Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7fac4b7b authored by Eric Biggers's avatar Eric Biggers Committed by Android (Google) Code Review
Browse files

Merge changes Iba3687cb,Iced66ee2 into main 

* changes:
  Split getHashFactorInternal() from getHashFactor()
  Make setLockCredential() use doVerifyCredential()
parents 4834bdaa 9669549c

services/core/java/com/android/server/locksettings/LockSettingsService.java

+19 −12
Original line number Diff line number Diff line
@@ -1889,8 +1889,11 @@ public class LockSettingsService extends ILockSettings.Stub { 
                // Verify the parent credential again, to make sure we have a fresh enough

                // auth token such that getDecryptedPasswordForTiedProfile() inside

                // setLockCredentialInternal() can function correctly.

                verifyCredential(savedCredential, mUserManager.getProfileParent(userId).id,

                        0 /* flags */);

                doVerifyCredential(

                        savedCredential,

                        mUserManager.getProfileParent(userId).id,

                        /* progressCallback= */ null,

                        /* flags= */ 0);

                savedCredential.zeroize();

                savedCredential = LockscreenCredential.createNone();

            }
@@ -2026,13 +2029,13 @@ public class LockSettingsService extends ILockSettings.Stub { 
            passwordHistory = "";

        } else {

            Slogf.d(TAG, "Adding new password to password history for user %d", userHandle);

            final byte[] hashFactor = getHashFactor(password, userHandle);

            final byte[] hashFactor = getHashFactorInternal(password, userHandle);

            final byte[] salt = getSalt(userHandle).getBytes();

            String hash = password.passwordToHistoryHash(salt, hashFactor);

            if (hash == null) {

                // This should never happen, as all information needed to compute the hash should be

                // available.  In particular, unwrapping the SP in getHashFactor() should always

                // succeed, as we're using the LSKF that was just set.

                // available. In particular, unwrapping the SP in getHashFactorInternal() should

                // always succeed, as we're using the LSKF that was just set.

                Slog.e(TAG, "Failed to compute password hash; password history won't be updated");

                return;

            }
@@ -3317,14 +3320,12 @@ public class LockSettingsService extends ILockSettings.Stub { 
    }



    /**

     * Returns a fixed pseudorandom byte string derived from the user's synthetic password.

     * This is used to salt the password history hash to protect the hash against offline

     * bruteforcing, since rederiving this value requires a successful authentication.

     * If user is a profile with unified challenge, currentCredential is ignored.

     * Returns a fixed pseudorandom byte string derived from the user's synthetic password. This is

     * used to salt the password history hash to protect the hash against offline bruteforcing,

     * since rederiving this value requires a successful authentication. If user is a profile with

     * unified challenge, currentCredential is ignored.

     */

    @Override

    public byte[] getHashFactor(LockscreenCredential currentCredential, int userId) {

        checkPasswordReadPermission();

    private byte[] getHashFactorInternal(LockscreenCredential currentCredential, int userId) {

        try {

            Slogf.d(TAG, "Getting password history hash factor for user %d", userId);

            if (isProfileWithUnifiedLock(userId)) {
@@ -3350,6 +3351,12 @@ public class LockSettingsService extends ILockSettings.Stub { 
        }

    }



    @Override

    public byte[] getHashFactor(LockscreenCredential currentCredential, int userId) {

        checkPasswordReadPermission();

        return getHashFactorInternal(currentCredential, userId);

    }



    private long addEscrowToken(@NonNull byte[] token, @TokenType int type, int userId,

            @NonNull EscrowTokenStateChangeCallback callback) {

        Slogf.i(TAG, "Adding escrow token for user %d", userId);