Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f5d386a authored by Chad Brubaker's avatar Chad Brubaker
Browse files

Use X509ExtendedTrustManagers 

Move the X509TrustManagers for the Network Security Config from
X509TrustManagers to X509ExtendedTrustManagers.

Bug: 27271561
Change-Id: I084a6c6022fe69730192d2bdcbabaf58e8f92f04
parent e4c5c161

core/java/android/security/net/config/NetworkSecurityTrustManager.java

+34 −4
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ import com.android.org.conscrypt.TrustManagerImpl; 


import android.util.ArrayMap;

import java.io.IOException;

import java.net.Socket;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.security.GeneralSecurityException;
@@ -29,14 +30,15 @@ import java.util.List; 
import java.util.Map;

import java.util.Set;



import javax.net.ssl.X509TrustManager;

import javax.net.ssl.SSLEngine;

import javax.net.ssl.X509ExtendedTrustManager;



/**

 * {@link X509TrustManager} that implements the trust anchor and pinning for a

 * {@link X509ExtendedTrustManager} that implements the trust anchor and pinning for a

 * given {@link NetworkSecurityConfig}.

 * @hide

 */

public class NetworkSecurityTrustManager implements X509TrustManager {

public class NetworkSecurityTrustManager extends X509ExtendedTrustManager {

    // TODO: Replace this with a general X509TrustManager and use duck-typing.

    private final TrustManagerImpl mDelegate;

    private final NetworkSecurityConfig mNetworkSecurityConfig;
@@ -67,10 +69,38 @@ public class NetworkSecurityTrustManager implements X509TrustManager { 
        mDelegate.checkClientTrusted(chain, authType);

    }



    @Override

    public void checkClientTrusted(X509Certificate[] certs, String authType, Socket socket)

            throws CertificateException {

        mDelegate.checkClientTrusted(certs, authType, socket);

    }



    @Override

    public void checkClientTrusted(X509Certificate[] certs, String authType, SSLEngine engine)

            throws CertificateException {

        mDelegate.checkClientTrusted(certs, authType, engine);

    }



    @Override

    public void checkServerTrusted(X509Certificate[] certs, String authType)

            throws CertificateException {

        checkServerTrusted(certs, authType, null);

        checkServerTrusted(certs, authType, (String) null);

    }



    @Override

    public void checkServerTrusted(X509Certificate[] certs, String authType, Socket socket)

            throws CertificateException {

        List<X509Certificate> trustedChain =

                mDelegate.getTrustedChainForServer(certs, authType, socket);

        checkPins(trustedChain);

    }



    @Override

    public void checkServerTrusted(X509Certificate[] certs, String authType, SSLEngine engine)

            throws CertificateException {

        List<X509Certificate> trustedChain =

                mDelegate.getTrustedChainForServer(certs, authType, engine);

        checkPins(trustedChain);

    }



    /**

core/java/android/security/net/config/RootTrustManager.java

+57 −5
Original line number Diff line number Diff line
@@ -16,24 +16,28 @@ 


package android.security.net.config;



import java.net.Socket;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.util.List;



import javax.net.ssl.X509TrustManager;

import javax.net.ssl.SSLSocket;

import javax.net.ssl.SSLEngine;

import javax.net.ssl.SSLSession;

import javax.net.ssl.X509ExtendedTrustManager;



/**

 * {@link X509TrustManager} based on an {@link ApplicationConfig}.

 * {@link X509ExtendedTrustManager} based on an {@link ApplicationConfig}.

 *

 * <p>This {@code X509TrustManager} delegates to the specific trust manager for the hostname

 * being used for the connection (See {@link ApplicationConfig#getConfigForHostname(String)} and

 * <p>This trust manager delegates to the specific trust manager for the hostname being used for

 * the connection (See {@link ApplicationConfig#getConfigForHostname(String)} and

 * {@link NetworkSecurityTrustManager}).</p>

 *

 * Note that if the {@code ApplicationConfig} has per-domain configurations the hostname aware

 * {@link #checkServerTrusted(X509Certificate[], String String)} must be used instead of the normal

 * non-aware call.

 * @hide */

public class RootTrustManager implements X509TrustManager {

public class RootTrustManager extends X509ExtendedTrustManager {

    private final ApplicationConfig mConfig;



    public RootTrustManager(ApplicationConfig config) {
@@ -52,6 +56,54 @@ public class RootTrustManager implements X509TrustManager { 
        config.getTrustManager().checkClientTrusted(chain, authType);

    }



    @Override

    public void checkClientTrusted(X509Certificate[] certs, String authType, Socket socket)

            throws CertificateException {

        // Use the default configuration for all client authentication. Domain specific configs are

        // only for use in checking server trust not client trust.

        NetworkSecurityConfig config = mConfig.getConfigForHostname("");

        config.getTrustManager().checkClientTrusted(certs, authType, socket);

    }



    @Override

    public void checkClientTrusted(X509Certificate[] certs, String authType, SSLEngine engine)

            throws CertificateException {

        // Use the default configuration for all client authentication. Domain specific configs are

        // only for use in checking server trust not client trust.

        NetworkSecurityConfig config = mConfig.getConfigForHostname("");

        config.getTrustManager().checkClientTrusted(certs, authType, engine);

    }



    @Override

    public void checkServerTrusted(X509Certificate[] certs, String authType, Socket socket)

            throws CertificateException {

        if (socket instanceof SSLSocket) {

            SSLSocket sslSocket = (SSLSocket) socket;

            SSLSession session = sslSocket.getHandshakeSession();

            if (session == null) {

                throw new CertificateException("Not in handshake; no session available");

            }

            String host = session.getPeerHost();

            NetworkSecurityConfig config = mConfig.getConfigForHostname(host);

            config.getTrustManager().checkServerTrusted(certs, authType, socket);

        } else {

            // Not an SSLSocket, use the hostname unaware checkServerTrusted.

            checkServerTrusted(certs, authType);

        }

    }



    @Override

    public void checkServerTrusted(X509Certificate[] certs, String authType, SSLEngine engine)

            throws CertificateException {

        SSLSession session = engine.getHandshakeSession();

        if (session == null) {

            throw new CertificateException("Not in handshake; no session available");

        }

        String host = session.getPeerHost();

        NetworkSecurityConfig config = mConfig.getConfigForHostname(host);

        config.getTrustManager().checkServerTrusted(certs, authType, engine);

    }



    @Override

    public void checkServerTrusted(X509Certificate[] certs, String authType)

            throws CertificateException {