Commit Graph

360 Commits

Author SHA1 Message Date
Chad Brubaker
8bfbc6e710 Add nsconfig support for WFA CAs
Bug: 78643773
Test: manually verified
Change-Id: Ib7d2b24669074b74bbda7ab7163ef25584e95a11
2018-04-26 19:33:06 +00:00
Dmitry Dementyev
745d2c98f9 Remove implementation of deprecated RecoveryController methods.
Bug: 78021839
Test: manual
Change-Id: I8a8a23f1cc14e7b9ffe1e758b6f35906d1a5cf2f
2018-04-14 13:37:07 -07:00
Jeff Sharkey
3990ee1c9f Clean up APIs before declaring API 28.
As part of finalizing an SDK, we need to ensure that no new APIs are
marked @Deprecated, since they're typically cleanup that someone
forgot to finish.

Someone forgot to replace Slice.getTimestamp() with Slice.getLong().

Bug: 77588754
Test: builds, boots
Exempt-From-Owner-Approval: SDK finalization
Change-Id: Ic0ec91a43d161a69c1e840c42046ad500b7aeca0
2018-04-11 13:49:21 -06:00
Bo Zhu
b95c90ce2d Add an API to check whether the recoverable keystore is enabled
Bug: 77690455
Test: It builds
Change-Id: I94be0e341d8a3e0fa9a5f9af8beda60e08a449e8
2018-04-10 14:50:21 -07:00
TreeHugger Robot
4147a83ae5 Merge "Revert "Remove deprecated RecoveryController API."" into pi-dev 2018-04-06 12:28:09 +00:00
Robert Berry
c157e21249 Revert "Remove deprecated RecoveryController API."
This reverts commit 0d55aa387a.

Reason for revert: aps_sidecar binary is still using some of these @removed APIs. Although HEAD of auth_folsom is fixed, aps_sidecar burned in framework is old.

Bug: 77629807
Change-Id: I2f03c7d12de30cc2eebd91bb65646caaa00fcd1d
2018-04-06 10:30:44 +00:00
TreeHugger Robot
ae938f5437 Merge "ConfirmationPrompt: Update for API review." into pi-dev 2018-04-05 18:50:35 +00:00
Dmitry Dementyev
654598b542 Merge "Remove deprecated recoverable keystore classes." into pi-dev 2018-04-04 17:42:11 +00:00
Dmitry Dementyev
ce70473a89 Merge "Remove deprecated RecoveryController API." into pi-dev 2018-04-04 17:41:51 +00:00
David Zeuthen
1870e2dec4 ConfirmationPrompt: Update for API review.
Misc. changes but notably the ConfirmationDialog class was renamed to
ConfirmationPrompt.

Manually tested by updating sample Android Confirmations application
to use updated API.

Bug: 77242268
Test: Manually tested.
Change-Id: I1caa3c6bff9486b43ba111329d1ef83c3b67baf9
2018-04-04 10:00:42 -04:00
Aseem Kumar
23174b7eae Throw ServiceSpecificException if calling app tries to initialize
certificates with lower version. Earlier, the code just returned
silently, giving no indication that updating certs failed.

Change-Id: I3eb1b9f423791a655b47b3e76c20a170e2b632c0
Bug: 77533356
Test: runtest frameworks-services -p
    com.android.server.locksettings.recoverablekeystore
2018-04-03 12:15:11 -07:00
Dmitry Dementyev
80def87389 Remove deprecated recoverable keystore classes.
RecoveryController and related Parcelables were moved to a different package long time ago. Only very old recvoery controller implementations used it.

Bug: 74944591
Test: atest RecoveryControllerHostTest
Change-Id: I803b7d8a813f7e6c3606dc77afb2e0a3d916ec3f
2018-04-02 18:57:37 -07:00
TreeHugger Robot
41d6d7c424 Merge "Revert "Throw invalid cert exception when deprecated initRecoveryService method"" into pi-dev 2018-04-03 01:55:30 +00:00
Dmitry Dementyev
0d55aa387a Remove deprecated RecoveryController API.
1) Mark all deprecated methods as removed.

Bug: 74944591
Test: atest RecoveryControllerHostTest
Change-Id: I2dd88d2ba0b9fb254327ee85b9d983ab10eb061b
2018-04-02 18:35:08 -07:00
Bo Zhu
1364455fd7 Merge "Expose the JNI scrypt function in a standalone Java class so we can use it in RecoverableKeyStore as well" into pi-dev 2018-04-03 00:28:43 +00:00
Dmitry Dementyev
0f23660488 Revert "Throw invalid cert exception when deprecated initRecoveryService method"
This reverts commit 50bc7e42d7.

Reason for revert: API is still used by old binary

Change-Id: I3c8348211baa26245786abda6360a8df96e2d223
Bug: 77293264
2018-04-03 00:19:27 +00:00
Bo Zhu
09856135e3 Expose the JNI scrypt function in a standalone Java class so we can
use it in RecoverableKeyStore as well

Bug: 77325751
Test: It builds. No caller code yet.

