a3038b2b31
After a reboot, KeyStore is locked, and certificates encrypted with user PIN are not accessible. So statemachines are not able to connect to EAP-TLS networks. This change makes the problem less severe by 1. Not signing certificates with user PIN on devices with hardware backed KeyStore. 2. Issuing a reconnect upon first USER_PRESENT event. This means HH (which has a hardware backed keystore) can connect to EAP-TLS networks without requiring user intervention and other devices will automatically connect to those networks after user punches PIN. Bug: 10325089 Change-Id: I023d60e58d8214152f051bd9ec84b85b702d829a
845 lines
31 KiB
Java
845 lines
31 KiB
Java
/*
|
|
* Copyright (C) 2013 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
package android.net.wifi;
|
|
|
|
import android.os.Parcel;
|
|
import android.os.Parcelable;
|
|
import android.os.Process;
|
|
import android.security.Credentials;
|
|
import android.security.KeyChain;
|
|
import android.security.KeyStore;
|
|
import android.text.TextUtils;
|
|
import android.util.Slog;
|
|
|
|
import java.io.ByteArrayInputStream;
|
|
import java.io.IOException;
|
|
import java.security.KeyFactory;
|
|
import java.security.NoSuchAlgorithmException;
|
|
import java.security.PrivateKey;
|
|
import java.security.cert.Certificate;
|
|
import java.security.cert.CertificateEncodingException;
|
|
import java.security.cert.CertificateException;
|
|
import java.security.cert.CertificateFactory;
|
|
import java.security.cert.X509Certificate;
|
|
import java.security.spec.InvalidKeySpecException;
|
|
import java.security.spec.PKCS8EncodedKeySpec;
|
|
import java.util.HashMap;
|
|
import java.util.Map;
|
|
|
|
/**
|
|
* Enterprise configuration details for Wi-Fi. Stores details about the EAP method
|
|
* and any associated credentials.
|
|
*/
|
|
public class WifiEnterpriseConfig implements Parcelable {
|
|
private static final String TAG = "WifiEnterpriseConfig";
|
|
private static final boolean DBG = false;
|
|
/**
|
|
* In old configurations, the "private_key" field was used. However, newer
|
|
* configurations use the key_id field with the engine_id set to "keystore".
|
|
* If this field is found in the configuration, the migration code is
|
|
* triggered.
|
|
*/
|
|
private static final String OLD_PRIVATE_KEY_NAME = "private_key";
|
|
|
|
/**
|
|
* String representing the keystore OpenSSL ENGINE's ID.
|
|
*/
|
|
private static final String ENGINE_ID_KEYSTORE = "keystore";
|
|
|
|
/**
|
|
* String representing the keystore URI used for wpa_supplicant.
|
|
*/
|
|
private static final String KEYSTORE_URI = "keystore://";
|
|
|
|
/**
|
|
* String to set the engine value to when it should be enabled.
|
|
*/
|
|
private static final String ENGINE_ENABLE = "1";
|
|
|
|
/**
|
|
* String to set the engine value to when it should be disabled.
|
|
*/
|
|
private static final String ENGINE_DISABLE = "0";
|
|
|
|
private static final String CA_CERT_PREFIX = KEYSTORE_URI + Credentials.CA_CERTIFICATE;
|
|
private static final String CLIENT_CERT_PREFIX = KEYSTORE_URI + Credentials.USER_CERTIFICATE;
|
|
|
|
private static final String EAP_KEY = "eap";
|
|
private static final String PHASE2_KEY = "phase2";
|
|
private static final String IDENTITY_KEY = "identity";
|
|
private static final String ANON_IDENTITY_KEY = "anonymous_identity";
|
|
private static final String PASSWORD_KEY = "password";
|
|
private static final String CLIENT_CERT_KEY = "client_cert";
|
|
private static final String CA_CERT_KEY = "ca_cert";
|
|
private static final String SUBJECT_MATCH_KEY = "subject_match";
|
|
private static final String ENGINE_KEY = "engine";
|
|
private static final String ENGINE_ID_KEY = "engine_id";
|
|
private static final String PRIVATE_KEY_ID_KEY = "key_id";
|
|
private static final String OPP_KEY_CACHING = "proactive_key_caching";
|
|
|
|
private HashMap<String, String> mFields = new HashMap<String, String>();
|
|
private X509Certificate mCaCert;
|
|
private PrivateKey mClientPrivateKey;
|
|
private X509Certificate mClientCertificate;
|
|
private boolean mNeedsSoftwareKeystore = false;
|
|
|
|
/** This represents an empty value of an enterprise field.
