Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2011 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | package android.security; |
| 17 | |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 18 | import android.app.Activity; |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 19 | import android.app.PendingIntent; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 20 | import android.content.ComponentName; |
| 21 | import android.content.Context; |
| 22 | import android.content.Intent; |
| 23 | import android.content.ServiceConnection; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 24 | import android.os.IBinder; |
| 25 | import android.os.Looper; |
| 26 | import android.os.RemoteException; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 27 | import java.io.ByteArrayInputStream; |
Brian Carlstrom | d752472 | 2011-05-17 16:20:36 -0700 | [diff] [blame] | 28 | import java.io.Closeable; |
Kenny Root | 5423e68 | 2011-11-14 08:43:13 -0800 | [diff] [blame] | 29 | import java.security.InvalidKeyException; |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 30 | import java.security.Principal; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 31 | import java.security.PrivateKey; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 32 | import java.security.cert.Certificate; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 33 | import java.security.cert.CertificateException; |
| 34 | import java.security.cert.CertificateFactory; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 35 | import java.security.cert.X509Certificate; |
Brian Carlstrom | db93b78 | 2011-07-01 00:12:17 -0700 | [diff] [blame] | 36 | import java.util.List; |
Kenny Root | b91773b | 2013-09-05 13:03:16 -0700 | [diff] [blame] | 37 | import java.util.Locale; |
Brian Carlstrom | 8e9929c | 2011-05-17 00:40:28 -0700 | [diff] [blame] | 38 | import java.util.concurrent.BlockingQueue; |
| 39 | import java.util.concurrent.LinkedBlockingQueue; |
Kenny Root | 5423e68 | 2011-11-14 08:43:13 -0800 | [diff] [blame] | 40 | |
Kenny Root | 12e7522 | 2013-04-23 22:34:24 -0700 | [diff] [blame] | 41 | import com.android.org.conscrypt.OpenSSLEngine; |
| 42 | import com.android.org.conscrypt.TrustedCertificateStore; |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 43 | |
| 44 | /** |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 45 | * The {@code KeyChain} class provides access to private keys and |
| 46 | * their corresponding certificate chains in credential storage. |
| 47 | * |
| 48 | * <p>Applications accessing the {@code KeyChain} normally go through |
| 49 | * these steps: |
| 50 | * |
| 51 | * <ol> |
| 52 | * |
| 53 | * <li>Receive a callback from an {@link javax.net.ssl.X509KeyManager |
| 54 | * X509KeyManager} that a private key is requested. |
| 55 | * |
| 56 | * <li>Call {@link #choosePrivateKeyAlias |
| 57 | * choosePrivateKeyAlias} to allow the user to select from a |
| 58 | * list of currently available private keys and corresponding |
| 59 | * certificate chains. The chosen alias will be returned by the |
| 60 | * callback {@link KeyChainAliasCallback#alias}, or null if no private |
| 61 | * key is available or the user cancels the request. |
| 62 | * |
| 63 | * <li>Call {@link #getPrivateKey} and {@link #getCertificateChain} to |
| 64 | * retrieve the credentials to return to the corresponding {@link |
| 65 | * javax.net.ssl.X509KeyManager} callbacks. |
| 66 | * |
| 67 | * </ol> |
| 68 | * |
| 69 | * <p>An application may remember the value of a selected alias to |
| 70 | * avoid prompting the user with {@link #choosePrivateKeyAlias |
| 71 | * choosePrivateKeyAlias} on subsequent connections. If the alias is |
| 72 | * no longer valid, null will be returned on lookups using that value |
Brian Carlstrom | ca43c45 | 2011-06-29 18:53:17 -0700 | [diff] [blame] | 73 | * |
| 74 | * <p>An application can request the installation of private keys and |
| 75 | * certificates via the {@code Intent} provided by {@link |
