPv6 Traffic Selector.
             default:
                 throw new IllegalArgumentException("Unrecognized Traffic Selector type.");
         }

         if (compareInetAddressTo(startingAddress, endingAddress) > 0) {
             throw new IllegalArgumentException("Received invalid address range.");
         }

         if (!isPortRangeValid(startPort, endPort)) {
             throw new IllegalArgumentException(
                     "Invalid port range. startPort: " + startPort + " endPort: " + endPort);
         }

         this.startPort = startPort;
         this.endPort = endPort;
         this.startingAddress = startingAddress;
         this.endingAddress = endingAddress;
     }

     /**
      * Decode IkeTrafficSelectors from inbound Traffic Selector Payload.
      *
      * <p>This method is only called by IkeTsPayload when decoding inbound IKE message.
      *
      * @param numTs number or Traffic Selectors
      * @param tsBytes encoded byte array of Traffic Selectors
      * @return an array of decoded IkeTrafficSelectors
      * @throws InvalidSyntaxException if received bytes are malformed.
      */
     public static IkeTrafficSelector[] decodeIkeTrafficSelectors(int numTs, byte[] tsBytes)
             throws InvalidSyntaxException {
         IkeTrafficSelector[] tsArray = new IkeTrafficSelector[numTs];
         ByteBuffer inputBuffer = ByteBuffer.wrap(tsBytes);

         try {
             for (int i = 0; i < numTs; i++) {
                 int tsType = Byte.toUnsignedInt(inputBuffer.get());
                 switch (tsType) {
                     case TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE:
                         tsArray[i] = decodeIpv4TrafficSelector(inputBuffer);
                         break;
                     case TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE:
                         // TODO: Support it.
                         throw new UnsupportedOperationException("Cannot decode this type.");
                     default:
                         throw new InvalidSyntaxException(
                                 "Invalid Traffic Selector type: " + tsType);
                 }
             }
         } catch (BufferOverflowException e) {
             // Throw exception if any Traffic Selector has invalid length.
             throw new InvalidSyntaxException(e);
         }

         if (inputBuffer.remaining() != 0) {
             throw new InvalidSyntaxException(
                     "Unexpected trailing characters of Traffic Selectors.");
         }

         return tsArray;
     }

     // Decode Traffic Selector using IPv4 address range from a ByteBuffer. A BufferOverflowException
     // will be thrown and caught by method caller if operation reaches the input ByteBuffer's limit.
     private static IkeTrafficSelector decodeIpv4TrafficSelector(ByteBuffer inputBuffer)
             throws InvalidSyntaxException {
         // Decode and validate IP Protocol ID
         int ipProtocolId = Byte.toUnsignedInt(inputBuffer.get());
         if (!IP_PROTOCOL_ID_SET.contains(ipProtocolId)) {
             throw new InvalidSyntaxException("Invalid IP Protocol ID.");
         }

         // Decode and validate Selector Length
         int tsLength = Short.toUnsignedInt(inputBuffer.getShort());
         if (TRAFFIC_SELECTOR_IPV4_LEN != tsLength) {
             throw new InvalidSyntaxException("Invalid Traffic Selector Length.");
         }

         // Decode and validate ports
         int startPort = Short.toUnsignedInt(inputBuffer.getShort());
         int endPort = Short.toUnsignedInt(inputBuffer.getShort());
         if (!isPortRangeValid(startPort, endPort)) {
             throw new InvalidSyntaxException(
                     "Received invalid port range. startPort: "
                             + startPort
                             + " endPort: "
                             + endPort);
         }

         // Decode and validate IPv4 addresses
         byte[] startAddressBytes = new byte[IPV4_ADDR_LEN];
         byte[] endAddressBytes = new byte[IPV4_ADDR_LEN];
         inputBuffer.get(startAddressBytes);
         inputBuffer.get(endAddressBytes);
         try {
             Inet4Address startAddress =
                     (Inet4Address) (Inet4Address.getByAddress(startAddressBytes));
             Inet4Address endAddress = (Inet4Address) (Inet4Address.getByAddress(endAddressBytes));

             // Validate address range.
             if (compareInetAddressTo(startAddress, endAddress) > 0) {
                 throw new InvalidSyntaxException("Received invalid IPv4 address range.");
             }

             return new IkeTrafficSelector(
                     TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE,
                     ipProtocolId,
                     TRAFFIC_SELECTOR_IPV4_LEN,
                     startPort,
                     endPort,
                     startAddress,
                     endAddress);
         } catch (ClassCastException | UnknownHostException | IllegalArgumentException e) {
             throw new InvalidSyntaxException(e);
         }
     }

     // TODO: Add a method for decoding IPv6 traffic selector.

