Merge "Added check for misprovisioned Pixel 2 device." into pi-dev
diff --git a/core/res/res/values/config.xml b/core/res/res/values/config.xml
index 9d6aee1..b372d7b 100644
--- a/core/res/res/values/config.xml
+++ b/core/res/res/values/config.xml
@@ -3508,4 +3508,11 @@
<!-- Whether or not we should show the option to show battery percentage -->
<bool name="config_battery_percentage_setting_available">true</bool>
+
+ <!-- Model of potentially misprovisioned devices. If none is specified in an overlay, an
+ empty string is passed in. -->
+ <string name="config_misprovisionedDeviceModel" translatable="false"></string>
+
+ <!-- Brand value for attestation of misprovisioned device. -->
+ <string name="config_misprovisionedBrandValue" translatable="false"></string>
</resources>
diff --git a/core/res/res/values/symbols.xml b/core/res/res/values/symbols.xml
index cd9d0c4..a3ed1b0 100644
--- a/core/res/res/values/symbols.xml
+++ b/core/res/res/values/symbols.xml
@@ -3412,4 +3412,7 @@
<java-symbol type="array" name="config_disableApksUnlessMatchedSku_apk_list" />
<java-symbol type="array" name="config_disableApkUnlessMatchedSku_skus_list" />
+
+ <java-symbol type="string" name="config_misprovisionedDeviceModel" />
+ <java-symbol type="string" name="config_misprovisionedBrandValue" />
</resources>
diff --git a/keystore/java/android/security/keystore/AttestationUtils.java b/keystore/java/android/security/keystore/AttestationUtils.java
index 1be8309..f7993ef 100644
--- a/keystore/java/android/security/keystore/AttestationUtils.java
+++ b/keystore/java/android/security/keystore/AttestationUtils.java
@@ -22,9 +22,9 @@
import android.annotation.SystemApi;
import android.annotation.TestApi;
import android.content.Context;
+import android.content.res.Resources;
import android.os.Build;
import android.security.KeyStore;
-import android.security.KeyStoreException;
import android.security.keymaster.KeymasterArguments;
import android.security.keymaster.KeymasterCertificateChain;
import android.security.keymaster.KeymasterDefs;
@@ -117,6 +117,40 @@
@NonNull public static KeymasterArguments prepareAttestationArguments(Context context,
@NonNull int[] idTypes, @NonNull byte[] attestationChallenge) throws
DeviceIdAttestationException {
+ return prepareAttestationArguments(context, idTypes,attestationChallenge, Build.BRAND);
+ }
+
+ /**
+ * Prepares Keymaster Arguments with attestation data for misprovisioned Pixel 2 device.
+ * See http://go/keyAttestationFailure and http://b/69471841 for more info.
+ * @hide should only be used by KeyChain.
+ */
+ @NonNull public static KeymasterArguments prepareAttestationArgumentsIfMisprovisioned(
+ Context context, @NonNull int[] idTypes, @NonNull byte[] attestationChallenge) throws
+ DeviceIdAttestationException {
+ if (!isPotentiallyMisprovisionedDevice(context)) {
+ return null;
+ }
+ Resources resources = context.getResources();
+ String misprovisionedBrand = resources.getString(
+ com.android.internal.R.string.config_misprovisionedBrandValue);
+ return prepareAttestationArguments(
+ context, idTypes, attestationChallenge, misprovisionedBrand);
+ }
+
+ @NonNull private static boolean isPotentiallyMisprovisionedDevice(Context context) {
+ Resources resources = context.getResources();
+ String misprovisionedModel = resources.getString(
+ com.android.internal.R.string.config_misprovisionedDeviceModel);
+ String misprovisionedBrand = resources.getString(
+ com.android.internal.R.string.config_misprovisionedBrandValue);
+
+ return (Build.MODEL.equals(misprovisionedModel));
+ }
+
+ @NonNull private static KeymasterArguments prepareAttestationArguments(Context context,
+ @NonNull int[] idTypes, @NonNull byte[] attestationChallenge, String brand) throws
+ DeviceIdAttestationException {
// Check method arguments, retrieve requested device IDs and prepare attestation arguments.
if (attestationChallenge == null) {
throw new NullPointerException("Missing attestation challenge");
@@ -169,7 +203,7 @@
}
}
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_BRAND,
- Build.BRAND.getBytes(StandardCharsets.UTF_8));
+ brand.getBytes(StandardCharsets.UTF_8));
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_DEVICE,
Build.DEVICE.getBytes(StandardCharsets.UTF_8));
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_PRODUCT,