From cdf4b2868a23edc18792ed2bf689aca38ee6ec82 Mon Sep 17 00:00:00 2001 From: Kevin Chyn Date: Fri, 24 Jul 2020 00:24:11 -0700 Subject: [PATCH] 3/n: Remove challenge from verifyCredential Decouples the remainder of challenges from LockSettingsService. Clients that require Gatekeeper HATs that wrap challenges should request the Gatekeeper Password, then request LockSettingsService to verify(GatekeeperPassword, Challenge). If the challenge is biometric-related, it must be generated after LockSettingsService completes verifyCredential, since LockSettingsService internally does generateChallenge/resetLockout/revokeChallenge. Bug: 161765592 Test: CtsVerifier biometric portion Test: Reset fingerprint/face lockout Test: atest com.android.server.locksettings Change-Id: Icb384194ce5007b264068e697113d55cbf94945b --- .../android/hardware/face/FaceManager.java | 6 +-- .../internal/widget/ILockSettings.aidl | 4 +- .../internal/widget/LockPatternChecker.java | 8 +--- .../internal/widget/LockPatternUtils.java | 15 +++--- .../AuthCredentialPasswordView.java | 6 ++- .../biometrics/AuthCredentialPatternView.java | 6 ++- .../biometrics/AuthCredentialView.java | 9 +++- .../locksettings/LockSettingsService.java | 33 +++++-------- .../LockSettingsServiceTests.java | 21 ++++---- .../locksettings/LockscreenFrpTest.java | 21 +++++--- .../locksettings/SyntheticPasswordTests.java | 48 ++++++++----------- 11 files changed, 87 insertions(+), 90 deletions(-) diff --git a/core/java/android/hardware/face/FaceManager.java b/core/java/android/hardware/face/FaceManager.java index 885d137dd2fe3..19cb13c7e1148 100644 --- a/core/java/android/hardware/face/FaceManager.java +++ b/core/java/android/hardware/face/FaceManager.java @@ -1073,12 +1073,12 @@ public class FaceManager implements BiometricAuthenticator, BiometricFaceConstan /** * @hide */ - public abstract static class GenerateChallengeCallback { - public abstract void onGenerateChallengeResult(long challenge); + public interface GenerateChallengeCallback { + void onGenerateChallengeResult(long challenge); } private abstract static class InternalGenerateChallengeCallback - extends GenerateChallengeCallback {} + implements GenerateChallengeCallback {} private class OnEnrollCancelListener implements OnCancelListener { @Override diff --git a/core/java/com/android/internal/widget/ILockSettings.aidl b/core/java/com/android/internal/widget/ILockSettings.aidl index a5a42e1afcdc4..d5d635de81d84 100644 --- a/core/java/com/android/internal/widget/ILockSettings.aidl +++ b/core/java/com/android/internal/widget/ILockSettings.aidl @@ -47,8 +47,8 @@ interface ILockSettings { void resetKeyStore(int userId); VerifyCredentialResponse checkCredential(in LockscreenCredential credential, int userId, in ICheckCredentialProgressCallback progressCallback); - VerifyCredentialResponse verifyCredential(in LockscreenCredential credential, long challenge, int userId, int flags); - VerifyCredentialResponse verifyTiedProfileChallenge(in LockscreenCredential credential, long challenge, int userId, int flags); + VerifyCredentialResponse verifyCredential(in LockscreenCredential credential, int userId, int flags); + VerifyCredentialResponse verifyTiedProfileChallenge(in LockscreenCredential credential, int userId, int flags); VerifyCredentialResponse verifyGatekeeperPassword(in byte[] gatekeeperPassword, long challenge, int userId); boolean checkVoldPassword(int userId); int getCredentialType(int userId); diff --git a/core/java/com/android/internal/widget/LockPatternChecker.java b/core/java/com/android/internal/widget/LockPatternChecker.java index a71ca8734e75d..5adbc583140fe 100644 --- a/core/java/com/android/internal/widget/LockPatternChecker.java +++ b/core/java/com/android/internal/widget/LockPatternChecker.java @@ -54,14 +54,12 @@ public final class LockPatternChecker { * * @param utils The LockPatternUtils instance to use. * @param credential The credential to check. - * @param challenge The challenge to verify against the credential. * @param userId The user to check against the credential. * @param flags See {@link LockPatternUtils.VerifyFlag} * @param callback The callback to be invoked with the verification result. */ public static AsyncTask verifyCredential(final LockPatternUtils utils, final LockscreenCredential credential, - final long challenge, final int userId, final @LockPatternUtils.VerifyFlag int flags, final OnVerifyCallback callback) { @@ -71,7 +69,7 @@ public final class LockPatternChecker { new AsyncTask() { @Override protected VerifyCredentialResponse doInBackground(Void... args) { - return utils.verifyCredential(credentialCopy, challenge, userId, flags); + return utils.verifyCredential(credentialCopy, userId, flags); } @Override @@ -138,14 +136,12 @@ public final class LockPatternChecker { * * @param utils The LockPatternUtils instance to use. * @param credential The credential to check. - * @param challenge The challenge to verify against the credential. * @param userId The user to check against