|
|
* NULL is used at wpa_supplicant to indicate an empty value
|
|
*/
|
|
static final String EMPTY_VALUE = "NULL";
|
|
|
|
public WifiEnterpriseConfig() {
|
|
// Do not set defaults so that the enterprise fields that are not changed
|
|
// by API are not changed underneath
|
|
// This is essential because an app may not have all fields like password
|
|
// available. It allows modification of subset of fields.
|
|
|
|
}
|
|
|
|
/** Copy constructor */
|
|
public WifiEnterpriseConfig(WifiEnterpriseConfig source) {
|
|
for (String key : source.mFields.keySet()) {
|
|
mFields.put(key, source.mFields.get(key));
|
|
}
|
|
}
|
|
|
|
@Override
|
|
public int describeContents() {
|
|
return 0;
|
|
}
|
|
|
|
@Override
|
|
public void writeToParcel(Parcel dest, int flags) {
|
|
dest.writeInt(mFields.size());
|
|
for (Map.Entry<String, String> entry : mFields.entrySet()) {
|
|
dest.writeString(entry.getKey());
|
|
dest.writeString(entry.getValue());
|
|
}
|
|
|
|
writeCertificate(dest, mCaCert);
|
|
|
|
if (mClientPrivateKey != null) {
|
|
String algorithm = mClientPrivateKey.getAlgorithm();
|
|
byte[] userKeyBytes = mClientPrivateKey.getEncoded();
|
|
dest.writeInt(userKeyBytes.length);
|
|
dest.writeByteArray(userKeyBytes);
|
|
dest.writeString(algorithm);
|
|
} else {
|
|
dest.writeInt(0);
|
|
}
|
|
|
|
writeCertificate(dest, mClientCertificate);
|
|
}
|
|
|
|
private void writeCertificate(Parcel dest, X509Certificate cert) {
|
|
if (cert != null) {
|
|
try {
|
|
byte[] certBytes = cert.getEncoded();
|
|
dest.writeInt(certBytes.length);
|
|
dest.writeByteArray(certBytes);
|
|
} catch (CertificateEncodingException e) {
|
|
dest.writeInt(0);
|
|
}
|
|
} else {
|
|
dest.writeInt(0);
|
|
}
|
|
}
|
|
|
|
public static final Creator<WifiEnterpriseConfig> CREATOR =
|
|
new Creator<WifiEnterpriseConfig>() {
|
|
public WifiEnterpriseConfig createFromParcel(Parcel in) {
|
|
WifiEnterpriseConfig enterpriseConfig = new WifiEnterpriseConfig();
|
|
int count = in.readInt();
|
|
for (int i = 0; i < count; i++) {
|
|
String key = in.readString();
|
|
String value = in.readString();
|
|
enterpriseConfig.mFields.put(key, value);
|
|
}
|
|
|
|
enterpriseConfig.mCaCert = readCertificate(in);
|
|
|
|
PrivateKey userKey = null;
|
|
int len = in.readInt();
|
|
if (len > 0) {
|
|
try {
|
|
byte[] bytes = new byte[len];
|
|
in.readByteArray(bytes);
|
|
String algorithm = in.readString();
|
|
KeyFactory keyFactory = KeyFactory.getInstance(algorithm);
|
|
userKey = keyFactory.generatePrivate(new PKCS8EncodedKeySpec(bytes));
|
|
} catch (NoSuchAlgorithmException e) {
|
|
userKey = null;
|
|
} catch (InvalidKeySpecException e) {
|
|
userKey = null;
|
|
}
|
|
}
|
|
|
|
enterpriseConfig.mClientPrivateKey = userKey;
|
|
enterpriseConfig.mClientCertificate = readCertificate(in);
|
|
return enterpriseConfig;
|
|
}
|
|
|
|
private X509Certificate readCertificate(Parcel in) {
|
|
X509Certificate cert = null;
|
|
int len = in.readInt();
|
|
if (len > 0) {
|
|
try {
|
|
byte[] bytes = new byte[len];
|
|
in.readByteArray(bytes);
|
|
CertificateFactory cFactory = CertificateFactory.getInstance("X.509");
|
|
cert = (X509Certificate) cFactory
|
|
.generateCertificate(new ByteArrayInputStream(bytes));
|
|
} catch (CertificateException e) {
|
|
cert = null;
|
|
}
|
|
}
|
|
return cert;
|
|
}
|
|
|
|
public WifiEnterpriseConfig[] newArray(int size) {
|
|
return new WifiEnterpriseConfig[size];
|
|
}
|
|
};
|
|
|
|
/** The Extensible Authentication Protocol method used */
|
|