| 76 | * #createInstallIntent}. Private keys installed via this {@code |
| 77 | * Intent} will be accessible via {@link #choosePrivateKeyAlias} while |
| 78 | * Certificate Authority (CA) certificates will be trusted by all |
| 79 | * applications through the default {@code X509TrustManager}. |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 80 | */ |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 81 | // TODO reference intent for credential installation when public |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 82 | public final class KeyChain { |
| 83 | |
| 84 | private static final String TAG = "KeyChain"; |
| 85 | |
| 86 | /** |
| 87 | * @hide Also used by KeyChainService implementation |
| 88 | */ |
| 89 | public static final String ACCOUNT_TYPE = "com.android.keychain"; |
| 90 | |
| 91 | /** |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 92 | * Action to bring up the KeyChainActivity |
| 93 | */ |
| 94 | private static final String ACTION_CHOOSER = "com.android.keychain.CHOOSER"; |
| 95 | |
| 96 | /** |
Kenny Root | 1a88d83 | 2014-02-07 09:12:48 -0800 | [diff] [blame] | 97 | * Package name for the Certificate Installer. |
| 98 | */ |
| 99 | private static final String CERT_INSTALLER_PACKAGE = "com.android.certinstaller"; |
| 100 | |
| 101 | /** |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 102 | * Extra for use with {@link #ACTION_CHOOSER} |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 103 | * @hide Also used by KeyChainActivity implementation |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 104 | */ |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 105 | public static final String EXTRA_RESPONSE = "response"; |
| 106 | |
| 107 | /** |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 108 | * Extra for use with {@link #ACTION_CHOOSER} |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 109 | * @hide Also used by KeyChainActivity implementation |
| 110 | */ |
| 111 | public static final String EXTRA_HOST = "host"; |
| 112 | |
| 113 | /** |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 114 | * Extra for use with {@link #ACTION_CHOOSER} |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 115 | * @hide Also used by KeyChainActivity implementation |
| 116 | */ |
| 117 | public static final String EXTRA_PORT = "port"; |
| 118 | |
| 119 | /** |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 120 | * Extra for use with {@link #ACTION_CHOOSER} |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 121 | * @hide Also used by KeyChainActivity implementation |
| 122 | */ |
| 123 | public static final String EXTRA_ALIAS = "alias"; |
| 124 | |
| 125 | /** |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 126 | * Extra for use with {@link #ACTION_CHOOSER} |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 127 | * @hide Also used by KeyChainActivity implementation |
| 128 | */ |
| 129 | public static final String EXTRA_SENDER = "sender"; |
| 130 | |
| 131 | /** |
Selim Gurun | 93ba4fe | 2012-02-14 11:48:49 -0800 | [diff] [blame] | 132 | * Action to bring up the CertInstaller. |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 133 | */ |
| 134 | private static final String ACTION_INSTALL = "android.credentials.INSTALL"; |
| 135 | |
| 136 | /** |
| 137 | * Optional extra to specify a {@code String} credential name on |
| 138 | * the {@code Intent} returned by {@link #createInstallIntent}. |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 139 | */ |
| 140 | // Compatible with old com.android.certinstaller.CredentialHelper.CERT_NAME_KEY |
| 141 | public static final String EXTRA_NAME = "name"; |
| 142 | |
| 143 | /** |
| 144 | * Optional extra to specify an X.509 certificate to install on |
| 145 | * the {@code Intent} returned by {@link #createInstallIntent}. |
| 146 | * The extra value should be a PEM or ASN.1 DER encoded {@code |
| 147 | * byte[]}. An {@link X509Certificate} can be converted to DER |
| 148 | * encoded bytes with {@link X509Certificate#getEncoded}. |
| 149 | * |
