Merge "Move trusted CA certs to core" into pi-dev (4d549c21) · Commits · e / os / android_frameworks_base

core/java/android/security/backup/TrustedRootCertificates.java

0 → 100644

+100 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* Copyright (C) 2018 The Android Open Source Project
			*
			* Licensed under the Apache License, Version 2.0 (the "License");
			* you may not use this file except in compliance with the License.
			* You may obtain a copy of the License at
			*
			* http://www.apache.org/licenses/LICENSE-2.0
			*
			* Unless required by applicable law or agreed to in writing, software
			* distributed under the License is distributed on an "AS IS" BASIS,
			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
			* See the License for the specific language governing permissions and
			* limitations under the License.
			*/

			package android.security.backup;

			import static android.security.backup.X509CertificateParsingUtils.decodeBase64Cert;

			import android.util.ArrayMap;

			import java.security.cert.CertificateException;
			import java.security.cert.X509Certificate;
			import java.util.Map;

			/**
			* Trusted root certificates for use by the
			* {@link android.security.keystore.recovery.RecoveryController}. These certificates are used to
			* verify the public keys of remote secure hardware modules. This is to prevent AOSP backing up keys
			* to untrusted devices.
			*
			* @hide
			*/
			public class TrustedRootCertificates {

			public static final String GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_ALIAS =
			"GoogleCloudKeyVaultServiceV1";

			private static final String GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_BASE64 = ""
			+ "MIIFJjCCAw6gAwIBAgIJAIobXsJlzhNdMA0GCSqGSIb3DQEBDQUAMCAxHjAcBgNV"
			+ "BAMMFUdvb2dsZSBDcnlwdEF1dGhWYXVsdDAeFw0xODAyMDIxOTM5MTRaFw0zODAx"
			+ "MjgxOTM5MTRaMCAxHjAcBgNVBAMMFUdvb2dsZSBDcnlwdEF1dGhWYXVsdDCCAiIw"
			+ "DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2OT5i40/H7LINg/lq/0G0hR65P"
			+ "Q4Mud3OnuVt6UIYV2T18+v6qW1yJd5FcnND/ZKPau4aUAYklqJuSVjOXQD0BjgS2"
			+ "98Xa4dSn8Ci1rUR+5tdmrxqbYUdT2ZvJIUMMR6fRoqi+LlAbKECrV+zYQTyLU68w"
			+ "V66hQpAButjJKiZzkXjmKLfJ5IWrNEn17XM988rk6qAQn/BYCCQGf3rQuJeksGmA"
			+ "N1lJOwNYxmWUyouVwqwZthNEWqTuEyBFMkAT+99PXW7oVDc7oU5cevuihxQWNTYq"
			+ "viGB8cck6RW3cmqrDSaJF/E+N0cXFKyYC7FDcggt6k3UrxNKTuySdDEa8+2RTQqU"
			+ "Y9npxBlQE+x9Ig56OI1BG3bSBsGdPgjpyHadZeh2tgk+oqlGsSsum24YxaxuSysT"
			+ "Qfcu/XhyfUXavfmGrBOXerTzIl5oBh/F5aHTV85M2tYEG0qsPPvSpZAWtdJ/2rca"
			+ "OxvhwOL+leZKr8McjXVR00lBsRuKXX4nTUMwya09CO3QHFPFZtZvqjy2HaMOnVLQ"
			+ "I6b6dHEfmsHybzVOe3yPEoFQSU9UhUdmi71kwwoanPD3j9fJHmXTx4PzYYBRf1ZE"
			+ "o+uPgMPk7CDKQFZLjnR40z1uzu3O8aZ3AKZzP+j7T4XQKJLQLmllKtPgLgNdJyib"
			+ "2Glg7QhXH/jBTL6hAgMBAAGjYzBhMB0GA1UdDgQWBBSbZfrqOYH54EJpkdKMZjMc"
			+ "z/Hp+DAfBgNVHSMEGDAWgBSbZfrqOYH54EJpkdKMZjMcz/Hp+DAPBgNVHRMBAf8E"
			+ "BTADAQH/MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQ0FAAOCAgEAKh9nm/vW"
			+ "glMWp3vcCwWwJW286ecREDlI+CjGh5h+f2N4QRrXd/tKE3qQJWCqGx8sFfIUjmI7"
			+ "KYdsC2gyQ2cA2zl0w7pB2QkuqE6zVbnh1D17Hwl19IMyAakFaM9ad4/EoH7oQmqX"
			+ "nF/f5QXGZw4kf1HcgKgoCHWXjqR8MqHOcXR8n6WFqxjzJf1jxzi6Yo2dZ7PJbnE6"
			+ "+kHIJuiCpiHL75v5g1HM41gT3ddFFSrn88ThNPWItT5Z8WpFjryVzank2Yt02LLl"
			+ "WqZg9IC375QULc5B58NMnaiVJIDJQ8zoNgj1yaxqtUMnJX570lotO2OXe4ec9aCQ"
			+ "DIJ84YLM/qStFdeZ9416E80dchskbDG04GuVJKlzWjxAQNMRFhyaPUSBTLLg+kwP"
			+ "t9+AMmc+A7xjtFQLZ9fBYHOBsndJOmeSQeYeckl+z/1WQf7DdwXn/yijon7mxz4z"
			+ "cCczfKwTJTwBh3wR5SQr2vQm7qaXM87qxF8PCAZrdZaw5I80QwkgTj0WTZ2/GdSw"
			+ "d3o5SyzzBAjpwtG+4bO/BD9h9wlTsHpT6yWOZs4OYAKU5ykQrncI8OyavMggArh3"
			+ "/oM58v0orUWINtIc2hBlka36PhATYQiLf+AiWKnwhCaaHExoYKfQlMtXBodNvOK8"
			+ "xqx69x05q/qbHKEcTHrsss630vxrp1niXvA=";