     // Validate port range.
     private static boolean isPortRangeValid(int startPort, int endPort) {
         return (startPort >= PORT_NUMBER_MIN
                 && startPort <= PORT_NUMBER_MAX
                 && endPort >= PORT_NUMBER_MIN
                 && endPort <= PORT_NUMBER_MAX
                 && startPort <= endPort);
     }

     // Compare two InetAddresses. Return -1 if the first input is smaller; 1 if the second input is
     // smaller; 0 if two addresses are equal.
     // TODO: Consider moving it to the platform code in the future./
     private static int compareInetAddressTo(InetAddress leftAddress, InetAddress rightAddress) {
         byte[] leftAddrBytes = leftAddress.getAddress();
         byte[] rightAddrBytes = rightAddress.getAddress();

         if (leftAddrBytes.length != rightAddrBytes.length) {
             throw new IllegalArgumentException("Two addresses are different types.");
         }

         for (int i = 0; i < leftAddrBytes.length; i++) {
             int unsignedByteLeft = Byte.toUnsignedInt(leftAddrBytes[i]);
             int unsignedByteRight = Byte.toUnsignedInt(rightAddrBytes[i]);

             int result = Integer.compare(unsignedByteLeft, unsignedByteRight);
             if (result != 0) return result;
         }
         return 0;
     }

     /**
      * Check if the input IkeTrafficSelector is a subset of this instance.
      *
      * @param ts the provided IkeTrafficSelector to check.
      * @return true if the input IkeTrafficSelector is a subset of this instance, otherwise false.
      */
     public boolean contains(IkeTrafficSelector ts) {
         if (tsType == ts.tsType
                 && ipProtocolId == ts.ipProtocolId
                 && startPort <= ts.startPort
                 && endPort >= ts.endPort
                 && compareInetAddressTo(startingAddress, ts.startingAddress) <= 0
                 && compareInetAddressTo(endingAddress, ts.endingAddress) >= 0) {
             return true;
         }
         return false;
     }

     @Override
     public int hashCode() {
         return Objects.hash(
                 tsType,
                 ipProtocolId,
                 selectorLength,
                 startPort,
                 endPort,
                 startingAddress,
                 endingAddress);
     }

     @Override
     public boolean equals(Object o) {
         if (!(o instanceof IkeTrafficSelector)) return false;

         IkeTrafficSelector other = (IkeTrafficSelector) o;

         if (tsType != other.tsType
                 || ipProtocolId != other.ipProtocolId
                 || startPort != other.startPort
                 || endPort != other.endPort) {
             return false;
         }

         switch (tsType) {
             case TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE:
                 return (((Inet4Address) startingAddress)
                                 .equals((Inet4Address) other.startingAddress)
                         && ((Inet4Address) endingAddress)
                                 .equals((Inet4Address) other.endingAddress));
             case TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE:
                 return (((Inet6Address) startingAddress)
                                 .equals((Inet6Address) other.startingAddress)
                         && ((Inet6Address) endingAddress)
                                 .equals((Inet6Address) other.endingAddress));
             default:
                 throw new UnsupportedOperationException("Unrecognized TS type");
         }
     }

     /**
      * Encode traffic selector to ByteBuffer.
      *
      * <p>This method will be only called by IkeTsPayload for building an outbound IKE message.
      *
      * @param byteBuffer destination ByteBuffer that stores encoded traffic selector.
      */
     public void encodeToByteBuffer(ByteBuffer byteBuffer) {
         byteBuffer
                 .put((byte) tsType)
                 .put((byte) ipProtocolId)
                 .putShort((short) selectorLength)
                 .putShort((short) startPort)
                 .putShort((short) endPort)
                 .put(startingAddress.getAddress())
                 .put(endingAddress.getAddress());
     }
 }
	/*
	* Copyright (C) 2019 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	package android.net.ipsec.ike;

	import android.annotation.IntDef;
	import android.util.ArraySet;

	import com.android.internal.annotations.VisibleForTesting;
	import com.android.internal.net.ipsec.ike.exceptions.InvalidSyntaxException;

	import java.lang.annotation.Retention;
	import java.lang.annotation.RetentionPolicy;
	import java.net.Inet4Address;
	import java.net.Inet6Address;
	import java.net.InetAddress;
	import java.net.UnknownHostException;
	import java.nio.BufferOverflowException;
	import java.nio.ByteBuffer;
	import java.util.Objects;