| 150 | * <p>{@link #EXTRA_NAME} may be used to provide a default alias |
| 151 | * name for the installed certificate. |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 152 | */ |
| 153 | // Compatible with old android.security.Credentials.CERTIFICATE |
| 154 | public static final String EXTRA_CERTIFICATE = "CERT"; |
| 155 | |
| 156 | /** |
| 157 | * Optional extra for use with the {@code Intent} returned by |
| 158 | * {@link #createInstallIntent} to specify a PKCS#12 key store to |
| 159 | * install. The extra value should be a {@code byte[]}. The bytes |
| 160 | * may come from an external source or be generated with {@link |
Brian Carlstrom | ca43c45 | 2011-06-29 18:53:17 -0700 | [diff] [blame] | 161 | * java.security.KeyStore#store} on a "PKCS12" instance. |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 162 | * |
| 163 | * <p>The user will be prompted for the password to load the key store. |
| 164 | * |
| 165 | * <p>The key store will be scanned for {@link |
| 166 | * java.security.KeyStore.PrivateKeyEntry} entries and both the |
| 167 | * private key and associated certificate chain will be installed. |
| 168 | * |
| 169 | * <p>{@link #EXTRA_NAME} may be used to provide a default alias |
| 170 | * name for the installed credentials. |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 171 | */ |
| 172 | // Compatible with old android.security.Credentials.PKCS12 |
| 173 | public static final String EXTRA_PKCS12 = "PKCS12"; |
| 174 | |
Selim Gurun | 93ba4fe | 2012-02-14 11:48:49 -0800 | [diff] [blame] | 175 | |
| 176 | /** |
Selim Gurun | 93ba4fe | 2012-02-14 11:48:49 -0800 | [diff] [blame] | 177 | * Broadcast Action: Indicates the trusted storage has changed. Sent when |
| 178 | * one of this happens: |
| 179 | * |
| 180 | * <ul> |
| 181 | * <li>a new CA is added, |
| 182 | * <li>an existing CA is removed or disabled, |
| 183 | * <li>a disabled CA is enabled, |
| 184 | * <li>trusted storage is reset (all user certs are cleared), |
| 185 | * <li>when permission to access a private key is changed. |
| 186 | * </ul> |
| 187 | */ |
| 188 | public static final String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED"; |
| 189 | |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 190 | /** |
| 191 | * Returns an {@code Intent} that can be used for credential |
| 192 | * installation. The intent may be used without any extras, in |
| 193 | * which case the user will be able to install credentials from |
| 194 | * their own source. |
| 195 | * |
| 196 | * <p>Alternatively, {@link #EXTRA_CERTIFICATE} or {@link |
| 197 | * #EXTRA_PKCS12} maybe used to specify the bytes of an X.509 |
| 198 | * certificate or a PKCS#12 key store for installation. These |
Brian Carlstrom | ca43c45 | 2011-06-29 18:53:17 -0700 | [diff] [blame] | 199 | * extras may be combined with {@link #EXTRA_NAME} to provide a |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 200 | * default alias name for credentials being installed. |
| 201 | * |
| 202 | * <p>When used with {@link Activity#startActivityForResult}, |
| 203 | * {@link Activity#RESULT_OK} will be returned if a credential was |
| 204 | * successfully installed, otherwise {@link |
| 205 | * Activity#RESULT_CANCELED} will be returned. |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 206 | */ |
| 207 | public static Intent createInstallIntent() { |
| 208 | Intent intent = new Intent(ACTION_INSTALL); |
Kenny Root | 1a88d83 | 2014-02-07 09:12:48 -0800 | [diff] [blame] | 209 | intent.setClassName(CERT_INSTALLER_PACKAGE, |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 210 | "com.android.certinstaller.CertInstallerMain"); |
| 211 | return intent; |
| 212 | } |
| 213 | |
| 214 | /** |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 215 | * Launches an {@code Activity} for the user to select the alias |
| 216 | * for a private key and certificate pair for authentication. The |
| 217 | * selected alias or null will be returned via the |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 218 | * KeyChainAliasCallback callback. |