public static final class Eap {
|
|
/** No EAP method used. Represents an empty config */
|
|
public static final int NONE = -1;
|
|
/** Protected EAP */
|
|
public static final int PEAP = 0;
|
|
/** EAP-Transport Layer Security */
|
|
public static final int TLS = 1;
|
|
/** EAP-Tunneled Transport Layer Security */
|
|
public static final int TTLS = 2;
|
|
/** EAP-Password */
|
|
public static final int PWD = 3;
|
|
/** @hide */
|
|
public static final String[] strings = { "PEAP", "TLS", "TTLS", "PWD" };
|
|
|
|
/** Prevent initialization */
|
|
private Eap() {}
|
|
}
|
|
|
|
/** The inner authentication method used */
|
|
public static final class Phase2 {
|
|
public static final int NONE = 0;
|
|
/** Password Authentication Protocol */
|
|
public static final int PAP = 1;
|
|
/** Microsoft Challenge Handshake Authentication Protocol */
|
|
public static final int MSCHAP = 2;
|
|
/** Microsoft Challenge Handshake Authentication Protocol v2 */
|
|
public static final int MSCHAPV2 = 3;
|
|
/** Generic Token Card */
|
|
public static final int GTC = 4;
|
|
private static final String PREFIX = "auth=";
|
|
/** @hide */
|
|
public static final String[] strings = {EMPTY_VALUE, "PAP", "MSCHAP", "MSCHAPV2", "GTC" };
|
|
|
|
/** Prevent initialization */
|
|
private Phase2() {}
|
|
}
|
|
|
|
/** Internal use only */
|
|
HashMap<String, String> getFields() {
|
|
return mFields;
|
|
}
|
|
|
|
/** Internal use only */
|
|
static String[] getSupplicantKeys() {
|
|
return new String[] { EAP_KEY, PHASE2_KEY, IDENTITY_KEY, ANON_IDENTITY_KEY, PASSWORD_KEY,
|
|
CLIENT_CERT_KEY, CA_CERT_KEY, SUBJECT_MATCH_KEY, ENGINE_KEY, ENGINE_ID_KEY,
|
|
PRIVATE_KEY_ID_KEY };
|
|
}
|
|
|
|
/**
|
|
* Set the EAP authentication method.
|
|
* @param eapMethod is one {@link Eap#PEAP}, {@link Eap#TLS}, {@link Eap#TTLS} or
|
|
* {@link Eap#PWD}
|
|
* @throws IllegalArgumentException on an invalid eap method
|
|
*/
|
|
public void setEapMethod(int eapMethod) {
|
|
switch (eapMethod) {
|
|
/** Valid methods */
|
|
case Eap.PEAP:
|
|
case Eap.PWD:
|
|
case Eap.TLS:
|
|
case Eap.TTLS:
|
|
mFields.put(EAP_KEY, Eap.strings[eapMethod]);
|
|
mFields.put(OPP_KEY_CACHING, "1");
|
|
break;
|
|
default:
|
|
throw new IllegalArgumentException("Unknown EAP method");
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get the eap method.
|
|
* @return eap method configured
|
|
*/
|
|
public int getEapMethod() {
|
|
String eapMethod = mFields.get(EAP_KEY);
|
|
return getStringIndex(Eap.strings, eapMethod, Eap.NONE);
|
|
}
|
|
|
|
/**
|
|
* Set Phase 2 authentication method. Sets the inner authentication method to be used in
|
|
* phase 2 after setting up a secure channel
|
|
* @param phase2Method is the inner authentication method and can be one of {@link Phase2#NONE},
|
|
* {@link Phase2#PAP}, {@link Phase2#MSCHAP}, {@link Phase2#MSCHAPV2},
|
|
* {@link Phase2#GTC}
|
|
* @throws IllegalArgumentException on an invalid phase2 method
|
|
*
|
|
*/
|
|
public void setPhase2Method(int phase2Method) {
|
|
switch (phase2Method) {
|
|
case Phase2.NONE:
|
|
mFields.put(PHASE2_KEY, EMPTY_VALUE);
|
|
break;
|
|
/** Valid methods */
|
|
case Phase2.PAP:
|
|
case Phase2.MSCHAP:
|
|
case Phase2.MSCHAPV2:
|
|
case Phase2.GTC:
|
|
mFields.put(PHASE2_KEY, convertToQuotedString(
|
|
Phase2.PREFIX + Phase2.strings[phase2Method]));
|
|
break;
|
|
default:
|
|
throw new IllegalArgumentException("Unknown Phase 2 method");
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get the phase 2 authentication method.
