Remove Android support for out-of-process KeyStores

net/android/java/src/org/chromium/net/AndroidKeyStore.java

Index: net/android/java/src/org/chromium/net/AndroidKeyStore.java
diff --git a/net/android/java/src/org/chromium/net/AndroidKeyStore.java b/net/android/java/src/org/chromium/net/AndroidKeyStore.java
index b4fadbaa1d35c573f0c028182314971f28a5a32f..030c44f1eea1668324938d0580fa6acc0e49e7eb 100644
--- a/net/android/java/src/org/chromium/net/AndroidKeyStore.java
+++ b/net/android/java/src/org/chromium/net/AndroidKeyStore.java
@@ -4,14 +4,25 @@
 
 package org.chromium.net;
 
+import org.chromium.base.Log;
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 
+import java.lang.reflect.Method;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.Signature;
+import java.security.interfaces.ECKey;
+import java.security.interfaces.RSAKey;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.spec.ECParameterSpec;
+
 /**
  * Specifies all the dependencies from the native OpenSSL engine on an Android KeyStore.
  */
 @JNINamespace("net::android")
-public interface AndroidKeyStore {
+public class AndroidKeyStore {
+    private static final String TAG = "AndroidKeyStore";
 
     /**
      * Returns the public modulus of a given RSA private key as a byte
@@ -20,22 +31,35 @@ public interface AndroidKeyStore {
      * an OpenSSL BIGNUM object. Required to craft a custom native RSA
      * object where RSA_size() works as expected.
      *
-     * @param key A PrivateKey instance, must implement RSAKey.
+     * @param privateKey A PrivateKey instance, must implement RSAKey.
      * @return A byte buffer corresponding to the modulus. This is
-     * big-endian representation of a BigInteger.
+     *         big-endian representation of a BigInteger.
      */
     @CalledByNative
-    byte[] getRSAKeyModulus(AndroidPrivateKey key);
+    private static byte[] getRSAKeyModulus(PrivateKey privateKey) {
+        if (privateKey instanceof RSAKey) {
+            return ((RSAKey) privateKey).getModulus().toByteArray();
+        }
+        Log.w(TAG, "Not a RSAKey instance!");
+        return null;
+    }
 
     /**
      * Returns the 'order' parameter of a given ECDSA private key as a
      * a byte buffer.
-     * @param key A PrivateKey instance. Must implement ECKey.
+     * @param privateKey A PrivateKey instance. Must implement ECKey.
      * @return A byte buffer corresponding to the 'order' parameter.
      * This is a big-endian representation of a BigInteger.
      */
     @CalledByNative
-    byte[] getECKeyOrder(AndroidPrivateKey key);
+    private static byte[] getECKeyOrder(PrivateKey privateKey) {
+        if (privateKey instanceof ECKey) {
+            ECParameterSpec params = ((ECKey) privateKey).getParams();
+            return params.getOrder().toByteArray();
+        }
+        Log.w(TAG, "Not an ECKey instance!");
+        return null;
+    }
 
     /**
      * Sign a given message with a given PrivateKey object. This method
@@ -57,7 +81,7 @@ public interface AndroidKeyStore {
      *    ECDSA_sign(0,...). The message must be a hash and the function shall
      *    compute a direct ECDSA signature for it.
      *
-     * @param key The PrivateKey handle.
+     * @param privateKey The PrivateKey handle.
      * @param message The message to sign.
      * @return signature as a byte buffer.
      *
@@ -66,17 +90,117 @@ public interface AndroidKeyStore {
      *            getOpenSSLHandleForPrivateKey() below for work-around.
      */
     @CalledByNative
-    byte[] rawSignDigestWithPrivateKey(AndroidPrivateKey key, byte[] message);
+    private static byte[] rawSignDigestWithPrivateKey(PrivateKey privateKey, byte[] message) {
+        // Get the Signature for this key.
+        Signature signature = null;
+        // Hint: Algorithm names come from:
+        // http://docs.oracle.com/javase/6/docs/technotes/guides/security/StandardNames.html
+        try {
+            String keyAlgorithm = privateKey.getAlgorithm();
+            if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
+                // IMPORTANT: Due to a platform bug, this will throw NoSuchAlgorithmException
+                // on Android 4.1.x. Fixed in 4.2 and higher.
+                // See https://android-review.googlesource.com/#/c/40352/
+                signature = Signature.getInstance("NONEwithRSA");
+            } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
+                signature = Signature.getInstance("NONEwithECDSA");
+            }
+        } catch (NoSuchAlgorithmException e) {
+            // Intentionally do nothing.
+        }
+
+        if (signature == null) {
+            Log.e(TAG, "Unsupported private key algorithm: " + privateKey.getAlgorithm());
+            return null;
+        }
+
+        // Sign the message.
+        try {
+            signature.initSign(privateKey);
+            signature.update(message);
+            return signature.sign();
+        } catch (Exception e) {
+            Log.e(TAG, "Exception while signing message with " + privateKey.getAlgorithm()
+                    + " private key: " + e);
+            return null;
+        }
+    }
 