the credential. * @param flags See {@link LockPatternUtils.VerifyFlag} * @param callback The callback to be invoked with the verification result. */ public static AsyncTask verifyTiedProfileChallenge(final LockPatternUtils utils, final LockscreenCredential credential, - final long challenge, final int userId, final @LockPatternUtils.VerifyFlag int flags, final OnVerifyCallback callback) { @@ -155,7 +151,7 @@ public final class LockPatternChecker { new AsyncTask() { @Override protected VerifyCredentialResponse doInBackground(Void... args) { - return utils.verifyTiedProfileChallenge(credentialCopy, challenge, userId, flags); + return utils.verifyTiedProfileChallenge(credentialCopy, userId, flags); } @Override diff --git a/core/java/com/android/internal/widget/LockPatternUtils.java b/core/java/com/android/internal/widget/LockPatternUtils.java index 206227344b963..f7370d6a22f97 100644 --- a/core/java/com/android/internal/widget/LockPatternUtils.java +++ b/core/java/com/android/internal/widget/LockPatternUtils.java @@ -386,18 +386,17 @@ public class LockPatternUtils { * If credential matches, return an opaque attestation that the challenge was verified. * * @param credential The credential to check. - * @param challenge The challenge to verify against the credential * @param userId The user whose credential is being verified * @param flags See {@link VerifyFlag} * @throws IllegalStateException if called on the main thread. */ @NonNull public VerifyCredentialResponse verifyCredential(@NonNull LockscreenCredential credential, - long challenge, int userId, @VerifyFlag int flags) { + int userId, @VerifyFlag int flags) { throwIfCalledOnMainThread(); try { final VerifyCredentialResponse response = getLockSettings().verifyCredential( - credential, challenge, userId, flags); + credential, userId, flags); if (response == null) { return VerifyCredentialResponse.ERROR; } else { @@ -411,8 +410,8 @@ public class LockPatternUtils { /** * With the Gatekeeper Password returned via {@link #verifyCredential(LockscreenCredential, - * long, int, boolean)}, request Gatekeeper to create a HardwareAuthToken wrapping the - * given challenge. + * int, int)}, request Gatekeeper to create a HardwareAuthToken wrapping the given + * challenge. */ @NonNull public VerifyCredentialResponse verifyGatekeeperPassword(@NonNull byte[] gatekeeperPassword, @@ -470,7 +469,6 @@ public class LockPatternUtils { * verified. * * @param credential The parent user's credential to check. - * @param challenge The challenge to verify against the credential * @return the attestation that the challenge was verified, or null * @param userId The managed profile user id * @param flags See {@link VerifyFlag} @@ -478,12 +476,11 @@ public class LockPatternUtils { */ @NonNull public VerifyCredentialResponse verifyTiedProfileChallenge( - @NonNull LockscreenCredential credential, - long challenge, int userId, @VerifyFlag int flags) { + @NonNull LockscreenCredential credential, int userId, @VerifyFlag int flags) { throwIfCalledOnMainThread(); try { final VerifyCredentialResponse response = getLockSettings() - .verifyTiedProfileChallenge(credential, challenge, userId, flags); + .verifyTiedProfileChallenge(credential, userId, flags); if (response == null) { return VerifyCredentialResponse.ERROR; } else { diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java index fe20d894274f2..d4e6506bd9a0d 100644 --- a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java +++ b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java @@ -28,6 +28,7 @@ import android.widget.ImeAwareEditText; import android.widget.TextView; import com.android.internal.widget.LockPatternChecker; +import com.android.internal.widget.LockPatternUtils; import com.android.internal.widget.LockscreenCredential; import com.android.internal.widget.VerifyCredentialResponse; import com.android.systemui.R; @@ -106,8 +107,11 @@ public class AuthCredentialPasswordView extends AuthCredentialView return; } + // Request LockSettingsService to return the Gatekeeper Password in the + // VerifyCredentialResponse so that we can request a Gatekeeper HAT with the + // Gatekeeper Password and operationId. mPendingLockCheck = LockPatternChecker.verifyCredential(mLockPatternUtils, - password, mOperationId, mEffectiveUserId, 0 /* flags */, + password, mEffectiveUserId, LockPatternUtils.VERIFY_FLAG_RETURN_GK_PW, this::onCredentialVerified); } } diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java index 0573ef0067dbe..ad89ae82f6376 100644 --- a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java +++ b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java @@ -68,12 +68,14 @@ public class AuthCredentialPatternView extends AuthCredentialView { } try (LockscreenCredential credential = LockscreenCredential.createPattern(pattern)) { + // Request LockSettingsService to return the Gatekeeper Password in the + // VerifyCredentialResponse so that we can request a Gatekeeper HAT with the + // Gatekeeper Password and