|
|
* @return a phase 2 method defined at {@link Phase2}
|
|
* */
|
|
public int getPhase2Method() {
|
|
String phase2Method = removeDoubleQuotes(mFields.get(PHASE2_KEY));
|
|
// Remove auth= prefix
|
|
if (phase2Method.startsWith(Phase2.PREFIX)) {
|
|
phase2Method = phase2Method.substring(Phase2.PREFIX.length());
|
|
}
|
|
return getStringIndex(Phase2.strings, phase2Method, Phase2.NONE);
|
|
}
|
|
|
|
/**
|
|
* Set the identity
|
|
* @param identity
|
|
*/
|
|
public void setIdentity(String identity) {
|
|
setFieldValue(IDENTITY_KEY, identity, "");
|
|
}
|
|
|
|
/**
|
|
* Get the identity
|
|
* @return the identity
|
|
*/
|
|
public String getIdentity() {
|
|
return getFieldValue(IDENTITY_KEY, "");
|
|
}
|
|
|
|
/**
|
|
* Set anonymous identity. This is used as the unencrypted identity with
|
|
* certain EAP types
|
|
* @param anonymousIdentity the anonymous identity
|
|
*/
|
|
public void setAnonymousIdentity(String anonymousIdentity) {
|
|
setFieldValue(ANON_IDENTITY_KEY, anonymousIdentity, "");
|
|
}
|
|
|
|
/** Get the anonymous identity
|
|
* @return anonymous identity
|
|
*/
|
|
public String getAnonymousIdentity() {
|
|
return getFieldValue(ANON_IDENTITY_KEY, "");
|
|
}
|
|
|
|
/**
|
|
* Set the password.
|
|
* @param password the password
|
|
*/
|
|
public void setPassword(String password) {
|
|
setFieldValue(PASSWORD_KEY, password, "");
|
|
}
|
|
|
|
/**
|
|
* Get the password.
|
|
*
|
|
* Returns locally set password value. For networks fetched from
|
|
* framework, returns "*".
|
|
*/
|
|
public String getPassword() {
|
|
return getFieldValue(PASSWORD_KEY, "");
|
|
}
|
|
|
|
/**
|
|
* Set CA certificate alias.
|
|
*
|
|
* <p> See the {@link android.security.KeyChain} for details on installing or choosing
|
|
* a certificate
|
|
* </p>
|
|
* @param alias identifies the certificate
|
|
* @hide
|
|
*/
|
|
public void setCaCertificateAlias(String alias) {
|
|
setFieldValue(CA_CERT_KEY, alias, CA_CERT_PREFIX);
|
|
}
|
|
|
|
/**
|
|
* Get CA certificate alias
|
|
* @return alias to the CA certificate
|
|
* @hide
|
|
*/
|
|
public String getCaCertificateAlias() {
|
|
return getFieldValue(CA_CERT_KEY, CA_CERT_PREFIX);
|
|
}
|
|
|
|
/**
|
|
* Specify a X.509 certificate that identifies the server.
|
|
*
|
|
* <p>A default name is automatically assigned to the certificate and used
|
|
* with this configuration. The framework takes care of installing the
|
|
* certificate when the config is saved and removing the certificate when
|
|
* the config is removed.
|
|
*
|
|
* @param cert X.509 CA certificate
|
|
* @throws IllegalArgumentException if not a CA certificate
|
|
*/
|
|
public void setCaCertificate(X509Certificate cert) {
|
|
if (cert != null) {
|
|
if (cert.getBasicConstraints() >= 0) {
|
|
mCaCert = cert;
|
|
} else {
|
|
throw new IllegalArgumentException("Not a CA certificate");
|
|
}
|
|
} else {
|
|
mCaCert = null;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get CA certificate
|
|
*
|
|
* @return X.509 CA certificate
|
|
*/
|
|
public X509Certificate getCaCertificate() {
|
|
return mCaCert;
|
|
}
|
|
|
|
/**
|
|
* Set Client certificate alias.
