Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Ensure key generation retries after remote key provisioning"

Browse Source
This commit is contained in:
Seth Moore
2022-05-17 15:37:24 +00:00
committed by Gerrit Code Review
parent 92ce74409b b51dd03878
commit bf73616e23
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java
View File

@@ -712,7 +712,7 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
case KeymasterDefs.KM_ERROR_HARDWARE_TYPE_UNAVAILABLE: case KeymasterDefs.KM_ERROR_HARDWARE_TYPE_UNAVAILABLE:
throw new StrongBoxUnavailableException("Failed to generated key pair.", e); throw new StrongBoxUnavailableException("Failed to generated key pair.", e);
case ResponseCode.OUT_OF_KEYS: case ResponseCode.OUT_OF_KEYS:
throw makeOutOfKeysException(e, securityLevel); return checkIfRetryableOrThrow(e, securityLevel);
default: default:
ProviderException p = new ProviderException("Failed to generate key pair.", e); ProviderException p = new ProviderException("Failed to generate key pair.", e);
if ((mSpec.getPurposes() & KeyProperties.PURPOSE_WRAP_KEY) != 0) { if ((mSpec.getPurposes() & KeyProperties.PURPOSE_WRAP_KEY) != 0) {
@@ -740,7 +740,7 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
// In case keystore reports OUT_OF_KEYS, call this handler in an attempt to remotely provision // In case keystore reports OUT_OF_KEYS, call this handler in an attempt to remotely provision
// some keys. // some keys.
private ProviderException makeOutOfKeysException(KeyStoreException e, int securityLevel) { GenerateKeyPairHelperResult checkIfRetryableOrThrow(KeyStoreException e, int securityLevel) {
GenerateRkpKey keyGen = new GenerateRkpKey(ActivityThread GenerateRkpKey keyGen = new GenerateRkpKey(ActivityThread
.currentApplication()); .currentApplication());
KeyStoreException ksException; KeyStoreException ksException;
@@ -757,8 +757,11 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
rkpStatus = KeyStoreException.RKP_SERVER_REFUSED_ISSUANCE; rkpStatus = KeyStoreException.RKP_SERVER_REFUSED_ISSUANCE;
break; break;
case IGenerateRkpKeyService.Status.OK: case IGenerateRkpKeyService.Status.OK:
// This will actually retry once immediately, so on "OK" go ahead and return // Explicitly return not-OK here so we retry in generateKeyPair. All other cases
// "temporarily unavailable". @see generateKeyPair // should throw because a retry doesn't make sense if we didn't actually
// provision fresh keys.
return new GenerateKeyPairHelperResult(
KeyStoreException.RKP_TEMPORARILY_UNAVAILABLE, null);
case IGenerateRkpKeyService.Status.NETWORK_COMMUNICATION_ERROR: case IGenerateRkpKeyService.Status.NETWORK_COMMUNICATION_ERROR:
case IGenerateRkpKeyService.Status.HTTP_CLIENT_ERROR: case IGenerateRkpKeyService.Status.HTTP_CLIENT_ERROR:
case IGenerateRkpKeyService.Status.HTTP_SERVER_ERROR: case IGenerateRkpKeyService.Status.HTTP_SERVER_ERROR:
@@ -781,7 +784,7 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
KeyStoreException.RKP_TEMPORARILY_UNAVAILABLE); KeyStoreException.RKP_TEMPORARILY_UNAVAILABLE);
} }
ksException.initCause(e); ksException.initCause(e);
return new ProviderException("Failed to talk to RemoteProvisioner", ksException); throw new ProviderException("Failed to provision new attestation keys.", ksException);
} }
private void addAttestationParameters(@NonNull List<KeyParameter> params) private void addAttestationParameters(@NonNull List<KeyParameter> params)