operationId. mPendingLockCheck = LockPatternChecker.verifyCredential( mLockPatternUtils, credential, - mOperationId, mEffectiveUserId, - 0 /* flags */, + LockPatternUtils.VERIFY_FLAG_RETURN_GK_PW, this::onPatternVerified); } } diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java index 101474be0ea8a..a8f6f85201f6f 100644 --- a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java +++ b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java @@ -288,7 +288,14 @@ public abstract class AuthCredentialView extends LinearLayout { if (response.isMatched()) { mClearErrorRunnable.run(); mLockPatternUtils.userPresent(mEffectiveUserId); - mCallback.onCredentialMatched(response.getGatekeeperHAT()); + + // The response passed into this method contains the Gatekeeper Password. We still + // have to request Gatekeeper to create a Hardware Auth Token with the + // Gatekeeper Password and Challenge (keystore operationId in this case) + final VerifyCredentialResponse gkResponse = mLockPatternUtils.verifyGatekeeperPassword( + response.getGatekeeperPw(), mOperationId, mEffectiveUserId); + + mCallback.onCredentialMatched(gkResponse.getGatekeeperHAT()); } else { if (timeoutMs > 0) { mHandler.removeCallbacks(mClearErrorRunnable); diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java index 127d5cc390370..d6e37bacdba8a 100644 --- a/services/core/java/com/android/server/locksettings/LockSettingsService.java +++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java @@ -187,6 +187,9 @@ public class LockSettingsService extends ILockSettings.Stub { private static final String SYNTHETIC_PASSWORD_UPDATE_TIME_KEY = "sp-handle-ts"; private static final String USER_SERIAL_NUMBER_KEY = "serial-number"; + // TODO (b/145978626) LockSettingsService no longer accepts challenges in the verifyCredential + // paths. These are temporarily left around to ensure that resetLockout works. It will be + // removed once resetLockout is compartmentalized. // No challenge provided private static final int CHALLENGE_NONE = 0; // Challenge was provided from the external caller (non-LockSettingsService) @@ -1609,8 +1612,8 @@ public class LockSettingsService extends ILockSettings.Stub { // Verify the parent credential again, to make sure we have a fresh enough // auth token such that getDecryptedPasswordForTiedProfile() inside // setLockCredentialInternal() can function correctly. - verifyCredential(savedCredential, /* challenge */ 0, - mUserManager.getProfileParent(userId).id, 0 /* flags */); + verifyCredential(savedCredential, mUserManager.getProfileParent(userId).id, + 0 /* flags */); savedCredential.zeroize(); savedCredential = LockscreenCredential.createNone(); } @@ -1969,7 +1972,7 @@ public class LockSettingsService extends ILockSettings.Stub { ICheckCredentialProgressCallback progressCallback) { checkPasswordReadPermission(userId); try { - return doVerifyCredential(credential, CHALLENGE_NONE, 0, userId, progressCallback, + return doVerifyCredential(credential, CHALLENGE_NONE, 0L, userId, progressCallback, 0 /* flags */); } finally { scheduleGc(); @@ -1979,21 +1982,11 @@ public class LockSettingsService extends ILockSettings.Stub { @Override @Nullable public VerifyCredentialResponse verifyCredential(LockscreenCredential credential, - long challenge, int userId, @LockPatternUtils.VerifyFlag int flags) { + int userId, int flags) { checkPasswordReadPermission(userId); - @ChallengeType int challengeType = CHALLENGE_FROM_CALLER; - if (challenge == 0) { - Slog.w(TAG, "VerifyCredential called with challenge=0"); - challengeType = CHALLENGE_NONE; - } - if (challenge != 0 && ((flags & VERIFY_FLAG_RETURN_GK_PW) != 0)) { - // Caller requests Gatekeeper Password to be returned. Challenge is a no-op here, since - // its only used when Gatekeeper verifies the SP. - Slog.w(TAG, "Challenge will not be used"); - } try { - return doVerifyCredential(credential, challengeType, challenge, userId, + return doVerifyCredential(credential, CHALLENGE_NONE, 0L, userId, null /* progressCallback */, flags); } finally { scheduleGc(); @@ -2083,7 +2076,7 @@ public class LockSettingsService extends ILockSettings.Stub { @Override public VerifyCredentialResponse verifyTiedProfileChallenge(LockscreenCredential credential, - long challenge, int userId, @LockPatternUtils.VerifyFlag int flags) { + int userId, @LockPatternUtils.VerifyFlag int flags) { checkPasswordReadPermission(userId); if (!isManagedProfileWithUnifiedLock(userId)) { throw new IllegalArgumentException("User id must be managed profile with unified lock"); @@ -2092,8 +2085,8 @@ public class LockSettingsService extends ILockSettings.Stub { // Unlock parent by using parent's challenge final VerifyCredentialResponse parentResponse = doVerifyCredential( credential, - CHALLENGE_FROM_CALLER, - challenge, + CHALLENGE_NONE, + 0L, parentProfileId, null /* progressCallback */, flags); @@ -2105,8 +2098,8 @@ public class LockSettingsService extends ILockSettings.Stub { try { // Unlock work profile, and work profile with unified