| 219 | * |
| 220 | * <p>{@code keyTypes} and {@code issuers} may be used to |
| 221 | * highlight suggested choices to the user, although to cope with |
| 222 | * sometimes erroneous values provided by servers, the user may be |
| 223 | * able to override these suggestions. |
| 224 | * |
| 225 | * <p>{@code host} and {@code port} may be used to give the user |
| 226 | * more context about the server requesting the credentials. |
| 227 | * |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 228 | * <p>{@code alias} allows the chooser to preselect an existing |
| 229 | * alias which will still be subject to user confirmation. |
| 230 | * |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 231 | * @param activity The {@link Activity} context to use for |
| 232 | * launching the new sub-Activity to prompt the user to select |
| 233 | * a private key; used only to call startActivity(); must not |
| 234 | * be null. |
| 235 | * @param response Callback to invoke when the request completes; |
| 236 | * must not be null |
| 237 | * @param keyTypes The acceptable types of asymmetric keys such as |
| 238 | * "RSA" or "DSA", or a null array. |
| 239 | * @param issuers The acceptable certificate issuers for the |
| 240 | * certificate matching the private key, or null. |
| 241 | * @param host The host name of the server requesting the |
| 242 | * certificate, or null if unavailable. |
| 243 | * @param port The port number of the server requesting the |
| 244 | * certificate, or -1 if unavailable. |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 245 | * @param alias The alias to preselect if available, or null if |
| 246 | * unavailable. |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 247 | */ |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 248 | public static void choosePrivateKeyAlias(Activity activity, KeyChainAliasCallback response, |
| 249 | String[] keyTypes, Principal[] issuers, |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 250 | String host, int port, |
| 251 | String alias) { |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 252 | /* |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 253 | * TODO currently keyTypes, issuers are unused. They are meant |
| 254 | * to follow the semantics and purpose of X509KeyManager |
| 255 | * method arguments. |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 256 | * |
| 257 | * keyTypes would allow the list to be filtered and typically |
| 258 | * will be set correctly by the server. In practice today, |
| 259 | * most all users will want only RSA, rarely DSA, and usually |
| 260 | * only a small number of certs will be available. |
| 261 | * |
| 262 | * issuers is typically not useful. Some servers historically |
| 263 | * will send the entire list of public CAs known to the |
| 264 | * server. Others will send none. If this is used, if there |
| 265 | * are no matches after applying the constraint, it should be |
| 266 | * ignored. |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 267 | */ |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 268 | if (activity == null) { |
| 269 | throw new NullPointerException("activity == null"); |
| 270 | } |
| 271 | if (response == null) { |
| 272 | throw new NullPointerException("response == null"); |
| 273 | } |
Brian Carlstrom | a00a2b3 | 2011-06-29 10:42:35 -0700 | [diff] [blame] | 274 | Intent intent = new Intent(ACTION_CHOOSER); |
Kenny Root | 1a88d83 | 2014-02-07 09:12:48 -0800 | [diff] [blame] | 275 | intent.setPackage(CERT_INSTALLER_PACKAGE); |
Fred Quintana | ab8b84a | 2011-07-13 14:55:39 -0700 | [diff] [blame] | 276 | intent.putExtra(EXTRA_RESPONSE, new AliasResponse(response)); |
Brian Carlstrom | 67c30df | 2011-06-24 02:13:23 -0700 | [diff] [blame] | 277 | intent.putExtra(EXTRA_HOST, host); |
| 278 | intent.putExtra(EXTRA_PORT, port); |
| 279 | intent.putExtra(EXTRA_ALIAS, alias); |
| 280 | // the PendingIntent is used to get calling package name |