Change-Id: I6ff847cff2efbd023612e51fe35be980f27f162d
2018-04-02 15:47:08 -07:00
Dmitry Dementyev
bf08774704 Merge "Throw invalid cert exception when deprecated initRecoveryService method is used." into pi-dev 2018-04-01 19:34:31 +00:00
Bo Zhu
0b8c82e660 Throw an exception if the given root alias is unknown
Bug: 76433465
Test: runtest frameworks-services -p
com.android.server.locksettings.recoverablekeystore

Change-Id: I3a213ab0cd3b0e9c002bc44d4ce929977e119e81
2018-03-31 21:35:28 -07:00
Dmitry Dementyev
50bc7e42d7 Throw invalid cert exception when deprecated initRecoveryService method
is used.

Throw unsupported operation exception when older version of RecoveryController is used.

Bug: 77293264
Test: atest RecoveryControllerHostTest
Change-Id: I0003104a4305444fac0092f4f6929545cf7c9413
2018-03-31 00:49:23 -07:00
Bo Zhu
41d2dd2f26 Expose e.getMessage() from the exceptions in RecoverableKeyStore
Bug: 77327780
Test: runtest frameworks-services -p \
      com.android.server.locksettings.recoverablekeystore

Change-Id: Ibf04d6405e6468bfdfef0a8cb8e6e96bffbbf3a2
2018-03-30 13:14:29 -07:00
Dmitry Dementyev
912853be10 Merge "Remove deprecated generateAndStoreKey method implementation" into pi-dev 2018-03-30 16:44:53 +00:00
Brian Young
0186b42f2a Merge changes from topics "niap-asym-write-pi-dev", "niap-asym-write-api-pi-dev" into pi-dev
* changes:
  Restore "Add "Unlocked device required" parameter to keys"
  Add "Unlocked device required" key API
2018-03-30 14:21:19 +00:00
Robert Berry
d490937854 Merge "Update RecoveryController JavaDoc" into pi-dev 2018-03-30 10:37:41 +00:00
Robert Berry
93f38d7b3a Update RecoveryController JavaDoc
Try to encode as many requirements as possible into the Recovery Agent
JavaDoc.

Bug: 70900575
Test: None, it is documentation
Change-Id: Iae05be24fa29d885f560943f256fd8d7ca692cf7
2018-03-30 11:35:06 +01:00
Dmitry Dementyev
86f5bb1a8c Remove deprecated generateAndStoreKey method implementation
Bug: 77156834
Test: GTS, apct.
Change-Id: I23791fced21308467afc60cc16efc4aee7074134
2018-03-30 05:58:11 +00:00
Bo Zhu
3cda0f2989 Merge "Minor correction to the javadoc to match implementation" into pi-dev 2018-03-30 00:04:46 +00:00
Bo Zhu
ba94b9ab00 Minor correction to the javadoc to match implementation
Change the number of bytes for the length prefix for salted hash to be
4-byte instead of 1-byte

Bug: 77294103
Test: None
Change-Id: Ifa2739c757539e9b7d2aaa1ea702de0148a311ba
2018-03-29 16:42:29 -07:00
Dmitry Dementyev
57ca3da24f Add support for testing mode root certificate.
1) Add Certificate
2) Helper class for end-to-end tests
3) Only create snapshot for passwords with special prefix in test mode
4) Sync only keys with insecure prefix in test mode.

Bug: 76433465
Test: adb shell am instrument -w -e package
com.android.server.locksettings.recoverablekeystore
com.android.frameworks.servicestests/android.support.test.runner.AndroidJUnitRunner

Change-Id: I6edc8c4716c3a034b6b79c7aa6f4b8478e9a3c9e
2018-03-29 14:18:42 -07:00
Robert Berry
52c15f1699 Add warning comment about serialization
As it's important we do not break serialization of KeyChainSnapshot
(as it could fail in weird and mysterious ways if we did), add
comments warning anybody editing those files to also update the
serializer and deserializer, as well as appropriate tests.

Test: none, just adding comments
Bug: 73921897
Change-Id: If73162b8fb2a0b44fd954b72c9030cd9e042282b
2018-03-29 10:21:50 +01:00
Brian Young
36716eb470 Add "Unlocked device required" key API
This adds the API methods and values for keyguard-bound keys, but
contains none of the actual functionality.

Test: CTS tests in CtsKeystoreTestCases

Bug: 67752510

Merged-In: Iccd7dafd77258d903d11353e02ba3ab956050c40
Change-Id: Iccd7dafd77258d903d11353e02ba3ab956050c40
(cherry picked from commit fd75c7232a)
2018-03-28 08:38:56 -07:00
Dmitry Dementyev
16d9db57f5 Use Builder instead for KeyChainProtectionParams.
Use Builder to create KeyChainSnapshot it tests.
Bug: 75952916
Test: apct
Change-Id: I5ab8c864a7ccc55dafa40867ec4364a705738d86
2018-03-26 12:03:51 -07:00
Dmitry Dementyev
a5b29ffffe Merge "Remove unimplemented RecoverableKeystoreManager APIs." into pi-dev 2018-03-26 02:18:33 +00:00
Dmitry Dementyev
0bbaf189c2 Add more NonNull annotations to RecoveryController API
Bug: 73959762
Test: none
Change-Id: I648c20a099d4ac1c002f4f467d7189a8bc019560
2018-03-23 17:36:58 -07:00
Dmitry Dementyev
9cd3e43d86 Merge "Add NonNull annotation to more parameters in Recovery Controller." into pi-dev 2018-03-24 00:10:30 +00:00
Dmitry Dementyev
4da14e00fc Remove unimplemented RecoverableKeystoreManager APIs.
Add some Nullable annotations.