|
|
*
|
|
* <p> See the {@link android.security.KeyChain} for details on installing or choosing
|
|
* a certificate
|
|
* </p>
|
|
* @param alias identifies the certificate
|
|
* @hide
|
|
*/
|
|
public void setClientCertificateAlias(String alias) {
|
|
setFieldValue(CLIENT_CERT_KEY, alias, CLIENT_CERT_PREFIX);
|
|
setFieldValue(PRIVATE_KEY_ID_KEY, alias, Credentials.USER_PRIVATE_KEY);
|
|
// Also, set engine parameters
|
|
if (TextUtils.isEmpty(alias)) {
|
|
mFields.put(ENGINE_KEY, ENGINE_DISABLE);
|
|
mFields.put(ENGINE_ID_KEY, EMPTY_VALUE);
|
|
} else {
|
|
mFields.put(ENGINE_KEY, ENGINE_ENABLE);
|
|
mFields.put(ENGINE_ID_KEY, convertToQuotedString(ENGINE_ID_KEYSTORE));
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get client certificate alias
|
|
* @return alias to the client certificate
|
|
* @hide
|
|
*/
|
|
public String getClientCertificateAlias() {
|
|
return getFieldValue(CLIENT_CERT_KEY, CLIENT_CERT_PREFIX);
|
|
}
|
|
|
|
/**
|
|
* Specify a private key and client certificate for client authorization.
|
|
*
|
|
* <p>A default name is automatically assigned to the key entry and used
|
|
* with this configuration. The framework takes care of installing the
|
|
* key entry when the config is saved and removing the key entry when
|
|
* the config is removed.
|
|
|
|
* @param privateKey
|
|
* @param clientCertificate
|
|
* @throws IllegalArgumentException for an invalid key or certificate.
|
|
*/
|
|
public void setClientKeyEntry(PrivateKey privateKey, X509Certificate clientCertificate) {
|
|
if (clientCertificate != null) {
|
|
if (clientCertificate.getBasicConstraints() != -1) {
|
|
throw new IllegalArgumentException("Cannot be a CA certificate");
|
|
}
|
|
if (privateKey == null) {
|
|
throw new IllegalArgumentException("Client cert without a private key");
|
|
}
|
|
if (privateKey.getEncoded() == null) {
|
|
throw new IllegalArgumentException("Private key cannot be encoded");
|
|
}
|
|
}
|
|
|
|
mClientPrivateKey = privateKey;
|
|
mClientCertificate = clientCertificate;
|
|
}
|
|
|
|
/**
|
|
* Get client certificate
|
|
*
|
|
* @return X.509 client certificate
|
|
*/
|
|
public X509Certificate getClientCertificate() {
|
|
return mClientCertificate;
|
|
}
|
|
|
|
boolean needsKeyStore() {
|
|
// Has no keys to be installed
|
|
if (mClientCertificate == null && mCaCert == null) return false;
|
|
return true;
|
|
}
|
|
|
|
static boolean isHardwareBackedKey(PrivateKey key) {
|
|
return KeyChain.isBoundKeyAlgorithm(key.getAlgorithm());
|
|
}
|
|
|
|
static boolean hasHardwareBackedKey(Certificate certificate) {
|
|
return KeyChain.isBoundKeyAlgorithm(certificate.getPublicKey().getAlgorithm());
|
|
}
|
|
|
|
boolean needsSoftwareBackedKeyStore() {
|
|
return mNeedsSoftwareKeystore;
|
|
}
|
|
|
|
boolean installKeys(android.security.KeyStore keyStore, String name) {
|
|
boolean ret = true;
|
|
String privKeyName = Credentials.USER_PRIVATE_KEY + name;
|
|
String userCertName = Credentials.USER_CERTIFICATE + name;
|
|
String caCertName = Credentials.CA_CERTIFICATE + name;
|
|
if (mClientCertificate != null) {
|
|
byte[] privKeyData = mClientPrivateKey.getEncoded();
|
|
if (isHardwareBackedKey(mClientPrivateKey)) {
|
|
// Hardware backed key store is secure enough to store keys un-encrypted, this
|
|
// removes the need for user to punch a PIN to get access to these keys
|
|
if (DBG) Slog.d(TAG, "importing keys " + name + " in hardware backed " +
|
|
"store");
|
|
ret = keyStore.importKey(privKeyName, privKeyData, Process.WIFI_UID,
|
|
KeyStore.FLAG_NONE);
|
|
} else {
|
|
// Software backed key store is NOT secure enough to store keys un-encrypted.
