From a2f766f3ee3783b847e18da8253f7690c2e5c556 Mon Sep 17 00:00:00 2001 From: Brian Lee Date: Mon, 9 Jan 2023 16:58:45 -0800 Subject: [PATCH] Pull SecureBox.java out into its own library. SecureBox is needed by Settings for encrypting device credential and was inaccessible from services/core/java/com/android/server. Create a new SecureBox library to resolve. Test: atest com.android.server.locksettings.recoverablekeystore SecureBoxTests Bug: 258505917 Change-Id: I65484edf12b04dfe1642cd0c97bc999d26430395 --- libs/securebox/Android.bp | 8 ++++ libs/securebox/OWNERS | 1 + .../src/com/android/security}/SecureBox.java | 16 +++++-- libs/securebox/tests/Android.bp | 46 +++++++++++++++++++ libs/securebox/tests/AndroidManifest.xml | 33 +++++++++++++ libs/securebox/tests/AndroidTest.xml | 31 +++++++++++++ .../com/android/security}/SecureBoxTest.java | 8 ++-- services/core/Android.bp | 1 + .../recoverablekeystore/KeySyncUtils.java | 1 + .../RecoverableKeyStoreManager.java | 1 + ...oteLockscreenValidationSessionStorage.java | 2 +- services/tests/servicestests/Android.bp | 1 + .../recoverablekeystore/KeySyncTaskTest.java | 1 + .../recoverablekeystore/KeySyncUtilsTest.java | 2 + .../RecoverableKeyStoreManagerTest.java | 1 + ...ockscreenValidationSessionStorageTest.java | 2 +- 16 files changed, 145 insertions(+), 10 deletions(-) create mode 100644 libs/securebox/Android.bp create mode 100644 libs/securebox/OWNERS rename {services/core/java/com/android/server/locksettings/recoverablekeystore => libs/securebox/src/com/android/security}/SecureBox.java (98%) create mode 100644 libs/securebox/tests/Android.bp create mode 100644 libs/securebox/tests/AndroidManifest.xml create mode 100644 libs/securebox/tests/AndroidTest.xml rename {services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore => libs/securebox/tests/src/com/android/security}/SecureBoxTest.java (99%) diff --git a/libs/securebox/Android.bp b/libs/securebox/Android.bp new file mode 100644 index 0000000000000..a29c03cfdcca1 --- /dev/null +++ b/libs/securebox/Android.bp @@ -0,0 +1,8 @@ +package { + default_applicable_licenses: ["frameworks_base_license"], +} + +java_library { + name: "securebox", + srcs: ["src/**/*.java"], +} diff --git a/libs/securebox/OWNERS b/libs/securebox/OWNERS new file mode 100644 index 0000000000000..e160799aa10d4 --- /dev/null +++ b/libs/securebox/OWNERS @@ -0,0 +1 @@ +include /services/core/java/com/android/server/locksettings/recoverablekeystore/OWNERS diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/SecureBox.java b/libs/securebox/src/com/android/security/SecureBox.java similarity index 98% rename from services/core/java/com/android/server/locksettings/recoverablekeystore/SecureBox.java rename to libs/securebox/src/com/android/security/SecureBox.java index 51a37b34e2cec..0ebaff4ac8e50 100644 --- a/services/core/java/com/android/server/locksettings/recoverablekeystore/SecureBox.java +++ b/libs/securebox/src/com/android/security/SecureBox.java @@ -14,11 +14,13 @@ * limitations under the License. */ -package com.android.server.locksettings.recoverablekeystore; +package com.android.security; import android.annotation.Nullable; + import com.android.internal.annotations.VisibleForTesting; import com.android.internal.util.ArrayUtils; + import java.math.BigInteger; import java.nio.BufferUnderflowException; import java.nio.ByteBuffer; @@ -41,6 +43,7 @@ import java.security.spec.ECPublicKeySpec; import java.security.spec.EllipticCurve; import java.security.spec.InvalidKeySpecException; import java.util.Arrays; + import javax.crypto.AEADBadTagException; import javax.crypto.BadPaddingException; import javax.crypto.Cipher; @@ -380,7 +383,7 @@ public class SecureBox { * @param publicKey The public key. * @return The key packed into a 65-byte array. */ - static byte[] encodePublicKey(PublicKey publicKey) { + public static byte[] encodePublicKey(PublicKey publicKey) { ECPoint point = ((ECPublicKey) publicKey).getW(); byte[] x = point.getAffineX().toByteArray(); byte[] y = point.getAffineY().toByteArray(); @@ -394,8 +397,13 @@ public class SecureBox { return