Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b160f8c4 authored by Yifan Hong's avatar Yifan Hong
Browse files

binder: RpcCertificateVerifier takes SSL pointer. 

This allows the implementation to get the certificate
chain from the SSL connection as well, if necessary.

Test: binderRpcTest
Bug: 195166979

Change-Id: I87ca34d09217f958fe014b963ef41e4821ffe743
parent bb24eea0

libs/binder/Android.bp

+3 −0
Original line number Diff line number Diff line
@@ -256,6 +256,9 @@ cc_defaults { 
    export_header_lib_headers: [

        "libbinder_headers",

    ],

    export_shared_lib_headers: [

        "libssl",

    ],

    export_include_dirs: ["include_tls"],

    static_libs: [

        "libbase",

libs/binder/RpcTransportTls.cpp

+1 −5
Original line number Diff line number Diff line
@@ -460,17 +460,13 @@ ssl_verify_result_t RpcTransportCtxTls::sslCustomVerify(SSL* ssl, uint8_t* outAl 
    LOG_ALWAYS_FATAL_IF(outAlert == nullptr);

    const char* logPrefix = SSL_is_server(ssl) ? "Server" : "Client";



    bssl::UniquePtr<X509> peerCert(SSL_get_peer_certificate(ssl)); // Does not set error queue

    LOG_ALWAYS_FATAL_IF(peerCert == nullptr,

                        "%s: libssl should not ask to verify non-existing cert", logPrefix);



    auto ctx = SSL_get_SSL_CTX(ssl); // Does not set error queue

    LOG_ALWAYS_FATAL_IF(ctx == nullptr);

    // void* -> RpcTransportCtxTls*

    auto rpcTransportCtxTls = reinterpret_cast<RpcTransportCtxTls*>(SSL_CTX_get_app_data(ctx));

    LOG_ALWAYS_FATAL_IF(rpcTransportCtxTls == nullptr);



    status_t verifyStatus = rpcTransportCtxTls->mCertVerifier->verify(peerCert.get(), outAlert);

    status_t verifyStatus = rpcTransportCtxTls->mCertVerifier->verify(ssl, outAlert);

    if (verifyStatus == OK) {

        return ssl_verify_ok;

    }

libs/binder/include_tls/binder/RpcCertificateVerifier.h

+12 −1
Original line number Diff line number Diff line
@@ -26,7 +26,18 @@ namespace android { 
class RpcCertificateVerifier {

public:

    virtual ~RpcCertificateVerifier() = default;

    virtual status_t verify(const X509* peerCert, uint8_t* outAlert) = 0;



    // The implementation may use the following function to get

    // the peer certificate and chain:

    // - SSL_get_peer_certificate

    // - SSL_get_peer_cert_chain

    // - SSL_get_peer_full_cert_chain

    //

    // The implementation should return OK on success or error codes on error. For example:

    // - PERMISSION_DENIED for rejected certificates

    // - NO_INIT for not presenting a certificate when requested

    // - UNKNOWN_ERROR for other errors

    virtual status_t verify(const SSL* ssl, uint8_t* outAlert) = 0;

};



} // namespace android

libs/binder/tests/RpcCertificateVerifierSimple.cpp

+7 −2
Original line number Diff line number Diff line
@@ -22,10 +22,15 @@ 


namespace android {



status_t RpcCertificateVerifierSimple::verify(const X509* peerCert, uint8_t* outAlert) {

status_t RpcCertificateVerifierSimple::verify(const SSL* ssl, uint8_t* outAlert) {

    const char* logPrefix = SSL_is_server(ssl) ? "Server" : "Client";

    bssl::UniquePtr<X509> peerCert(SSL_get_peer_certificate(ssl)); // Does not set error queue

    LOG_ALWAYS_FATAL_IF(peerCert == nullptr,

                        "%s: libssl should not ask to verify non-existing cert", logPrefix);



    std::lock_guard<std::mutex> lock(mMutex);

    for (const auto& trustedCert : mTrustedPeerCertificates) {

        if (0 == X509_cmp(trustedCert.get(), peerCert)) {

        if (0 == X509_cmp(trustedCert.get(), peerCert.get())) {

            return OK;

        }

    }

libs/binder/tests/RpcCertificateVerifierSimple.h

+1 −1
Original line number Diff line number Diff line
@@ -35,7 +35,7 @@ namespace android { 
// certificate being added.

class RpcCertificateVerifierSimple : public RpcCertificateVerifier {

public:

    status_t verify(const X509*, uint8_t*) override;

    status_t verify(const SSL*, uint8_t*) override;



    // Add a trusted peer certificate. Peers presenting this certificate are accepted.

    //