| 281 | intent.putExtra(EXTRA_SENDER, PendingIntent.getActivity(activity, 0, new Intent(), 0)); |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 282 | activity.startActivity(intent); |
| 283 | } |
| 284 | |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 285 | private static class AliasResponse extends IKeyChainAliasCallback.Stub { |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 286 | private final KeyChainAliasCallback keyChainAliasResponse; |
Fred Quintana | ab8b84a | 2011-07-13 14:55:39 -0700 | [diff] [blame] | 287 | private AliasResponse(KeyChainAliasCallback keyChainAliasResponse) { |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 288 | this.keyChainAliasResponse = keyChainAliasResponse; |
| 289 | } |
| 290 | @Override public void alias(String alias) { |
Fred Quintana | ab8b84a | 2011-07-13 14:55:39 -0700 | [diff] [blame] | 291 | keyChainAliasResponse.alias(alias); |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 292 | } |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 293 | } |
| 294 | |
| 295 | /** |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 296 | * Returns the {@code PrivateKey} for the requested alias, or null |
| 297 | * if no there is no result. |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 298 | * |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 299 | * @param alias The alias of the desired private key, typically |
| 300 | * returned via {@link KeyChainAliasCallback#alias}. |
| 301 | * @throws KeyChainException if the alias was valid but there was some problem accessing it. |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 302 | */ |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 303 | public static PrivateKey getPrivateKey(Context context, String alias) |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 304 | throws KeyChainException, InterruptedException { |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 305 | if (alias == null) { |
| 306 | throw new NullPointerException("alias == null"); |
| 307 | } |
Brian Carlstrom | d752472 | 2011-05-17 16:20:36 -0700 | [diff] [blame] | 308 | KeyChainConnection keyChainConnection = bind(context); |
Brian Carlstrom | 8e9929c | 2011-05-17 00:40:28 -0700 | [diff] [blame] | 309 | try { |
Kenny Root | 5423e68 | 2011-11-14 08:43:13 -0800 | [diff] [blame] | 310 | final IKeyChainService keyChainService = keyChainConnection.getService(); |
| 311 | final String keyId = keyChainService.requestPrivateKey(alias); |
| 312 | if (keyId == null) { |
| 313 | throw new KeyChainException("keystore had a problem"); |
| 314 | } |
| 315 | |
| 316 | final OpenSSLEngine engine = OpenSSLEngine.getInstance("keystore"); |
| 317 | return engine.getPrivateKeyById(keyId); |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 318 | } catch (RemoteException e) { |
| 319 | throw new KeyChainException(e); |
| 320 | } catch (RuntimeException e) { |
| 321 | // only certain RuntimeExceptions can be propagated across the IKeyChainService call |
| 322 | throw new KeyChainException(e); |
Kenny Root | 5423e68 | 2011-11-14 08:43:13 -0800 | [diff] [blame] | 323 | } catch (InvalidKeyException e) { |
| 324 | throw new KeyChainException(e); |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 325 | } finally { |
| 326 | keyChainConnection.close(); |
| 327 | } |
| 328 | } |
| 329 | |
| 330 | /** |
| 331 | * Returns the {@code X509Certificate} chain for the requested |
| 332 | * alias, or null if no there is no result. |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 333 | * |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 334 | * @param alias The alias of the desired certificate chain, typically |
| 335 | * returned via {@link KeyChainAliasCallback#alias}. |
| 336 | * @throws KeyChainException if the alias was valid but there was some problem accessing it. |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 337 | */ |
| 338 | public static X509Certificate[] getCertificateChain(Context context, String alias) |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 339 | throws KeyChainException, InterruptedException { |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 340 | if (alias == null) { |