Bug: 75952916,74859770
Test: apct
Change-Id: I25710263a1ba806d49ec11638dab00f3513631a8
2018-03-23 16:30:51 -07:00
Dmitry Dementyev
fd4ae0b2dd Add NonNull annotation to more parameters in Recovery Controller.
Use Builder instead of deprecated constructor for KeyDerivationParams.
Bug: 75952916
Test: adb shell am instrument \
-w -e package com.android.server.locksettings.recoverablekeystore \
com.android.frameworks.servicestests/android.support.test.runner.AndroidJUnitRunner
Change-Id: I223e4dc1aa92cbde60e53b364ed74a452d3f6bbd
2018-03-23 15:04:37 -07:00
TreeHugger Robot
73b7722c13 Merge "Do not throw KeystoreException for when a key does not exist" into pi-dev 2018-03-23 20:03:45 +00:00
Dmitry Dementyev
95f2965a74 Merge "Prepare KeyChainSnapshot to removing deprecated getTrustedHardwarePublicKey method." into pi-dev 2018-03-23 17:16:17 +00:00
Dmitry Dementyev
364dbf1c9e Merge "Update RecoverableKeyStoreManager methods to throw NullPointerException when null is passed as @NonNull argument." into pi-dev 2018-03-23 17:06:18 +00:00
Bo Zhu
9ec7026e92 Merge "Unhide the enum/function for the password hashing algorithm scrypt" into pi-dev 2018-03-23 15:25:36 +00:00
Robert Berry
72f5755721 Do not throw KeystoreException for when a key does not exist
Bug: 75955240
Test: manual
Change-Id: Ibd2f4d7cd654752b69d2d22e803d4d1cc05c118f
2018-03-23 08:08:02 +00:00
Aseem Kumar
933dfc1cd6 Delete unimplemented APIs from RecoveryController.
Bug: 74859770
Test: make update-api builds
Change-Id: Ic547e0ee2ef13995389a71369ffa736a7d83b78a
2018-03-23 05:16:42 +00:00
Bo Zhu
40d8a45b23 Unhide the enum/function for the password hashing algorithm scrypt
Bug: 75024420
Test: none, it's just unhiding APIs
Change-Id: I9cbb327678d334079e2c660d85013f3073d4cb87
2018-03-22 20:22:44 -07:00
Dmitry Dementyev
1e6a9dcecb Update RecoverableKeyStoreManager methods to throw NullPointerException when null is passed as @NonNull argument.
Mark serverParams as nullable. Null value can be used to prevent new
snapshots creation.

Bug: 73959762
Test: Test: adb shell am instrument \
-w -e package com.android.server.locksettings.recoverablekeystore \
com.android.frameworks.servicestests/android.support.test.runner.AndroidJUnitRunner
Change-Id: I5c6ddd696b2882b3d27978b0146ff419bedaf5ee
2018-03-22 19:47:20 -07:00
Dmitry Dementyev
3b67e06de5 Prepare KeyChainSnapshot to removing deprecated getTrustedHardwarePublicKey method.
Add null checks to getTrustedHardwareCertPath.
Remove unused and outdated PersistentKeyChainSnapshot class.
Use CertPath instead of public keys in  KeySyncTaskTest.

Bug: 75952916
Test: adb shell am instrument \
-w -e package com.android.server.locksettings.recoverablekeystore \
com.android.frameworks.servicestests/android.support.test.runner.AndroidJUnitRunner

Change-Id: Ifabe7d5fa250069ebe0885ce52ec29b01294f63a
2018-03-22 19:43:17 -07:00
Robert Berry
c6bd185565 Merge "Unhide RecoveryController#getRootCertificates()" into pi-dev 2018-03-22 17:23:05 +00:00
Robert Berry
3818de595b Merge "Unhide RecoverySession#recoverKeyChainSnapshot() method" into pi-dev 2018-03-22 17:19:33 +00:00
Robert Berry
f9332469a4 Merge "Small fix for the key grant alias used in importKey" into pi-dev 2018-03-22 13:55:31 +00:00
Robert Berry
750b71c651 Unhide RecoverySession#recoverKeyChainSnapshot() method
The other methods expose raw key materials, which is a security flaw. This
new API is already being used by GMSCore, via reflection (although falling
back to the old methods if it is not available). Would be good to switch it
on ASAP.

Bug: 74345822
Test: Tested with GMSCore
Change-Id: I30d53c9e825888d1122c72d23b7c1c10c6edb1e9
2018-03-22 13:49:54 +00:00