Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a6999ef authored by Joseph Jang's avatar Joseph Jang Committed by Automerger Merge Worker
Browse files

Merge "Export extractDerSubjectFromCertificate() utility API for oem Hal usage" am: a66f64d0 

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1996432

Change-Id: I9194eaf9a5d934cd113918eae5c1e06a61917ac1
parents 92fbebc8 a66f64d0

identity/support/include/android/hardware/identity/support/IdentityCredentialSupport.h

+4 −0
Original line number Diff line number Diff line
@@ -407,6 +407,10 @@ const vector<uint8_t>& getTestHardwareBoundKey(); 
// may be smaller than |maxChunkSize|.

vector<vector<uint8_t>> chunkVector(const vector<uint8_t>& content, size_t maxChunkSize);



// Extract the issuer subject name from the leaf cert in the given chain,

// returning it as DER-encoded bytes.

optional<vector<uint8_t>> extractDerSubjectFromCertificate(const vector<uint8_t>& certificate);



}  // namespace support

}  // namespace identity

}  // namespace hardware

identity/support/src/IdentityCredentialSupport.cpp

+31 −33
Original line number Diff line number Diff line
@@ -209,38 +209,6 @@ optional<vector<uint8_t>> derEncodeKeyPair(const EVP_PKEY& pkey) { 
    return keyPair;

}



// Extract the issuer subject name from the leaf cert in the given chain,

// returning it as DER-encoded bytes.

optional<vector<uint8_t>> extractDerSubjectFromCertificate(const vector<uint8_t>& certificate) {

    const uint8_t* input = certificate.data();

    X509_Ptr cert(d2i_X509(/*cert=*/nullptr, &input, certificate.size()));

    if (!cert) {

        LOG(ERROR) << "Failed to parse certificate";

        return std::nullopt;

    }



    X509_NAME* subject = X509_get_subject_name(cert.get());

    if (!subject) {

        LOG(ERROR) << "Failed to retrieve subject name";

        return std::nullopt;

    }



    int encodedSubjectLength = i2d_X509_NAME(subject, /*out=*/nullptr);

    if (encodedSubjectLength < 0) {

        LOG(ERROR) << "Error obtaining encoded subject name length";

        return std::nullopt;

    }



    vector<uint8_t> encodedSubject(encodedSubjectLength);

    uint8_t* out = encodedSubject.data();

    if (encodedSubjectLength != i2d_X509_NAME(subject, &out)) {

        LOG(ERROR) << "Error encoding subject name";

        return std::nullopt;

    }



    return encodedSubject;

}



// Generates the attestation certificate with the parameters passed in.  Note

// that the passed in |activeTimeMilliSeconds| |expireTimeMilliSeconds| are in

// milli seconds since epoch.  We are setting them to milliseconds due to
@@ -900,7 +868,7 @@ optional<std::pair<vector<uint8_t>, vector<uint8_t>>> createEcKeyPairWithAttesta 
    }



    optional<vector<uint8_t>> derIssuerSubject =

            extractDerSubjectFromCertificate(attestationKeyCert);

            support::extractDerSubjectFromCertificate(attestationKeyCert);

    if (!derIssuerSubject) {

        LOG(ERROR) << "Error error extracting issuer name from the given certificate chain";

        return std::nullopt;
@@ -2325,6 +2293,36 @@ const vector<uint8_t>& getTestHardwareBoundKey() { 
    return testHardwareBoundKey;

}



optional<vector<uint8_t>> extractDerSubjectFromCertificate(const vector<uint8_t>& certificate) {

    const uint8_t* input = certificate.data();

    X509_Ptr cert(d2i_X509(/*cert=*/nullptr, &input, certificate.size()));

    if (!cert) {

        LOG(ERROR) << "Failed to parse certificate";

        return std::nullopt;

    }



    X509_NAME* subject = X509_get_subject_name(cert.get());

    if (!subject) {

        LOG(ERROR) << "Failed to retrieve subject name";

        return std::nullopt;

    }



    int encodedSubjectLength = i2d_X509_NAME(subject, /*out=*/nullptr);

    if (encodedSubjectLength < 0) {

        LOG(ERROR) << "Error obtaining encoded subject name length";

        return std::nullopt;

    }



    vector<uint8_t> encodedSubject(encodedSubjectLength);

    uint8_t* out = encodedSubject.data();

    if (encodedSubjectLength != i2d_X509_NAME(subject, &out)) {

        LOG(ERROR) << "Error encoding subject name";

        return std::nullopt;

    }



    return encodedSubject;

}



}  // namespace support

}  // namespace identity

}  // namespace hardware