|
|
// Save keys encrypted so they are protected with user's PIN. User will
|
|
// have to unlock phone before being able to use these keys and connect to
|
|
// networks.
|
|
if (DBG) Slog.d(TAG, "importing keys " + name + " in software backed store");
|
|
ret = keyStore.importKey(privKeyName, privKeyData, Process.WIFI_UID,
|
|
KeyStore.FLAG_ENCRYPTED);
|
|
mNeedsSoftwareKeystore = true;
|
|
}
|
|
if (ret == false) {
|
|
return ret;
|
|
}
|
|
|
|
ret = putCertInKeyStore(keyStore, userCertName, mClientCertificate);
|
|
if (ret == false) {
|
|
// Remove private key installed
|
|
keyStore.delKey(privKeyName, Process.WIFI_UID);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
if (mCaCert != null) {
|
|
ret = putCertInKeyStore(keyStore, caCertName, mCaCert);
|
|
if (ret == false) {
|
|
if (mClientCertificate != null) {
|
|
// Remove client key+cert
|
|
keyStore.delKey(privKeyName, Process.WIFI_UID);
|
|
keyStore.delete(userCertName, Process.WIFI_UID);
|
|
}
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
// Set alias names
|
|
if (mClientCertificate != null) {
|
|
setClientCertificateAlias(name);
|
|
mClientPrivateKey = null;
|
|
mClientCertificate = null;
|
|
}
|
|
|
|
if (mCaCert != null) {
|
|
setCaCertificateAlias(name);
|
|
mCaCert = null;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
private boolean putCertInKeyStore(android.security.KeyStore keyStore, String name,
|
|
Certificate cert) {
|
|
try {
|
|
byte[] certData = Credentials.convertToPem(cert);
|
|
if (DBG) Slog.d(TAG, "putting certificate " + name + " in keystore");
|
|
return keyStore.put(name, certData, Process.WIFI_UID, KeyStore.FLAG_NONE);
|
|
|
|
} catch (IOException e1) {
|
|
return false;
|
|
} catch (CertificateException e2) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
void removeKeys(KeyStore keyStore) {
|
|
String client = getFieldValue(CLIENT_CERT_KEY, CLIENT_CERT_PREFIX);
|
|
// a valid client certificate is configured
|
|
if (!TextUtils.isEmpty(client)) {
|
|
if (DBG) Slog.d(TAG, "removing client private key and user cert");
|
|
keyStore.delKey(Credentials.USER_PRIVATE_KEY + client, Process.WIFI_UID);
|
|
keyStore.delete(Credentials.USER_CERTIFICATE + client, Process.WIFI_UID);
|
|
}
|
|
|
|
String ca = getFieldValue(CA_CERT_KEY, CA_CERT_PREFIX);
|
|
// a valid ca certificate is configured
|
|
if (!TextUtils.isEmpty(ca)) {
|
|
if (DBG) Slog.d(TAG, "removing CA cert");
|
|
keyStore.delete(Credentials.CA_CERTIFICATE + ca, Process.WIFI_UID);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set subject match. This is the substring to be matched against the subject of the
|
|
* authentication server certificate.
|
|
* @param subjectMatch substring to be matched
|
|
*/
|
|
public void setSubjectMatch(String subjectMatch) {
|
|
setFieldValue(SUBJECT_MATCH_KEY, subjectMatch, "");
|
|
}
|
|
|
|
/**
|
|
* Get subject match
|
|
* @return the subject match string
|
|
*/
|
|
public String getSubjectMatch() {
|
|
return getFieldValue(SUBJECT_MATCH_KEY, "");
|
|
}
|
|
|
|
/** See {@link WifiConfiguration#getKeyIdForCredentials} @hide */
|
|
String getKeyId(WifiEnterpriseConfig current) {
|
|
String eap = mFields.get(EAP_KEY);
|
|
String phase2 = mFields.get(PHASE2_KEY);
|
|
|
|
// If either eap or phase2 are not initialized, use current config details
|
|
if (TextUtils.isEmpty((eap))) {
|
|
eap = current.mFields.get(EAP_KEY);
|
|
}
|
|
if (TextUtils.isEmpty(phase2)) {
|
|
phase2 = current.mFields.get(PHASE2_KEY);
|
|
}
|
|
return eap + "_" + phase2;
|
|
}
|
|
|
|
/** Migrates the old style TLS config to the new config style. This should only be used
|
|
* when restoring an old wpa_supplicant.conf or upgrading from a previous
|
|
* platform version.