| 341 | throw new NullPointerException("alias == null"); |
| 342 | } |
| 343 | KeyChainConnection keyChainConnection = bind(context); |
| 344 | try { |
Brian Carlstrom | ba1a667 | 2011-05-24 21:54:37 -0700 | [diff] [blame] | 345 | IKeyChainService keyChainService = keyChainConnection.getService(); |
Kenny Root | 0150e48 | 2013-02-13 15:22:50 -0800 | [diff] [blame] | 346 | |
| 347 | final byte[] certificateBytes = keyChainService.getCertificate(alias); |
| 348 | if (certificateBytes == null) { |
| 349 | return null; |
| 350 | } |
| 351 | |
Brian Carlstrom | db93b78 | 2011-07-01 00:12:17 -0700 | [diff] [blame] | 352 | TrustedCertificateStore store = new TrustedCertificateStore(); |
Kenny Root | 54e03af | 2012-08-07 10:04:26 -0700 | [diff] [blame] | 353 | List<X509Certificate> chain = store |
| 354 | .getCertificateChain(toCertificate(certificateBytes)); |
Brian Carlstrom | db93b78 | 2011-07-01 00:12:17 -0700 | [diff] [blame] | 355 | return chain.toArray(new X509Certificate[chain.size()]); |
Kenny Root | cfba6a0 | 2013-05-06 15:00:58 -0700 | [diff] [blame] | 356 | } catch (CertificateException e) { |
| 357 | throw new KeyChainException(e); |
Brian Carlstrom | 93201f5 | 2011-06-09 15:05:35 -0700 | [diff] [blame] | 358 | } catch (RemoteException e) { |
| 359 | throw new KeyChainException(e); |
| 360 | } catch (RuntimeException e) { |
| 361 | // only certain RuntimeExceptions can be propagated across the IKeyChainService call |
| 362 | throw new KeyChainException(e); |
Brian Carlstrom | 8e9929c | 2011-05-17 00:40:28 -0700 | [diff] [blame] | 363 | } finally { |
Brian Carlstrom | d752472 | 2011-05-17 16:20:36 -0700 | [diff] [blame] | 364 | keyChainConnection.close(); |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 365 | } |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 366 | } |
| 367 | |
Kenny Root | bf556ac | 2013-04-01 15:10:22 -0700 | [diff] [blame] | 368 | /** |
| 369 | * Returns {@code true} if the current device's {@code KeyChain} supports a |
| 370 | * specific {@code PrivateKey} type indicated by {@code algorithm} (e.g., |
| 371 | * "RSA"). |
| 372 | */ |
Kenny Root | 5b7e90a | 2013-04-02 11:23:41 -0700 | [diff] [blame] | 373 | public static boolean isKeyAlgorithmSupported(String algorithm) { |
Kenny Root | b91773b | 2013-09-05 13:03:16 -0700 | [diff] [blame] | 374 | final String algUpper = algorithm.toUpperCase(Locale.US); |
| 375 | return "DSA".equals(algUpper) || "EC".equals(algUpper) || "RSA".equals(algUpper); |
Kenny Root | bf556ac | 2013-04-01 15:10:22 -0700 | [diff] [blame] | 376 | } |
| 377 | |
| 378 | /** |
| 379 | * Returns {@code true} if the current device's {@code KeyChain} binds any |
| 380 | * {@code PrivateKey} of the given {@code algorithm} to the device once |
| 381 | * imported or generated. This can be used to tell if there is special |
| 382 | * hardware support that can be used to bind keys to the device in a way |
| 383 | * that makes it non-exportable. |
| 384 | */ |
Kenny Root | 5b7e90a | 2013-04-02 11:23:41 -0700 | [diff] [blame] | 385 | public static boolean isBoundKeyAlgorithm(String algorithm) { |
| 386 | if (!isKeyAlgorithmSupported(algorithm)) { |
Kenny Root | bf556ac | 2013-04-01 15:10:22 -0700 | [diff] [blame] | 387 | return false; |
| 388 | } |
| 389 | |
Kenny Root | b91773b | 2013-09-05 13:03:16 -0700 | [diff] [blame] | 390 | return KeyStore.getInstance().isHardwareBacked(algorithm); |
Kenny Root | bf556ac | 2013-04-01 15:10:22 -0700 | [diff] [blame] | 391 | } |
| 392 | |
Brian Carlstrom | 8e9929c | 2011-05-17 00:40:28 -0700 | [diff] [blame] | 393 | private static X509Certificate toCertificate(byte[] bytes) { |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 394 | if (bytes == null) { |
Brian Carlstrom | 8e9929c | 2011-05-17 00:40:28 -0700 | [diff] [blame] | 395 | throw new IllegalArgumentException("bytes == null"); |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 396 | } |