output; } - @VisibleForTesting - static PublicKey decodePublicKey(byte[] keyBytes) + /** + * Decodes byte[] encoded public key. + * + * @param keyBytes encoded public key + * @return the public key + */ + public static PublicKey decodePublicKey(byte[] keyBytes) throws NoSuchAlgorithmException, InvalidKeyException { BigInteger x = new BigInteger( diff --git a/libs/securebox/tests/Android.bp b/libs/securebox/tests/Android.bp new file mode 100644 index 0000000000000..7df546ae0ff66 --- /dev/null +++ b/libs/securebox/tests/Android.bp @@ -0,0 +1,46 @@ +// Copyright (C) 2022 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package { + default_applicable_licenses: ["frameworks_base_license"], +} + +android_test { + name: "SecureBoxTests", + srcs: [ + "**/*.java", + ], + static_libs: [ + "securebox", + "androidx.test.runner", + "androidx.test.rules", + "androidx.test.ext.junit", + "frameworks-base-testutils", + "junit", + "mockito-target-extended-minus-junit4", + "platform-test-annotations", + "testables", + "testng", + "truth-prebuilt", + ], + libs: [ + "android.test.mock", + "android.test.base", + "android.test.runner", + ], + jni_libs: [ + "libdexmakerjvmtiagent", + "libstaticjvmtiagent", + ], +} diff --git a/libs/securebox/tests/AndroidManifest.xml b/libs/securebox/tests/AndroidManifest.xml new file mode 100644 index 0000000000000..3dc9563943621 --- /dev/null +++ b/libs/securebox/tests/AndroidManifest.xml @@ -0,0 +1,33 @@ + + + + + + + + + + + + + + diff --git a/libs/securebox/tests/AndroidTest.xml b/libs/securebox/tests/AndroidTest.xml new file mode 100644 index 0000000000000..54abd13515b4e --- /dev/null +++ b/libs/securebox/tests/AndroidTest.xml @@ -0,0 +1,31 @@ + + + + + + + diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/SecureBoxTest.java b/libs/securebox/tests/src/com/android/security/SecureBoxTest.java similarity index 99% rename from services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/SecureBoxTest.java rename to libs/securebox/tests/src/com/android/security/SecureBoxTest.java index 34235bd957424..b6e2365038dce 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/SecureBoxTest.java +++ b/libs/securebox/tests/src/com/android/security/SecureBoxTest.java @@ -1,5 +1,5 @@ /* - * Copyright (C) 2017 The Android Open Source Project + * Copyright (C) 2023 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -14,7 +14,7 @@ * limitations under the License. */ -package com.android.server.locksettings.recoverablekeystore; +package com.android.security; import static com.google.common.truth.Truth.assertThat; @@ -24,11 +24,11 @@ import static org.testng.Assert.expectThrows; import androidx.test.filters.SmallTest; import androidx.test.runner.AndroidJUnit4; +import com.android.internal.util.ArrayUtils; + import org.junit.Test; import org.junit.runner.RunWith; -import com.android.internal.util.ArrayUtils; - import java.math.BigInteger; import java.nio.charset.StandardCharsets; import java.security.InvalidKeyException; diff --git a/services/core/Android.bp b/services/core/Android.bp index c0bb5869ba642..f65ed3357b135 100644 --- a/services/core/Android.bp +++ b/services/core/Android.bp @@ -182,6 +182,7 @@ java_library_static { "SurfaceFlingerProperties", "com.android.sysprop.watchdog", "ImmutabilityAnnotation", + "securebox", ], javac_shard_size: 50, javacflags: [ diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/KeySyncUtils.java b/services/core/java/com/android/server/locksettings/recoverablekeystore/KeySyncUtils.java index 7921619977c7c..2818caabf9b02 100644 --- a/services/core/java/com/android/server/locksettings/recoverablekeystore/KeySyncUtils.java +++ b/services/core/java/com/android/server/locksettings/recoverablekeystore/KeySyncUtils.java @@ -21,6 +21,7 @@ import android.util.Pair; import com.android.internal.annotations.VisibleForTesting; import com.android.internal.util.ArrayUtils; +import com.android.security.SecureBox; import java.nio.ByteBuffer; import java.nio.ByteOrder; diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java b/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java index 