Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Invalidate existing keys when platform_key_generation_id is set" into qt-dev

Browse Source
This commit is contained in:
Annie Meng
2019-05-01 17:37:03 +00:00
committed by Android (Google) Code Review
parent 8e24abad64 e94375a88f
commit 0307878613
2 changed files with 31 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RecoverableKeyStoreDb.java
View File

@@ -333,6 +333,7 @@ public class RecoverableKeyStoreDb {
String[] selectionArguments = new String[] {String.valueOf(userId)};
ensureUserMetadataEntryExists(userId);
invalidateKeysForUser(userId);
return db.update(UserMetadataEntry.TABLE_NAME, values, selection, selectionArguments);
}
@@ -394,16 +395,13 @@ public class RecoverableKeyStoreDb {
/**
* Updates status of old keys to {@code RecoveryController.RECOVERY_STATUS_PERMANENT_FAILURE}.
*/
public void invalidateKeysWithOldGenerationId(int userId, int newGenerationId) {
public void invalidateKeysForUser(int userId) {
SQLiteDatabase db = mKeyStoreDbHelper.getWritableDatabase();
ContentValues values = new ContentValues();
values.put(KeysEntry.COLUMN_NAME_RECOVERY_STATUS,
RecoveryController.RECOVERY_STATUS_PERMANENT_FAILURE);
String selection =
KeysEntry.COLUMN_NAME_USER_ID + " = ? AND "
+ KeysEntry.COLUMN_NAME_GENERATION_ID + " < ?";
db.update(KeysEntry.TABLE_NAME, values, selection,
new String[] {String.valueOf(userId), String.valueOf(newGenerationId)});
String selection = KeysEntry.COLUMN_NAME_USER_ID + " = ?";
db.update(KeysEntry.TABLE_NAME, values, selection, new String[] {String.valueOf(userId)});
}
/**

29
services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/storage/RecoverableKeyStoreDbTest.java
View File

@@ -329,6 +329,31 @@ public class RecoverableKeyStoreDbTest {
assertEquals(serialNumber, mRecoverableKeyStoreDb.getUserSerialNumbers().get(userId));
}
@Test
public void setPlatformKeyGenerationId_invalidatesExistingKeysForUser() {
int userId = 42;
int generationId = 110;
int uid = 1009;
int status = 120;
String alias = "test";
byte[] nonce = getUtf8Bytes("nonce");
byte[] keyMaterial = getUtf8Bytes("keymaterial");
byte[] keyMetadata = null;
WrappedKey wrappedKey =
new WrappedKey(nonce, keyMaterial, keyMetadata, generationId, status);
mRecoverableKeyStoreDb.insertKey(userId, uid, alias, wrappedKey);
WrappedKey retrievedKey = mRecoverableKeyStoreDb.getKey(uid, alias);
assertThat(retrievedKey.getRecoveryStatus()).isEqualTo(status);
mRecoverableKeyStoreDb.setPlatformKeyGenerationId(userId, generationId + 1);
retrievedKey = mRecoverableKeyStoreDb.getKey(uid, alias);
assertThat(retrievedKey.getRecoveryStatus())
.isEqualTo(RecoveryController.RECOVERY_STATUS_PERMANENT_FAILURE);
}
@Test
public void removeUserFromAllTables_removesData() throws Exception {
@@ -439,7 +464,7 @@ public class RecoverableKeyStoreDbTest {
}
@Test
public void testInvalidateKeysWithOldGenerationId_withSingleKey() {
public void testInvalidateKeysForUser_withSingleKey() {
int userId = 12;
int uid = 1009;
int generationId = 6;
@@ -458,7 +483,7 @@ public class RecoverableKeyStoreDbTest {
assertThat(retrievedKey.getRecoveryStatus()).isEqualTo(status);
mRecoverableKeyStoreDb.setRecoveryStatus(uid, alias, status2);
mRecoverableKeyStoreDb.invalidateKeysWithOldGenerationId(userId, generationId + 1);
mRecoverableKeyStoreDb.invalidateKeysForUser(userId);
retrievedKey = mRecoverableKeyStoreDb.getKey(uid, alias);
assertThat(retrievedKey.getRecoveryStatus())