| 397 | try { |
| 398 | CertificateFactory certFactory = CertificateFactory.getInstance("X.509"); |
| 399 | Certificate cert = certFactory.generateCertificate(new ByteArrayInputStream(bytes)); |
| 400 | return (X509Certificate) cert; |
| 401 | } catch (CertificateException e) { |
| 402 | throw new AssertionError(e); |
| 403 | } |
| 404 | } |
| 405 | |
Brian Carlstrom | d752472 | 2011-05-17 16:20:36 -0700 | [diff] [blame] | 406 | /** |
| 407 | * @hide for reuse by CertInstaller and Settings. |
| 408 | * @see KeyChain#bind |
| 409 | */ |
| 410 | public final static class KeyChainConnection implements Closeable { |
| 411 | private final Context context; |
| 412 | private final ServiceConnection serviceConnection; |
| 413 | private final IKeyChainService service; |
| 414 | private KeyChainConnection(Context context, |
| 415 | ServiceConnection serviceConnection, |
| 416 | IKeyChainService service) { |
| 417 | this.context = context; |
| 418 | this.serviceConnection = serviceConnection; |
| 419 | this.service = service; |
| 420 | } |
| 421 | @Override public void close() { |
| 422 | context.unbindService(serviceConnection); |
| 423 | } |
| 424 | public IKeyChainService getService() { |
| 425 | return service; |
| 426 | } |
| 427 | } |
| 428 | |
| 429 | /** |
| 430 | * @hide for reuse by CertInstaller and Settings. |
| 431 | * |
| 432 | * Caller should call unbindService on the result when finished. |
| 433 | */ |
| 434 | public static KeyChainConnection bind(Context context) throws InterruptedException { |
| 435 | if (context == null) { |
| 436 | throw new NullPointerException("context == null"); |
| 437 | } |
| 438 | ensureNotOnMainThread(context); |
| 439 | final BlockingQueue<IKeyChainService> q = new LinkedBlockingQueue<IKeyChainService>(1); |
| 440 | ServiceConnection keyChainServiceConnection = new ServiceConnection() { |
Fred Quintana | ab8b84a | 2011-07-13 14:55:39 -0700 | [diff] [blame] | 441 | volatile boolean mConnectedAtLeastOnce = false; |
Brian Carlstrom | d752472 | 2011-05-17 16:20:36 -0700 | [diff] [blame] | 442 | @Override public void onServiceConnected(ComponentName name, IBinder service) { |
Fred Quintana | ab8b84a | 2011-07-13 14:55:39 -0700 | [diff] [blame] | 443 | if (!mConnectedAtLeastOnce) { |
| 444 | mConnectedAtLeastOnce = true; |
| 445 | try { |
| 446 | q.put(IKeyChainService.Stub.asInterface(service)); |
| 447 | } catch (InterruptedException e) { |
| 448 | // will never happen, since the queue starts with one available slot |
| 449 | } |
Brian Carlstrom | d752472 | 2011-05-17 16:20:36 -0700 | [diff] [blame] | 450 | } |
| 451 | } |
| 452 | @Override public void onServiceDisconnected(ComponentName name) {} |
| 453 | }; |
Maggie Benthall | da51e68 | 2013-08-08 22:35:44 -0400 | [diff] [blame] | 454 | Intent intent = new Intent(IKeyChainService.class.getName()); |
| 455 | ComponentName comp = intent.resolveSystemService(context.getPackageManager(), 0); |
| 456 | intent.setComponent(comp); |
| 457 | boolean isBound = context.bindService(intent, |
Brian Carlstrom | d752472 | 2011-05-17 16:20:36 -0700 | [diff] [blame] | 458 | keyChainServiceConnection, |
| 459 | Context.BIND_AUTO_CREATE); |
| 460 | if (!isBound) { |
| 461 | throw new AssertionError("could not bind to KeyChainService"); |
| 462 | } |
| 463 | return new KeyChainConnection(context, keyChainServiceConnection, q.take()); |
| 464 | } |
| 465 | |
Brian Carlstrom | 8e9929c | 2011-05-17 00:40:28 -0700 | [diff] [blame] | 466 | private static void ensureNotOnMainThread(Context context) { |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 467 | Looper looper = Looper.myLooper(); |
Brian Carlstrom | 8e9929c | 2011-05-17 00:40:28 -0700 | [diff] [blame] | 468 | if (looper != null && looper == context.getMainLooper()) { |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 469 | throw new IllegalStateException( |
| 470 | "calling this from your main thread can lead to deadlock"); |
| 471 | } |
| 472 | } |
Brian Carlstrom | b9a07c1 | 2011-04-11 09:03:51 -0700 | [diff] [blame] | 473 | } |