			/**
			* The X509 certificate of the trusted root CA cert for the recoverable key store service.
			*
			* TODO: Change it to the production certificate root CA before the final launch.
			*/
			private static final X509Certificate GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_CERTIFICATE =
			parseGoogleCloudKeyVaultServiceV1Certificate();

			private static final int NUMBER_OF_ROOT_CERTIFICATES = 1;

			/**
			* Returns all available root certificates, keyed by alias.
			*/
			public static Map<String, X509Certificate> listRootCertificates() {
			ArrayMap<String, X509Certificate> certificates =
			new ArrayMap<>(NUMBER_OF_ROOT_CERTIFICATES);
			certificates.put(
			GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_ALIAS,
			GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_CERTIFICATE);
			return certificates;
			}

			private static X509Certificate parseGoogleCloudKeyVaultServiceV1Certificate() {
			try {
			return decodeBase64Cert(GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_BASE64);
			} catch (CertificateException e) {
			// Should not happen
			throw new RuntimeException(e);
			}
			}
			}

core/java/android/security/backup/X509CertificateParsingUtils.java

0 → 100644

+82 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* Copyright 2018 The Android Open Source Project
			*
			* Licensed under the Apache License, Version 2.0 (the "License");
			* you may not use this file except in compliance with the License.
			* You may obtain a copy of the License at
			*
			* http://www.apache.org/licenses/LICENSE-2.0
			*
			* Unless required by applicable law or agreed to in writing, software
			* distributed under the License is distributed on an "AS IS" BASIS,
			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
			* See the License for the specific language governing permissions and
			* limitations under the License.
			*/

			package android.security.backup;

			import java.io.ByteArrayInputStream;
			import java.io.InputStream;
			import java.security.cert.CertificateException;
			import java.security.cert.CertificateFactory;
			import java.security.cert.X509Certificate;
			import java.util.Base64;

			/**
			* Static helper methods for decoding {@link X509Certificate} instances.
			*
			* @hide
			*/
			public class X509CertificateParsingUtils {
			private static final String CERT_FORMAT = "X.509";

			/**
			* Decodes an {@link X509Certificate} encoded as a base-64 string.
			*/
			public static X509Certificate decodeBase64Cert(String string) throws CertificateException {
			try {
			return decodeCert(decodeBase64(string));
			} catch (IllegalArgumentException e) {
			throw new CertificateException(e);
			}
			}

			/**
			* Decodes a base-64 string.
			*
			* @throws IllegalArgumentException if not a valid base-64 string.
			*/
			private static byte[] decodeBase64(String string) {
			return Base64.getDecoder().decode(string);
			}

