Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac3576b0 authored by Sandro Montanari's avatar Sandro Montanari Committed by Automerger Merge Worker
Browse files

Merge "Add CertificateTransparencyVerificationRequired to... 

Merge "Add CertificateTransparencyVerificationRequired to NetworkSecurityConfig" into main am: e03f2fb6

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2860966



Change-Id: I340260fe94477d2dbf60d4953158ec62d374f2d4
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 78c70d3e e03f2fb6

core/api/current.txt

+1 −0
Original line number Diff line number Diff line
@@ -39342,6 +39342,7 @@ package android.security { 














  public class NetworkSecurityPolicy {















    method public static android.security.NetworkSecurityPolicy getInstance();













    method @FlaggedApi("android.security.certificate_transparency_configuration") public boolean isCertificateTransparencyVerificationRequired(@NonNull String);















    method public boolean isCleartextTrafficPermitted();















    method public boolean isCleartextTrafficPermitted(String);















  }

























core/java/android/security/NetworkSecurityPolicy.java



+18
−3




























Original line number
Diff line number
Diff line








@@ -16,6 +16,8 @@





























package android.security;





























import android.annotation.FlaggedApi;













import android.annotation.NonNull;















import android.content.Context;















import android.content.pm.PackageManager;















import android.security.net.config.ApplicationConfig;









@@ -26,9 +28,6 @@ import android.security.net.config.ManifestConfigSource;













 *















 * <p>Network stacks/components should honor this policy to make it possible to centrally control















 * the relevant aspects of network security behavior.













 *













 * <p>The policy currently consists of a single flag: whether cleartext network traffic is













 * permitted. See {@link #isCleartextTrafficPermitted()}.















 */















public class NetworkSecurityPolicy {


























@@ -93,6 +92,22 @@ public class NetworkSecurityPolicy {













        libcore.net.NetworkSecurityPolicy.setInstance(policy);















    }





























    /**













     * Returns {@code true} if Certificate Transparency information is required to be verified by













     * the client in TLS connections to {@code hostname}.













     *













     * <p>See RFC6962 section 3.3 for more details.













     *













     * @param hostname hostname to check whether certificate transparency verification is required













     * @return {@code true} if certificate transparency verification is required and {@code false}













     *     otherwise













     */













    @FlaggedApi(Flags.FLAG_CERTIFICATE_TRANSPARENCY_CONFIGURATION)













    public boolean isCertificateTransparencyVerificationRequired(@NonNull String hostname) {













        return libcore.net.NetworkSecurityPolicy.getInstance()













                .isCertificateTransparencyVerificationRequired(hostname);













    }





























    /**















     * Handle an update to the system or user certificate stores.















     * @hide

































core/java/android/security/flags.aconfig



+7
−0




























Original line number
Diff line number
Diff line















package: "android.security"





























flag {













    name: "certificate_transparency_configuration"













    namespace: "network_security"













    description: "Enable certificate transparency setting in the network security config"













    bug: "28746284"













}





























flag {















    name: "fsverity_api"















    namespace: "hardware_backed_security"

































core/java/android/security/net/config/ApplicationConfig.java



+21
−0




























Original line number
Diff line number
Diff line








@@ -16,10 +16,15 @@





























package android.security.net.config;





























import static android.security.Flags.certificateTransparencyConfiguration;



























import android.annotation.NonNull;















import android.util.Pair;





























import java.util.HashSet;















import java.util.Locale;















import java.util.Set;





























import javax.net.ssl.X509TrustManager;































/**










@@ -147,6 +152,22 @@ public final class ApplicationConfig {













        return getConfigForHostname(hostname).isCleartextTrafficPermitted();















    }





























    /**













     * Returns {@code true} if Certificate Transparency information is required to be verified by













     * the client in TLS connections to {@code hostname}.













     *













     * <p>See RFC6962 section 3.3 for more details.













     *













     * @param hostname hostname to check whether certificate transparency verification is required













     * @return {@code true} if certificate transparency verification is required and {@code false}













     *     otherwise













     */













    public boolean isCertificateTransparencyVerificationRequired(@NonNull String hostname) {













        return certificateTransparencyConfiguration()













                ? getConfigForHostname(hostname).isCertificateTransparencyVerificationRequired()













                : NetworkSecurityConfig.DEFAULT_CERTIFICATE_TRANSPARENCY_VERIFICATION_REQUIRED;













    }





























    public void handleTrustStorageUpdate() {















        synchronized(mLock) {















            // If the config is uninitialized then there is no work to be done to handle an update,

































core/java/android/security/net/config/ConfigNetworkSecurityPolicy.java



+1
−1




























Original line number
Diff line number
Diff line








@@ -40,6 +40,6 @@ public class ConfigNetworkSecurityPolicy extends libcore.net.NetworkSecurityPoli





























    @Override















    public boolean isCertificateTransparencyVerificationRequired(String hostname) {













        return false;













        return mConfig.isCertificateTransparencyVerificationRequired(hostname);















    }















}