	/**
	* IkeTrafficSelector represents a Traffic Selector of a Child SA.
	*
	* <p>IkeTrafficSelector can be constructed by users for initiating Create Child exchange or be
	* constructed from a decoded inbound Traffic Selector Payload.
	*
	* @see <a href="https://tools.ietf.org/html/rfc7296#section-3.13">RFC 7296, Internet Key Exchange
	* Protocol Version 2 (IKEv2)</a>
	*/
	public final class IkeTrafficSelector {

	// IpProtocolId consists of standard IP Protocol IDs.
	@Retention(RetentionPolicy.SOURCE)
	@IntDef({IP_PROTOCOL_ID_UNSPEC, IP_PROTOCOL_ID_ICMP, IP_PROTOCOL_ID_TCP, IP_PROTOCOL_ID_UDP})
	public @interface IpProtocolId {}

	// Zero value is re-defined by IKE to indicate that all IP protocols are acceptable.
	@VisibleForTesting static final int IP_PROTOCOL_ID_UNSPEC = 0;
	@VisibleForTesting static final int IP_PROTOCOL_ID_ICMP = 1;
	@VisibleForTesting static final int IP_PROTOCOL_ID_TCP = 6;
	@VisibleForTesting static final int IP_PROTOCOL_ID_UDP = 17;

	private static final ArraySet<Integer> IP_PROTOCOL_ID_SET = new ArraySet<>();

	static {
	IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_UNSPEC);
	IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_ICMP);
	IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_TCP);
	IP_PROTOCOL_ID_SET.add(IP_PROTOCOL_ID_UDP);
	}

	/**
	* TrafficSelectorType consists of IKE standard Traffic Selector Types.
	*
	* @see <a
	* href="https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml">Internet
	* Key Exchange Version 2 (IKEv2) Parameters</a>
	*/
	@Retention(RetentionPolicy.SOURCE)
	@IntDef({TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE, TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE})
	public @interface TrafficSelectorType {}

	public static final int TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE = 7;
	public static final int TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE = 8;

	public static final int PORT_NUMBER_MIN = 0;
	public static final int PORT_NUMBER_MAX = 65535;

	// TODO: Consider defining these constants in a central place in Connectivity.
	private static final int IPV4_ADDR_LEN = 4;
	private static final int IPV6_ADDR_LEN = 16;

	@VisibleForTesting static final int TRAFFIC_SELECTOR_IPV4_LEN = 16;
	@VisibleForTesting static final int TRAFFIC_SELECTOR_IPV6_LEN = 40;

	public final int tsType;
	public final int ipProtocolId;
	public final int selectorLength;
	public final int startPort;
	public final int endPort;
	public final InetAddress startingAddress;
	public final InetAddress endingAddress;

	private IkeTrafficSelector(
	int tsType,
	int ipProtocolId,
	int selectorLength,
	int startPort,
	int endPort,
	InetAddress startingAddress,
	InetAddress endingAddress) {
	this.tsType = tsType;
	this.ipProtocolId = ipProtocolId;
	this.selectorLength = selectorLength;
	this.startPort = startPort;
	this.endPort = endPort;
	this.startingAddress = startingAddress;
	this.endingAddress = endingAddress;
	}

	/**
	* Construct an instance of IkeTrafficSelector for building an outbound IKE message.
	*
	* @param tsType the Traffic Selector type.
	* @param startPort the smallest port number allowed by this Traffic Selector.
	* @param endPort the largest port number allowed by this Traffic Selector.
	* @param startingAddress the smallest address included in this Traffic Selector.
	* @param endingAddress the largest address included in this Traffic Selector.
	*/
	public IkeTrafficSelector(
	@TrafficSelectorType int tsType,
	int startPort,
	int endPort,
	InetAddress startingAddress,
	InetAddress endingAddress) {

	this.tsType = tsType;
	this.ipProtocolId = IP_PROTOCOL_ID_UNSPEC;

	switch (tsType) {
	case TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE:
	this.selectorLength = TRAFFIC_SELECTOR_IPV4_LEN;