|
|
* @return true if the config was updated
|
|
* @hide
|
|
*/
|
|
boolean migrateOldEapTlsNative(WifiNative wifiNative, int netId) {
|
|
String oldPrivateKey = wifiNative.getNetworkVariable(netId, OLD_PRIVATE_KEY_NAME);
|
|
/*
|
|
* If the old configuration value is not present, then there is nothing
|
|
* to do.
|
|
*/
|
|
if (TextUtils.isEmpty(oldPrivateKey)) {
|
|
return false;
|
|
} else {
|
|
// Also ignore it if it's empty quotes.
|
|
oldPrivateKey = removeDoubleQuotes(oldPrivateKey);
|
|
if (TextUtils.isEmpty(oldPrivateKey)) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
mFields.put(ENGINE_KEY, ENGINE_ENABLE);
|
|
mFields.put(ENGINE_ID_KEY, convertToQuotedString(ENGINE_ID_KEYSTORE));
|
|
|
|
/*
|
|
* The old key started with the keystore:// URI prefix, but we don't
|
|
* need that anymore. Trim it off if it exists.
|
|
*/
|
|
final String keyName;
|
|
if (oldPrivateKey.startsWith(KEYSTORE_URI)) {
|
|
keyName = new String(oldPrivateKey.substring(KEYSTORE_URI.length()));
|
|
} else {
|
|
keyName = oldPrivateKey;
|
|
}
|
|
mFields.put(PRIVATE_KEY_ID_KEY, convertToQuotedString(keyName));
|
|
|
|
wifiNative.setNetworkVariable(netId, ENGINE_KEY, mFields.get(ENGINE_KEY));
|
|
wifiNative.setNetworkVariable(netId, ENGINE_ID_KEY, mFields.get(ENGINE_ID_KEY));
|
|
wifiNative.setNetworkVariable(netId, PRIVATE_KEY_ID_KEY, mFields.get(PRIVATE_KEY_ID_KEY));
|
|
// Remove old private_key string so we don't run this again.
|
|
wifiNative.setNetworkVariable(netId, OLD_PRIVATE_KEY_NAME, EMPTY_VALUE);
|
|
return true;
|
|
}
|
|
|
|
/** Migrate certs from global pool to wifi UID if not already done */
|
|
void migrateCerts(android.security.KeyStore keyStore) {
|
|
String client = getFieldValue(CLIENT_CERT_KEY, CLIENT_CERT_PREFIX);
|
|
// a valid client certificate is configured
|
|
if (!TextUtils.isEmpty(client)) {
|
|
if (!keyStore.contains(Credentials.USER_PRIVATE_KEY + client, Process.WIFI_UID)) {
|
|
keyStore.duplicate(Credentials.USER_PRIVATE_KEY + client, -1,
|
|
Credentials.USER_PRIVATE_KEY + client, Process.WIFI_UID);
|
|
keyStore.duplicate(Credentials.USER_CERTIFICATE + client, -1,
|
|
Credentials.USER_CERTIFICATE + client, Process.WIFI_UID);
|
|
}
|
|
}
|
|
|
|
String ca = getFieldValue(CA_CERT_KEY, CA_CERT_PREFIX);
|
|
// a valid ca certificate is configured
|
|
if (!TextUtils.isEmpty(ca)) {
|
|
if (!keyStore.contains(Credentials.CA_CERTIFICATE + ca, Process.WIFI_UID)) {
|
|
keyStore.duplicate(Credentials.CA_CERTIFICATE + ca, -1,
|
|
Credentials.CA_CERTIFICATE + ca, Process.WIFI_UID);
|
|
}
|
|
}
|
|
}
|
|
|
|
void initializeSoftwareKeystoreFlag(android.security.KeyStore keyStore) {
|
|
String client = getFieldValue(CLIENT_CERT_KEY, CLIENT_CERT_PREFIX);
|
|
if (!TextUtils.isEmpty(client)) {
|
|
// a valid client certificate is configured
|
|
|
|
// BUGBUG: keyStore.get() never returns certBytes; because it is not
|
|
// taking WIFI_UID as a parameter. It always looks for certificate
|
|
// with SYSTEM_UID, and never finds any Wifi certificates. Assuming that
|
|
// all certificates need software keystore until we get the get() API
|
|
// fixed.
