Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f6823e71 authored by Gabriel Biren's avatar Gabriel Biren
Browse files

Update WifiKeystore and WifiMigration behavior 

when the supplicant cannot access WifiBlobstore.

On vendor partitions that are <= T, the supplicant
will expect certs to be in the Legacy Keystore
database. This means that:
 - New certs should be stored in Legacy Keystore
 - Certificates should not be migrated out of
   Legacy Keystore on bootup.

Bug: 353140706
Flag: EXEMPT bugfix
Test: atest WifiKeystoreTest WifiMigrationTest
Test: Manual test - verify that the certs are
      stored in the expected database on a V
      device and a V sys + T vend device
Change-Id: Ic7c49b5b3d1ad310b23f201d20c45b4fee142d22
parent f6f83051

wifi/java/src/android/net/wifi/WifiKeystore.java

+11 −4
Original line number Diff line number Diff line
@@ -36,6 +36,8 @@ import java.util.Set; 
@SuppressLint("UnflaggedApi") // Promoting from @SystemApi(MODULE_LIBRARIES)

public final class WifiKeystore {

    private static final String TAG = "WifiKeystore";

    private static final String sPrimaryDbName =

            WifiBlobStore.supplicantCanAccessBlobstore() ? "WifiBlobstore" : "LegacyKeystore";



    /** @hide */

    WifiKeystore() {
@@ -57,8 +59,13 @@ public final class WifiKeystore { 
        // are able to access the same values.

        final long identity = Binder.clearCallingIdentity();

        try {

            Log.i(TAG, "put blob. alias " + alias);

            Log.i(TAG, "put blob. alias=" + alias + ", primaryDb=" + sPrimaryDbName);

            if (WifiBlobStore.supplicantCanAccessBlobstore()) {

                return WifiBlobStore.getInstance().put(alias, blob);

            } else {

                WifiBlobStore.getLegacyKeystore().put(alias, Process.WIFI_UID, blob);

                return true;

            }

        } catch (Exception e) {

            Log.e(TAG, "Failed to put blob.", e);

            return false;
@@ -80,7 +87,7 @@ public final class WifiKeystore { 
    public static @NonNull byte[] get(@NonNull String alias) {

        final long identity = Binder.clearCallingIdentity();

        try {

            Log.i(TAG, "get blob. alias " + alias);

            Log.i(TAG, "get blob. alias=" + alias + ", primaryDb=" + sPrimaryDbName);

            byte[] blob = WifiBlobStore.getInstance().get(alias);

            if (blob != null) {

                return blob;
@@ -112,7 +119,7 @@ public final class WifiKeystore { 
        boolean legacyKsSuccess = false;

        final long identity = Binder.clearCallingIdentity();

        try {

            Log.i(TAG, "remove blob. alias " + alias);

            Log.i(TAG, "remove blob. alias=" + alias + ", primaryDb=" + sPrimaryDbName);

            blobStoreSuccess = WifiBlobStore.getInstance().remove(alias);

            // Legacy Keystore will throw an exception if the alias is not found.

            WifiBlobStore.getLegacyKeystore().remove(alias, Process.WIFI_UID);

wifi/java/src/android/net/wifi/WifiMigration.java

+4 −0
Original line number Diff line number Diff line
@@ -577,6 +577,10 @@ public final class WifiMigration { 
    @FlaggedApi(Flags.FLAG_LEGACY_KEYSTORE_TO_WIFI_BLOBSTORE_MIGRATION_READ_ONLY)

    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)

    public static void migrateLegacyKeystoreToWifiBlobstore() {

        if (!WifiBlobStore.supplicantCanAccessBlobstore()) {

            Log.i(TAG, "Avoiding migration since supplicant cannot access WifiBlobstore");

            return;

        }

        final long identity = Binder.clearCallingIdentity();

        try {

            ILegacyKeystore legacyKeystore = WifiBlobStore.getLegacyKeystore();

wifi/tests/src/android/net/wifi/WifiKeystoreTest.java

+17 −2
Original line number Diff line number Diff line
@@ -61,6 +61,7 @@ public class WifiKeystoreTest { 
        mSession = ExtendedMockito.mockitoSession()

                .mockStatic(WifiBlobStore.class, withSettings().lenient())

                .startMocking();

        when(WifiBlobStore.supplicantCanAccessBlobstore()).thenReturn(true);

        when(WifiBlobStore.getLegacyKeystore()).thenReturn(mLegacyKeystore);

        when(WifiBlobStore.getInstance()).thenReturn(mWifiBlobStore);

    }
@@ -74,15 +75,29 @@ public class WifiKeystoreTest { 
    }



    /**

     * Test that put() only writes to the WifiBlobStore database.

     * Test that put() writes to the WifiBlobStore database when it

     * is available to supplicant.

     */

    @Test

    public void testPut() throws Exception {

    public void testPut_wifiBlobstore() throws Exception {

        when(WifiBlobStore.supplicantCanAccessBlobstore()).thenReturn(true);

        WifiKeystore.put(TEST_ALIAS, TEST_VALUE);

        verify(mWifiBlobStore).put(anyString(), any());

        verify(mLegacyKeystore, never()).put(anyString(), anyInt(), any());

    }



    /**

     * Test that put() writes to Legacy Keystore if the WifiBlobstore database

     * is not available to supplicant.

     */

    @Test

    public void testPut_legacyKeystore() throws Exception {

        when(WifiBlobStore.supplicantCanAccessBlobstore()).thenReturn(false);

        WifiKeystore.put(TEST_ALIAS, TEST_VALUE);

        verify(mLegacyKeystore).put(anyString(), anyInt(), any());

        verify(mWifiBlobStore, never()).put(anyString(), any());

    }



    /**

     * Test that if the alias is found in the WifiBlobStore database,

     * then the legacy database is not searched.

wifi/tests/src/android/net/wifi/WifiMigrationTest.java

+12 −0
Original line number Diff line number Diff line
@@ -56,6 +56,7 @@ public class WifiMigrationTest { 
        mSession = ExtendedMockito.mockitoSession()

                .mockStatic(WifiBlobStore.class, withSettings().lenient())

                .startMocking();

        when(WifiBlobStore.supplicantCanAccessBlobstore()).thenReturn(true);

        when(WifiBlobStore.getLegacyKeystore()).thenReturn(mLegacyKeystore);

        when(WifiBlobStore.getInstance()).thenReturn(mWifiBlobStore);

        when(mLegacyKeystore.get(anyString(), anyInt())).thenReturn(TEST_VALUE);
@@ -69,6 +70,17 @@ public class WifiMigrationTest { 
        }

    }



    /**

     * Verify that the Keystore migration is skipped if supplicant does not have

     * access to the WifiBlobstore database.

     */

    @Test

    public void testKeystoreMigrationAvoidedOnLegacyVendorPartition() {

        when(WifiBlobStore.supplicantCanAccessBlobstore()).thenReturn(false);

        WifiMigration.migrateLegacyKeystoreToWifiBlobstore();

        verifyNoMoreInteractions(mLegacyKeystore, mWifiBlobStore);

    }



    /**

     * Verify that the Keystore migration method returns immediately if no aliases

     * are found in Legacy Keystore.