	if (!(startingAddress instanceof Inet4Address)
	\|\| !(endingAddress instanceof Inet4Address)) {
	throw new IllegalArgumentException(
	"Invalid address range: TS_IPV4_ADDR_RANGE requires IPv4 addresses.");
	}

	break;
	case TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE:
	throw new UnsupportedOperationException("Do not support IPv6 Traffic Selector.");
	// TODO: Support IPv6 Traffic Selector.
	default:
	throw new IllegalArgumentException("Unrecognized Traffic Selector type.");
	}

	if (compareInetAddressTo(startingAddress, endingAddress) > 0) {
	throw new IllegalArgumentException("Received invalid address range.");
	}

	if (!isPortRangeValid(startPort, endPort)) {
	throw new IllegalArgumentException(
	"Invalid port range. startPort: " + startPort + " endPort: " + endPort);
	}

	this.startPort = startPort;
	this.endPort = endPort;
	this.startingAddress = startingAddress;
	this.endingAddress = endingAddress;
	}

	/**
	* Decode IkeTrafficSelectors from inbound Traffic Selector Payload.
	*
	* <p>This method is only called by IkeTsPayload when decoding inbound IKE message.
	*
	* @param numTs number or Traffic Selectors
	* @param tsBytes encoded byte array of Traffic Selectors
	* @return an array of decoded IkeTrafficSelectors
	* @throws InvalidSyntaxException if received bytes are malformed.
	*/
	public static IkeTrafficSelector[] decodeIkeTrafficSelectors(int numTs, byte[] tsBytes)
	throws InvalidSyntaxException {
	IkeTrafficSelector[] tsArray = new IkeTrafficSelector[numTs];
	ByteBuffer inputBuffer = ByteBuffer.wrap(tsBytes);

	try {
	for (int i = 0; i < numTs; i++) {
	int tsType = Byte.toUnsignedInt(inputBuffer.get());
	switch (tsType) {
	case TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE:
	tsArray[i] = decodeIpv4TrafficSelector(inputBuffer);
	break;
	case TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE:
	// TODO: Support it.
	throw new UnsupportedOperationException("Cannot decode this type.");
	default:
	throw new InvalidSyntaxException(
	"Invalid Traffic Selector type: " + tsType);
	}
	}
	} catch (BufferOverflowException e) {
	// Throw exception if any Traffic Selector has invalid length.
	throw new InvalidSyntaxException(e);
	}

	if (inputBuffer.remaining() != 0) {
	throw new InvalidSyntaxException(
	"Unexpected trailing characters of Traffic Selectors.");
	}

	return tsArray;
	}

	// Decode Traffic Selector using IPv4 address range from a ByteBuffer. A BufferOverflowException
	// will be thrown and caught by method caller if operation reaches the input ByteBuffer's limit.
	private static IkeTrafficSelector decodeIpv4TrafficSelector(ByteBuffer inputBuffer)
	throws InvalidSyntaxException {
	// Decode and validate IP Protocol ID
	int ipProtocolId = Byte.toUnsignedInt(inputBuffer.get());
	if (!IP_PROTOCOL_ID_SET.contains(ipProtocolId)) {
	throw new InvalidSyntaxException("Invalid IP Protocol ID.");
	}

	// Decode and validate Selector Length
	int tsLength = Short.toUnsignedInt(inputBuffer.getShort());
	if (TRAFFIC_SELECTOR_IPV4_LEN != tsLength) {
	throw new InvalidSyntaxException("Invalid Traffic Selector Length.");
	}

	// Decode and validate ports
	int startPort = Short.toUnsignedInt(inputBuffer.getShort());
	int endPort = Short.toUnsignedInt(inputBuffer.getShort());
	if (!isPortRangeValid(startPort, endPort)) {
	throw new InvalidSyntaxException(
	"Received invalid port range. startPort: "
	+ startPort
	+ " endPort: "
	+ endPort);
	}

	// Decode and validate IPv4 addresses
	byte[] startAddressBytes = new byte[IPV4_ADDR_LEN];
	byte[] endAddressBytes = new byte[IPV4_ADDR_LEN];
	inputBuffer.get(startAddressBytes);
	inputBuffer.get(endAddressBytes);
	try {
	Inet4Address startAddress =
	(Inet4Address) (Inet4Address.getByAddress(startAddressBytes));
	Inet4Address endAddress = (Inet4Address) (Inet4Address.getByAddress(endAddressBytes));

	// Validate address range.
	if (compareInetAddressTo(startAddress, endAddress) > 0) {
	throw new InvalidSyntaxException("Received invalid IPv4 address range.");
	}

	return new IkeTrafficSelector(
	TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE,
	ipProtocolId,
	TRAFFIC_SELECTOR_IPV4_LEN,
	startPort,
	endPort,
	startAddress,
	endAddress);
	} catch (ClassCastException \| UnknownHostException \| IllegalArgumentException e) {
	throw new InvalidSyntaxException(e);
	}
	}

	// TODO: Add a method for decoding IPv6 traffic selector.