|
|
|
|
mNeedsSoftwareKeystore = true;
|
|
|
|
/*
|
|
try {
|
|
|
|
if (DBG) Slog.d(TAG, "Loading client certificate " + Credentials
|
|
.USER_CERTIFICATE + client);
|
|
|
|
CertificateFactory factory = CertificateFactory.getInstance("X.509");
|
|
if (factory == null) {
|
|
Slog.e(TAG, "Error getting certificate factory");
|
|
return;
|
|
}
|
|
|
|
byte[] certBytes = keyStore.get(Credentials.USER_CERTIFICATE + client);
|
|
if (certBytes != null) {
|
|
Certificate cert = (X509Certificate) factory.generateCertificate(
|
|
new ByteArrayInputStream(certBytes));
|
|
|
|
if (cert != null) {
|
|
mNeedsSoftwareKeystore = hasHardwareBackedKey(cert);
|
|
|
|
if (DBG) Slog.d(TAG, "Loaded client certificate " + Credentials
|
|
.USER_CERTIFICATE + client);
|
|
if (DBG) Slog.d(TAG, "It " + (mNeedsSoftwareKeystore ? "needs" :
|
|
"does not need" ) + " software key store");
|
|
} else {
|
|
Slog.d(TAG, "could not generate certificate");
|
|
}
|
|
} else {
|
|
Slog.e(TAG, "Could not load client certificate " + Credentials
|
|
.USER_CERTIFICATE + client);
|
|
mNeedsSoftwareKeystore = true;
|
|
}
|
|
|
|
} catch(CertificateException e) {
|
|
Slog.e(TAG, "Could not read certificates");
|
|
mCaCert = null;
|
|
mClientCertificate = null;
|
|
}
|
|
*/
|
|
}
|
|
}
|
|
|
|
private String removeDoubleQuotes(String string) {
|
|
if (TextUtils.isEmpty(string)) return "";
|
|
int length = string.length();
|
|
if ((length > 1) && (string.charAt(0) == '"')
|
|
&& (string.charAt(length - 1) == '"')) {
|
|
return string.substring(1, length - 1);
|
|
}
|
|
return string;
|
|
}
|
|
|
|
private String convertToQuotedString(String string) {
|
|
return "\"" + string + "\"";
|
|
}
|
|
|
|
/** Returns the index at which the toBeFound string is found in the array.
|
|
* @param arr array of strings
|
|
* @param toBeFound string to be found
|
|
* @param defaultIndex default index to be returned when string is not found
|
|
* @return the index into array
|
|
*/
|
|
private int getStringIndex(String arr[], String toBeFound, int defaultIndex) {
|
|
if (TextUtils.isEmpty(toBeFound)) return defaultIndex;
|
|
for (int i = 0; i < arr.length; i++) {
|
|
if (toBeFound.equals(arr[i])) return i;
|
|
}
|
|
return defaultIndex;
|
|
}
|
|
|
|
/** Returns the field value for the key.
|
|
* @param key into the hash
|
|
* @param prefix is the prefix that the value may have
|
|
* @return value
|
|
*/
|
|
private String getFieldValue(String key, String prefix) {
|
|
String value = mFields.get(key);
|
|
// Uninitialized or known to be empty after reading from supplicant
|
|
if (TextUtils.isEmpty(value) || EMPTY_VALUE.equals(value)) return "";
|
|
|
|
value = removeDoubleQuotes(value);
|
|
if (value.startsWith(prefix)) {
|
|
return value.substring(prefix.length());
|
|
} else {
|
|
return value;
|
|
}
|
|
}
|
|
|
|
/** Set a value with an optional prefix at key
|
|
* @param key into the hash
|
|
* @param value to be set
|
|
* @param prefix an optional value to be prefixed to actual value
|
|
*/
|
|
private void setFieldValue(String key, String value, String prefix) {
|
|
if (TextUtils.isEmpty(value)) {
|
|
mFields.put(key, EMPTY_VALUE);
|
|
} else {
|
|
mFields.put(key, convertToQuotedString(prefix + value));
|
|
}
|
|
}
|
|
|
|
@Override
|
|
public String toString() {
|
|
StringBuffer sb = new StringBuffer();
|
|
for (String key : mFields.keySet()) {
|
|
sb.append(key).append(" ").append(mFields.get(key)).append("\n");
|
|
}
|
|
return sb.toString();
|
|
}
|
|
}
|