     /**
      * Return the type of a given PrivateKey object. This is an integer
      * that maps to one of the values defined by org.chromium.net.PrivateKeyType,
      * which is itself auto-generated from net/android/private_key_type_list.h
-     * @param key The PrivateKey handle
+     * @param privateKey The PrivateKey handle
      * @return key type, or PrivateKeyType.INVALID if unknown.
      */
     @CalledByNative
-    int getPrivateKeyType(AndroidPrivateKey key);
+    private static int getPrivateKeyType(PrivateKey privateKey) {
+        String keyAlgorithm = privateKey.getAlgorithm();
+        if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
+            return PrivateKeyType.RSA;
+        } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
+            return PrivateKeyType.ECDSA;
+        } else {
+            return PrivateKeyType.INVALID;
+        }
+    }
+
+    private static Object getOpenSSLKeyForPrivateKey(PrivateKey privateKey) {
+        // Sanity checks
+        if (privateKey == null) {
+            Log.e(TAG, "privateKey == null");
+            return null;
+        }
+        if (!(privateKey instanceof RSAPrivateKey)) {
+            Log.e(TAG, "does not implement RSAPrivateKey");
+            return null;
+        }
+        // First, check that this is a proper instance of OpenSSLRSAPrivateKey
+        // or one of its sub-classes.
+        Class<?> superClass;
+        try {
+            superClass =
+                    Class.forName("org.apache.harmony.xnet.provider.jsse.OpenSSLRSAPrivateKey");
+        } catch (Exception e) {
+            // This may happen if the target device has a completely different
+            // implementation of the java.security APIs, compared to vanilla
+            // Android. Highly unlikely, but still possible.
+            Log.e(TAG, "Cannot find system OpenSSLRSAPrivateKey class: " + e);
+            return null;
+        }
+        if (!superClass.isInstance(privateKey)) {
+            // This may happen if the PrivateKey was not created by the "AndroidOpenSSL"
+            // provider, which should be the default. That could happen if an OEM decided
+            // to implement a different default provider. Also highly unlikely.
+            Log.e(TAG, "Private key is not an OpenSSLRSAPrivateKey instance, its class name is:"
+                    + privateKey.getClass().getCanonicalName());
+            return null;
+        }
+
+        try {
+            // Use reflection to invoke the 'getOpenSSLKey()' method on the
+            // private key. This returns another Java object that wraps a native
+            // EVP_PKEY and OpenSSLEngine. Note that the method is final in Android
+            // 4.1, so calling the superclass implementation is ok.
+            Method getKey = superClass.getDeclaredMethod("getOpenSSLKey");
+            getKey.setAccessible(true);
+            Object opensslKey = null;
+            try {
+                opensslKey = getKey.invoke(privateKey);
+            } finally {
+                getKey.setAccessible(false);
+            }
+            if (opensslKey == null) {
+                // Bail when detecting OEM "enhancement".
+                Log.e(TAG, "getOpenSSLKey() returned null");
+                return null;
+            }
+            return opensslKey;
+        } catch (Exception e) {
+            Log.e(TAG, "Exception while trying to retrieve system EVP_PKEY handle: " + e);
+            return null;
+        }
+    }
 