	// Validate port range.
	private static boolean isPortRangeValid(int startPort, int endPort) {
	return (startPort >= PORT_NUMBER_MIN
	&& startPort <= PORT_NUMBER_MAX
	&& endPort >= PORT_NUMBER_MIN
	&& endPort <= PORT_NUMBER_MAX
	&& startPort <= endPort);
	}

	// Compare two InetAddresses. Return -1 if the first input is smaller; 1 if the second input is
	// smaller; 0 if two addresses are equal.
	// TODO: Consider moving it to the platform code in the future./
	private static int compareInetAddressTo(InetAddress leftAddress, InetAddress rightAddress) {
	byte[] leftAddrBytes = leftAddress.getAddress();
	byte[] rightAddrBytes = rightAddress.getAddress();

	if (leftAddrBytes.length != rightAddrBytes.length) {
	throw new IllegalArgumentException("Two addresses are different types.");
	}

	for (int i = 0; i < leftAddrBytes.length; i++) {
	int unsignedByteLeft = Byte.toUnsignedInt(leftAddrBytes[i]);
	int unsignedByteRight = Byte.toUnsignedInt(rightAddrBytes[i]);

	int result = Integer.compare(unsignedByteLeft, unsignedByteRight);
	if (result != 0) return result;
	}
	return 0;
	}

	/**
	* Check if the input IkeTrafficSelector is a subset of this instance.
	*
	* @param ts the provided IkeTrafficSelector to check.
	* @return true if the input IkeTrafficSelector is a subset of this instance, otherwise false.
	*/
	public boolean contains(IkeTrafficSelector ts) {
	if (tsType == ts.tsType
	&& ipProtocolId == ts.ipProtocolId
	&& startPort <= ts.startPort
	&& endPort >= ts.endPort
	&& compareInetAddressTo(startingAddress, ts.startingAddress) <= 0
	&& compareInetAddressTo(endingAddress, ts.endingAddress) >= 0) {
	return true;
	}
	return false;
	}

	@Override
	public int hashCode() {
	return Objects.hash(
	tsType,
	ipProtocolId,
	selectorLength,
	startPort,
	endPort,
	startingAddress,
	endingAddress);
	}

	@Override
	public boolean equals(Object o) {
	if (!(o instanceof IkeTrafficSelector)) return false;

	IkeTrafficSelector other = (IkeTrafficSelector) o;

	if (tsType != other.tsType
	\|\| ipProtocolId != other.ipProtocolId
	\|\| startPort != other.startPort
	\|\| endPort != other.endPort) {
	return false;
	}

	switch (tsType) {
	case TRAFFIC_SELECTOR_TYPE_IPV4_ADDR_RANGE:
	return (((Inet4Address) startingAddress)
	.equals((Inet4Address) other.startingAddress)
	&& ((Inet4Address) endingAddress)
	.equals((Inet4Address) other.endingAddress));
	case TRAFFIC_SELECTOR_TYPE_IPV6_ADDR_RANGE:
	return (((Inet6Address) startingAddress)
	.equals((Inet6Address) other.startingAddress)
	&& ((Inet6Address) endingAddress)
	.equals((Inet6Address) other.endingAddress));
	default:
	throw new UnsupportedOperationException("Unrecognized TS type");
	}
	}

	/**
	* Encode traffic selector to ByteBuffer.
	*
	* <p>This method will be only called by IkeTsPayload for building an outbound IKE message.
	*
	* @param byteBuffer destination ByteBuffer that stores encoded traffic selector.
	*/
	public void encodeToByteBuffer(ByteBuffer byteBuffer) {
	byteBuffer
	.put((byte) tsType)
	.put((byte) ipProtocolId)
	.putShort((short) selectorLength)
	.putShort((short) startPort)
	.putShort((short) endPort)
	.put(startingAddress.getAddress())
	.put(endingAddress.getAddress());
	}
	}