			/**
			* Decodes a byte array containing an encoded X509 certificate.
			*
			* @param certBytes the byte array containing the encoded X509 certificate
			* @return the decoded X509 certificate
			* @throws CertificateException if any parsing error occurs
			*/
			private static X509Certificate decodeCert(byte[] certBytes) throws CertificateException {
			return decodeCert(new ByteArrayInputStream(certBytes));
			}

			/**
			* Decodes an X509 certificate from an {@code InputStream}.
			*
			* @param inStream the input stream containing the encoded X509 certificate
			* @return the decoded X509 certificate
			* @throws CertificateException if any parsing error occurs
			*/
			private static X509Certificate decodeCert(InputStream inStream) throws CertificateException {
			CertificateFactory certFactory;
			try {
			certFactory = CertificateFactory.getInstance(CERT_FORMAT);
			} catch (CertificateException e) {
			// Should not happen, as X.509 is mandatory for all providers.
			throw new RuntimeException(e);
			}
			return (X509Certificate) certFactory.generateCertificate(inStream);
			}
			}

core/tests/coretests/src/android/security/backup/TrustedRootCertificatesTest.java

0 → 100644

+44 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* Copyright (C) 2018 The Android Open Source Project
			*
			* Licensed under the Apache License, Version 2.0 (the "License");
			* you may not use this file except in compliance with the License.
			* You may obtain a copy of the License at
			*
			* http://www.apache.org/licenses/LICENSE-2.0
			*
			* Unless required by applicable law or agreed to in writing, software
			* distributed under the License is distributed on an "AS IS" BASIS,
			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
			* See the License for the specific language governing permissions and
			* limitations under the License.
			*/

			package android.security.backup;

			import static android.security.backup.TrustedRootCertificates.listRootCertificates;

			import static org.junit.Assert.assertTrue;

			import android.support.test.filters.SmallTest;
			import android.support.test.runner.AndroidJUnit4;

			import org.junit.Test;
			import org.junit.runner.RunWith;

			import java.security.cert.X509Certificate;
			import java.util.Map;

			@RunWith(AndroidJUnit4.class)
			@SmallTest
			public class TrustedRootCertificatesTest {
			private static final String GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_ALIAS =
			"GoogleCloudKeyVaultServiceV1";

			@Test
			public void listRootCertificates_listsGoogleCloudVaultV1Certificate() {
			Map<String, X509Certificate> certificates = listRootCertificates();

			assertTrue(certificates.containsKey(GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_ALIAS));
			}
			}

core/tests/coretests/src/android/security/backup/X509CertificateParsingUtilsTest.java

0 → 100644

+82 −0

Original line number	Original line	Diff line number	Diff line
			/*
			* Copyright (C) 2018 The Android Open Source Project
			*
			* Licensed under the Apache License, Version 2.0 (the "License");
			* you may not use this file except in compliance with the License.
			* You may obtain a copy of the License at
			*
			* http://www.apache.org/licenses/LICENSE-2.0
			*
			* Unless required by applicable law or agreed to in writing, software
			* distributed under the License is distributed on an "AS IS" BASIS,
			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
			* See the License for the specific language governing permissions and
			* limitations under the License.
			*/

			package android.security.backup;

			import static android.security.backup.X509CertificateParsingUtils.decodeBase64Cert;

			import static org.junit.Assert.assertNotNull;
			import static org.junit.Assert.fail;

			import android.support.test.filters.SmallTest;
			import android.support.test.runner.AndroidJUnit4;

			import org.junit.Test;
			import org.junit.runner.RunWith;

			import java.security.cert.CertificateException;

			@RunWith(AndroidJUnit4.class)
			@SmallTest
			public class X509CertificateParsingUtilsTest {