7c80d8a54bca6..b437421b658a9 100644 --- a/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java +++ b/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java @@ -44,6 +44,7 @@ import android.util.Log; import com.android.internal.annotations.VisibleForTesting; import com.android.internal.util.HexDump; +import com.android.security.SecureBox; import com.android.server.locksettings.recoverablekeystore.certificate.CertParsingException; import com.android.server.locksettings.recoverablekeystore.certificate.CertUtils; import com.android.server.locksettings.recoverablekeystore.certificate.CertValidationException; diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorage.java b/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorage.java index b94548bee69e8..267a72e13e01e 100644 --- a/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorage.java +++ b/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorage.java @@ -23,7 +23,7 @@ import android.util.Log; import android.util.SparseArray; import com.android.internal.annotations.VisibleForTesting; -import com.android.server.locksettings.recoverablekeystore.SecureBox; +import com.android.security.SecureBox; import java.security.KeyPair; import java.security.NoSuchAlgorithmException; diff --git a/services/tests/servicestests/Android.bp b/services/tests/servicestests/Android.bp index ced2a4b82214a..3a7b9a49f1610 100644 --- a/services/tests/servicestests/Android.bp +++ b/services/tests/servicestests/Android.bp @@ -62,6 +62,7 @@ android_test { "junit-params", "ActivityContext", "coretests-aidl", + "securebox", ], libs: [ diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncTaskTest.java b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncTaskTest.java index ea5caa8656669..cc1100b1fd22f 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncTaskTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncTaskTest.java @@ -55,6 +55,7 @@ import androidx.test.filters.SmallTest; import androidx.test.runner.AndroidJUnit4; import com.android.internal.util.ArrayUtils; +import com.android.security.SecureBox; import com.android.server.locksettings.recoverablekeystore.storage.RecoverableKeyStoreDb; import com.android.server.locksettings.recoverablekeystore.storage.RecoverySnapshotStorage; diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncUtilsTest.java b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncUtilsTest.java index 19a606e002729..1cf44711d6f09 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncUtilsTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/KeySyncUtilsTest.java @@ -28,6 +28,8 @@ import androidx.test.filters.SmallTest; import androidx.test.runner.AndroidJUnit4; import com.android.internal.util.ArrayUtils; +import com.android.security.SecureBox; + import com.google.common.collect.ImmutableMap; import org.junit.Test; diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java index 1b983f0bfb1b6..bb79fd89982a3 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java @@ -60,6 +60,7 @@ import androidx.test.runner.AndroidJUnit4; import com.android.internal.util.ArrayUtils; import com.android.internal.widget.LockPatternUtils; +import com.android.security.SecureBox; import com.android.server.locksettings.recoverablekeystore.storage.ApplicationKeyStorage; import com.android.server.locksettings.recoverablekeystore.storage.CleanupManager; import com.android.server.locksettings.recoverablekeystore.storage.RecoverableKeyStoreDb; diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorageTest.java b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorageTest.java index a1cf1289e1fa2..05d30edbab83c 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorageTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/storage/RemoteLockscreenValidationSessionStorageTest.java @@ -23,7 +23,7 @@ import android.os.SystemClock; import androidx.test.filters.SmallTest; import androidx.test.runner.AndroidJUnit4; -import com.android.server.locksettings.recoverablekeystore.SecureBox; +import com.android.security.SecureBox; import org.junit.Before; import org.junit.Test;