lock must use password only return doVerifyCredential(getDecryptedPasswordForTiedProfile(userId), - CHALLENGE_FROM_CALLER, - challenge, + CHALLENGE_NONE, + 0L, userId, null /* progressCallback */, flags); } catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException diff --git a/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java b/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java index 12b144f2b7789..1f66c7c02658b 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java @@ -129,7 +129,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { mGateKeeperService.clearAuthToken(TURNED_OFF_PROFILE_USER_ID); // verify credential assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - firstUnifiedPassword, 0, PRIMARY_USER_ID) + firstUnifiedPassword, PRIMARY_USER_ID, 0 /* flags */) .getResponseCode()); // Verify that we have a new auth token for the profile @@ -186,13 +186,13 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { mGateKeeperService.clearAuthToken(MANAGED_PROFILE_USER_ID); // verify primary credential assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - primaryPassword, 0, PRIMARY_USER_ID) + primaryPassword, PRIMARY_USER_ID, 0 /* flags */) .getResponseCode()); assertNull(mGateKeeperService.getAuthToken(MANAGED_PROFILE_USER_ID)); // verify profile credential assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - profilePassword, 0, MANAGED_PROFILE_USER_ID) + profilePassword, MANAGED_PROFILE_USER_ID, 0 /* flags */) .getResponseCode()); assertNotNull(mGateKeeperService.getAuthToken(MANAGED_PROFILE_USER_ID)); assertEquals(profileSid, mGateKeeperService.getSecureUserId(MANAGED_PROFILE_USER_ID)); @@ -203,7 +203,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { newPassword("pwd"), primaryPassword, PRIMARY_USER_ID)); mStorageManager.setIgnoreBadUnlock(false); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - profilePassword, 0, MANAGED_PROFILE_USER_ID) + profilePassword, MANAGED_PROFILE_USER_ID, 0 /* flags */) .getResponseCode()); assertEquals(profileSid, mGateKeeperService.getSecureUserId(MANAGED_PROFILE_USER_ID)); } @@ -389,7 +389,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { initializeStorageWithCredential(PRIMARY_USER_ID, password, 1234); reset(mRecoverableKeyStoreManager); - mService.verifyCredential(password, 1, PRIMARY_USER_ID); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */); verify(mRecoverableKeyStoreManager) .lockScreenSecretAvailable( @@ -406,7 +406,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { MANAGED_PROFILE_USER_ID)); reset(mRecoverableKeyStoreManager); - mService.verifyCredential(pattern, 1, MANAGED_PROFILE_USER_ID); + mService.verifyCredential(pattern, MANAGED_PROFILE_USER_ID, 0 /* flags */); verify(mRecoverableKeyStoreManager) .lockScreenSecretAvailable( @@ -421,7 +421,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { mService.setSeparateProfileChallengeEnabled(MANAGED_PROFILE_USER_ID, false, null); reset(mRecoverableKeyStoreManager); - mService.verifyCredential(pattern, 1, PRIMARY_USER_ID); + mService.verifyCredential(pattern, PRIMARY_USER_ID, 0 /* flags */); // Parent sends its credentials for both the parent and profile. verify(mRecoverableKeyStoreManager) @@ -484,9 +484,8 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { private void assertVerifyCredentials(int userId, LockscreenCredential credential, long sid) throws RemoteException{ - final long challenge = 54321; - VerifyCredentialResponse response = mService.verifyCredential(credential, - challenge, userId); + VerifyCredentialResponse response = mService.verifyCredential(credential, userId, + 0 /* flags */); assertEquals(GateKeeperResponse.RESPONSE_OK, response.getResponseCode()); if (sid != -1) assertEquals(sid, mGateKeeperService.getSecureUserId(userId)); @@ -508,7 +507,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { badCredential = LockscreenCredential.createPin("0"); } assertEquals(GateKeeperResponse.RESPONSE_ERROR, mService.verifyCredential( - badCredential, challenge, userId).getResponseCode()); + badCredential, userId, 0 /* flags */).getResponseCode()); } private void initializeStorageWithCredential(int userId, LockscreenCredential credential, diff --git a/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java b/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java index 4b3f7b5d08ef6..9c0239b2b6a6e 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java @@ -52,7 +52,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PIN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -61,7 +62,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PATTERN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPattern("4321"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPattern("4321"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -70,7 +72,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PASSWORD, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPassword("4321"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPassword("4321"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -80,7 +83,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PATTERN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPattern("5678"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPattern("5678"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -98,7 +102,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { mSettings.setDeviceProvisioned(true); assertEquals(VerifyCredentialResponse.RESPONSE_ERROR, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -113,7 +118,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PIN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @@ -129,6 +135,7 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PASSWORD, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } } diff --git a/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java b/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java index ba851992cbad9..2bd0e55f7d21b 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java @@ -119,8 +119,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { long sid = mGateKeeperService.getSecureUserId(PRIMARY_USER_ID); mService.setLockCredential(newPassword, password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - newPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + newPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertEquals(sid, mGateKeeperService.getSecureUserId(PRIMARY_USER_ID)); } @@ -131,12 +130,10 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertEquals(VerifyCredentialResponse.RESPONSE_ERROR, mService.verifyCredential( - badPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); } @Test @@ -153,8 +150,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { // set a new password mService.setLockCredential(badPassword, nonePassword(), PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - badPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertNotEquals(sid, mGateKeeperService.getSecureUserId(PRIMARY_USER_ID)); } @@ -166,8 +162,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); mService.setLockCredential(badPassword, password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - badPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); // Check the same secret was passed each time ArgumentCaptor> secret = ArgumentCaptor.forClass(ArrayList.class); @@ -183,8 +178,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); reset(mAuthSecretService); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); verify(mAuthSecretService).primaryUserCredential(any(ArrayList.class)); } @@ -194,8 +188,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, SECONDARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, SECONDARY_USER_ID) - .getResponseCode()); + password, SECONDARY_USER_ID, 0 /* flags */).getResponseCode()); verify(mAuthSecretService, never()).primaryUserCredential(any(ArrayList.class)); } @@ -246,7 +239,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); assertTrue(mService.hasPendingEscrowToken(PRIMARY_USER_ID)); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); assertFalse(mService.hasPendingEscrowToken(PRIMARY_USER_ID)); @@ -259,8 +253,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { verify(mDevicePolicyManager).reportPasswordChanged(PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - pattern, 0, PRIMARY_USER_ID) - .getResponseCode()); + pattern, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID)); } @@ -275,7 +268,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null); assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); mLocalService.setLockCredentialWithToken(nonePassword(), handle, token, PRIMARY_USER_ID); @@ -284,8 +278,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - pattern, 0, PRIMARY_USER_ID) - .getResponseCode()); + pattern, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID)); } @@ -301,7 +294,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null); assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); mService.setLockCredential(pattern, password, PRIMARY_USER_ID); @@ -309,8 +303,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { mLocalService.setLockCredentialWithToken(newPassword, handle, token, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - newPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + newPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID)); } @@ -357,8 +350,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); // Activate token (password gets migrated to SP at the same time) assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); // Verify token is activated assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); } @@ -488,8 +480,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); verify(mAuthSecretService, never()).primaryUserCredential(any(ArrayList.class)); } @@ -503,7 +494,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { reset(mDevicePolicyManager); long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); mService.onCleanupUser(PRIMARY_USER_ID);