Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5341ebba authored by Joseph Jang's avatar Joseph Jang
Browse files

Export extractDerSubjectFromCertificate() utility API for oem Hal usage 

mDL oem Hal may need X509 utility API to extract subject name from certificate.

Bug: 218613398
Change-Id: I6316dfb3f1c50394af2d3d35c95d616bd6a2106b
parent 4965e27b

identity/support/include/android/hardware/identity/support/IdentityCredentialSupport.h

+4 −0
Original line number Diff line number Diff line
@@ -407,6 +407,10 @@ const vector<uint8_t>& getTestHardwareBoundKey(); 
// may be smaller than |maxChunkSize|.

vector<vector<uint8_t>> chunkVector(const vector<uint8_t>& content, size_t maxChunkSize);



// Extract the issuer subject name from the leaf cert in the given chain,

// returning it as DER-encoded bytes.

optional<vector<uint8_t>> extractDerSubjectFromCertificate(const vector<uint8_t>& certificate);



}  // namespace support

}  // namespace identity

}  // namespace hardware

identity/support/src/IdentityCredentialSupport.cpp

+31 −33
Original line number Diff line number Diff line
@@ -209,38 +209,6 @@ optional<vector<uint8_t>> derEncodeKeyPair(const EVP_PKEY& pkey) { 
    return keyPair;

}



// Extract the issuer subject name from the leaf cert in the given chain,

// returning it as DER-encoded bytes.

optional<vector<uint8_t>> extractDerSubjectFromCertificate(const vector<uint8_t>& certificate) {

    const uint8_t* input = certificate.data();

    X509_Ptr cert(d2i_X509(/*cert=*/nullptr, &input, certificate.size()));

    if (!cert) {

        LOG(ERROR) << "Failed to parse certificate";

        return std::nullopt;

    }



    X509_NAME* subject = X509_get_subject_name(cert.get());

    if (!subject) {

        LOG(ERROR) << "Failed to retrieve subject name";

        return std::nullopt;

    }



    int encodedSubjectLength = i2d_X509_NAME(subject, /*out=*/nullptr);

    if (encodedSubjectLength < 0) {

        LOG(ERROR) << "Error obtaining encoded subject name length";

        return std::nullopt;

    }



    vector<uint8_t> encodedSubject(encodedSubjectLength);

    uint8_t* out = encodedSubject.data();

    if (encodedSubjectLength != i2d_X509_NAME(subject, &out)) {

        LOG(ERROR) << "Error encoding subject name";

        return std::nullopt;

    }



    return encodedSubject;

}



// Generates the attestation certificate with the parameters passed in.  Note

// that the passed in |activeTimeMilliSeconds| |expireTimeMilliSeconds| are in

// milli seconds since epoch.  We are setting them to milliseconds due to
@@ -900,7 +868,7 @@ optional<std::pair<vector<uint8_t>, vector<uint8_t>>> createEcKeyPairWithAttesta 
    }



    optional<vector<uint8_t>> derIssuerSubject =

            extractDerSubjectFromCertificate(attestationKeyCert);

            support::extractDerSubjectFromCertificate(attestationKeyCert);

    if (!derIssuerSubject) {

        LOG(ERROR) << "Error error extracting issuer name from the given certificate chain";

        return std::nullopt;
@@ -2325,6 +2293,36 @@ const vector<uint8_t>& getTestHardwareBoundKey() { 
    return testHardwareBoundKey;

}



optional<vector<uint8_t>> extractDerSubjectFromCertificate(const vector<uint8_t>& certificate) {

    const uint8_t* input = certificate.data();

    X509_Ptr cert(d2i_X509(/*cert=*/nullptr, &input, certificate.size()));

    if (!cert) {

        LOG(ERROR) << "Failed to parse certificate";

        return std::nullopt;

    }



    X509_NAME* subject = X509_get_subject_name(cert.get());

    if (!subject) {

        LOG(ERROR) << "Failed to retrieve subject name";

        return std::nullopt;

    }



    int encodedSubjectLength = i2d_X509_NAME(subject, /*out=*/nullptr);

    if (encodedSubjectLength < 0) {

        LOG(ERROR) << "Error obtaining encoded subject name length";

        return std::nullopt;

    }



    vector<uint8_t> encodedSubject(encodedSubjectLength);

    uint8_t* out = encodedSubject.data();

    if (encodedSubjectLength != i2d_X509_NAME(subject, &out)) {

        LOG(ERROR) << "Error encoding subject name";

        return std::nullopt;

    }



    return encodedSubject;

}



}  // namespace support

}  // namespace identity

}  // namespace hardware