			private static final String GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_BASE64 = ""
			+ "MIIFJjCCAw6gAwIBAgIJAIobXsJlzhNdMA0GCSqGSIb3DQEBDQUAMCAxHjAcBgNV"
			+ "BAMMFUdvb2dsZSBDcnlwdEF1dGhWYXVsdDAeFw0xODAyMDIxOTM5MTRaFw0zODAx"
			+ "MjgxOTM5MTRaMCAxHjAcBgNVBAMMFUdvb2dsZSBDcnlwdEF1dGhWYXVsdDCCAiIw"
			+ "DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2OT5i40/H7LINg/lq/0G0hR65P"
			+ "Q4Mud3OnuVt6UIYV2T18+v6qW1yJd5FcnND/ZKPau4aUAYklqJuSVjOXQD0BjgS2"
			+ "98Xa4dSn8Ci1rUR+5tdmrxqbYUdT2ZvJIUMMR6fRoqi+LlAbKECrV+zYQTyLU68w"
			+ "V66hQpAButjJKiZzkXjmKLfJ5IWrNEn17XM988rk6qAQn/BYCCQGf3rQuJeksGmA"
			+ "N1lJOwNYxmWUyouVwqwZthNEWqTuEyBFMkAT+99PXW7oVDc7oU5cevuihxQWNTYq"
			+ "viGB8cck6RW3cmqrDSaJF/E+N0cXFKyYC7FDcggt6k3UrxNKTuySdDEa8+2RTQqU"
			+ "Y9npxBlQE+x9Ig56OI1BG3bSBsGdPgjpyHadZeh2tgk+oqlGsSsum24YxaxuSysT"
			+ "Qfcu/XhyfUXavfmGrBOXerTzIl5oBh/F5aHTV85M2tYEG0qsPPvSpZAWtdJ/2rca"
			+ "OxvhwOL+leZKr8McjXVR00lBsRuKXX4nTUMwya09CO3QHFPFZtZvqjy2HaMOnVLQ"
			+ "I6b6dHEfmsHybzVOe3yPEoFQSU9UhUdmi71kwwoanPD3j9fJHmXTx4PzYYBRf1ZE"
			+ "o+uPgMPk7CDKQFZLjnR40z1uzu3O8aZ3AKZzP+j7T4XQKJLQLmllKtPgLgNdJyib"
			+ "2Glg7QhXH/jBTL6hAgMBAAGjYzBhMB0GA1UdDgQWBBSbZfrqOYH54EJpkdKMZjMc"
			+ "z/Hp+DAfBgNVHSMEGDAWgBSbZfrqOYH54EJpkdKMZjMcz/Hp+DAPBgNVHRMBAf8E"
			+ "BTADAQH/MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQ0FAAOCAgEAKh9nm/vW"
			+ "glMWp3vcCwWwJW286ecREDlI+CjGh5h+f2N4QRrXd/tKE3qQJWCqGx8sFfIUjmI7"
			+ "KYdsC2gyQ2cA2zl0w7pB2QkuqE6zVbnh1D17Hwl19IMyAakFaM9ad4/EoH7oQmqX"
			+ "nF/f5QXGZw4kf1HcgKgoCHWXjqR8MqHOcXR8n6WFqxjzJf1jxzi6Yo2dZ7PJbnE6"
			+ "+kHIJuiCpiHL75v5g1HM41gT3ddFFSrn88ThNPWItT5Z8WpFjryVzank2Yt02LLl"
			+ "WqZg9IC375QULc5B58NMnaiVJIDJQ8zoNgj1yaxqtUMnJX570lotO2OXe4ec9aCQ"
			+ "DIJ84YLM/qStFdeZ9416E80dchskbDG04GuVJKlzWjxAQNMRFhyaPUSBTLLg+kwP"
			+ "t9+AMmc+A7xjtFQLZ9fBYHOBsndJOmeSQeYeckl+z/1WQf7DdwXn/yijon7mxz4z"
			+ "cCczfKwTJTwBh3wR5SQr2vQm7qaXM87qxF8PCAZrdZaw5I80QwkgTj0WTZ2/GdSw"
			+ "d3o5SyzzBAjpwtG+4bO/BD9h9wlTsHpT6yWOZs4OYAKU5ykQrncI8OyavMggArh3"
			+ "/oM58v0orUWINtIc2hBlka36PhATYQiLf+AiWKnwhCaaHExoYKfQlMtXBodNvOK8"
			+ "xqx69x05q/qbHKEcTHrsss630vxrp1niXvA=";

			private static final String INVALID_BASE64 = "EVTVA==";

			@Test
			public void decodeBase64Cert_decodesValidCertificate() throws Exception {
			assertNotNull(decodeBase64Cert(GOOGLE_CLOUD_KEY_VAULT_SERVICE_V1_BASE64));
			}

			@Test
			public void decodeBase64Cert_throwsCertificateExceptionForInvalidBase64() {
			try {
			decodeBase64Cert(INVALID_BASE64);
			fail("Did not throw when attempting to decode invalid base-64");
			} catch (CertificateException e) {
			// expected
			}
			}
			}