Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4b6c696 authored by Chad Brubaker's avatar Chad Brubaker
Browse files

Support TrustedCertificateStore.findAllIssuers 

(cherry-picked from commit aa6c3c3e)
Change-Id: I176ec42c9907e50ee218e4fb352b530ca797be46
parent c027ae49

core/java/android/security/net/config/CertificateSource.java

+2 −1
Original line number Diff line number Diff line
@@ -16,12 +16,13 @@ 


package android.security.net.config;



import java.util.Set;

import java.security.cert.X509Certificate;

import java.util.Set;



/** @hide */

public interface CertificateSource {

    Set<X509Certificate> getCertificates();

    X509Certificate findBySubjectAndPublicKey(X509Certificate cert);

    X509Certificate findByIssuerAndSignature(X509Certificate cert);

    Set<X509Certificate> findAllByIssuerAndSignature(X509Certificate cert);

}

core/java/android/security/net/config/CertificatesEntryRef.java

+5 −1
Original line number Diff line number Diff line
@@ -17,8 +17,8 @@ 
package android.security.net.config;



import android.util.ArraySet;

import java.util.Set;

import java.security.cert.X509Certificate;

import java.util.Set;



/** @hide */

public final class CertificatesEntryRef {
@@ -60,4 +60,8 @@ public final class CertificatesEntryRef { 


        return new TrustAnchor(foundCert, mOverridesPins);

    }



    public Set<X509Certificate> findAllCertificatesByIssuerAndSignature(X509Certificate cert) {

        return mSource.findAllByIssuerAndSignature(cert);

    }

}

core/java/android/security/net/config/DirectoryCertificateSource.java

+41 −0
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ import java.security.cert.Certificate; 
import java.security.cert.CertificateException;

import java.security.cert.CertificateFactory;

import java.security.cert.X509Certificate;

import java.util.Collections;

import java.util.Set;

import libcore.io.IoUtils;
@@ -110,10 +111,50 @@ abstract class DirectoryCertificateSource implements CertificateSource { 
        });

    }



    @Override

    public Set<X509Certificate> findAllByIssuerAndSignature(final X509Certificate cert) {

        return findCerts(cert.getIssuerX500Principal(), new CertSelector() {

            @Override

            public boolean match(X509Certificate ca) {

                try {

                    cert.verify(ca.getPublicKey());

                    return true;

                } catch (Exception e) {

                    return false;

                }

            }

        });

    }



    private static interface CertSelector {

        boolean match(X509Certificate cert);

    }



    private Set<X509Certificate> findCerts(X500Principal subj, CertSelector selector) {

        String hash = getHash(subj);

        Set<X509Certificate> certs = null;

        for (int index = 0; index >= 0; index++) {

            String fileName = hash + "." + index;

            if (!new File(mDir, fileName).exists()) {

                break;

            }

            if (isCertMarkedAsRemoved(fileName)) {

                continue;

            }

            X509Certificate cert = readCertificate(fileName);

            if (!subj.equals(cert.getSubjectX500Principal())) {

                continue;

            }

            if (selector.match(cert)) {

                if (certs == null) {

                    certs = new ArraySet<X509Certificate>();

                }

                certs.add(cert);

            }

        }

        return certs != null ? certs : Collections.<X509Certificate>emptySet();

    }



    private X509Certificate findCert(X500Principal subj, CertSelector selector) {

        String hash = getHash(subj);

        for (int index = 0; index >= 0; index++) {

core/java/android/security/net/config/KeyStoreCertificateSource.java

+15 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ import java.security.KeyStore; 
import java.security.KeyStoreException;

import java.security.cert.Certificate;

import java.security.cert.X509Certificate;

import java.util.Collections;

import java.util.Enumeration;

import java.util.Set;
@@ -90,4 +91,18 @@ class KeyStoreCertificateSource implements CertificateSource { 
        }

        return anchor.getTrustedCert();

    }



    @Override

    public Set<X509Certificate> findAllByIssuerAndSignature(X509Certificate cert) {

        ensureInitialized();

        Set<java.security.cert.TrustAnchor> anchors = mIndex.findAllByIssuerAndSignature(cert);

        if (anchors.isEmpty()) {

            return Collections.<X509Certificate>emptySet();

        }

        Set<X509Certificate> certs = new ArraySet<X509Certificate>(anchors.size());

        for (java.security.cert.TrustAnchor anchor : anchors) {

            certs.add(anchor.getTrustedCert());

        }

        return certs;

    }

}

core/java/android/security/net/config/NetworkSecurityConfig.java

+9 −0
Original line number Diff line number Diff line
@@ -145,6 +145,15 @@ public final class NetworkSecurityConfig { 
        return null;

    }



    /** @hide */

    public Set<X509Certificate> findAllCertificatesByIssuerAndSignature(X509Certificate cert) {

        Set<X509Certificate> certs = new ArraySet<X509Certificate>();

        for (CertificatesEntryRef ref : mCertificatesEntryRefs) {

            certs.addAll(ref.findAllCertificatesByIssuerAndSignature(cert));

        }

        return certs;

    }



    /**

     * Return a {@link Builder} for the default {@code NetworkSecurityConfig}.

     *