     /**
      * Return the system EVP_PKEY handle corresponding to a given PrivateKey
@@ -106,11 +230,48 @@ public interface AndroidKeyStore {
      * libcore/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLRSAPrivateKey.java
      * libcore/luni/src/main/native/org_apache_harmony_xnet_provider_jsse_NativeCrypto.cpp
      *
-     * @param key The PrivateKey handle.
+     * @param privateKey The PrivateKey handle.
      * @return The EVP_PKEY handle, as a 32-bit integer (0 if not available)
      */
     @CalledByNative
-    long getOpenSSLHandleForPrivateKey(AndroidPrivateKey key);
+    private static long getOpenSSLHandleForPrivateKey(PrivateKey privateKey) {
+        Object opensslKey = getOpenSSLKeyForPrivateKey(privateKey);
+        if (opensslKey == null) return 0;
+
+        try {
+            // Use reflection to invoke the 'getPkeyContext' method on the
+            // result of the getOpenSSLKey(). This is an 32-bit integer
+            // which is the address of an EVP_PKEY object. Note that this
+            // method these days returns a 64-bit long, but since this code
+            // path is used for older Android versions, it may still return
+            // a 32-bit int here. To be on the safe side, we cast the return
+            // value via Number rather than directly to Integer or Long.
+            Method getPkeyContext;
+            try {
+                getPkeyContext = opensslKey.getClass().getDeclaredMethod("getPkeyContext");
+            } catch (Exception e) {
+                // Bail here too, something really not working as expected.
+                Log.e(TAG, "No getPkeyContext() method on OpenSSLKey member:" + e);
+                return 0;
+            }
+            getPkeyContext.setAccessible(true);
+            long evp_pkey = 0;
+            try {
+                evp_pkey = ((Number) getPkeyContext.invoke(opensslKey)).longValue();
+            } finally {
+                getPkeyContext.setAccessible(false);
+            }
+            if (evp_pkey == 0) {
+                // The PrivateKey is probably rotten for some reason.
+                Log.e(TAG, "getPkeyContext() returned null");
+            }
+            return evp_pkey;
+
+        } catch (Exception e) {
+            Log.e(TAG, "Exception while trying to retrieve system EVP_PKEY handle: " + e);
+            return 0;
+        }
+    }
 
     /**
      * Return the OpenSSLEngine object corresponding to a given PrivateKey
@@ -119,15 +280,67 @@ public interface AndroidKeyStore {
      * This shall only be used for Android 4.1 to work around a platform bug.
      * See https://crbug.com/381465.
      *
-     * @param key The PrivateKey handle.
+     * @param privateKey The PrivateKey handle.
      * @return The OpenSSLEngine object (or null if not available)
      */
     @CalledByNative
-    Object getOpenSSLEngineForPrivateKey(AndroidPrivateKey key);
+    private static Object getOpenSSLEngineForPrivateKey(PrivateKey privateKey) {
+        // Find the system OpenSSLEngine class.
+        Class<?> engineClass;
+        try {
+            engineClass = Class.forName("org.apache.harmony.xnet.provider.jsse.OpenSSLEngine");
+        } catch (Exception e) {
+            // This may happen if the target device has a completely different
+            // implementation of the java.security APIs, compared to vanilla
+            // Android. Highly unlikely, but still possible.
+            Log.e(TAG, "Cannot find system OpenSSLEngine class: " + e);
+            return null;
+        }
+
+        Object opensslKey = getOpenSSLKeyForPrivateKey(privateKey);
+        if (opensslKey == null) return null;
+
+        try {
+            // Use reflection to invoke the 'getEngine' method on the
+            // result of the getOpenSSLKey().
+            Method getEngine;
+            try {
+                getEngine = opensslKey.getClass().getDeclaredMethod("getEngine");
+            } catch (Exception e) {
+                // Bail here too, something really not working as expected.
+                Log.e(TAG, "No getEngine() method on OpenSSLKey member:" + e);
+                return null;
+            }
+            getEngine.setAccessible(true);
+            Object engine = null;
+            try {
+                engine = getEngine.invoke(opensslKey);
+            } finally {
+                getEngine.setAccessible(false);
+            }
+            if (engine == null) {
+                // The PrivateKey is probably rotten for some reason.
+                Log.e(TAG, "getEngine() returned null");
+            }
+            // Sanity-check the returned engine.
+            if (!engineClass.isInstance(engine)) {
+                Log.e(TAG, "Engine is not an OpenSSLEngine instance, its class name is:"
+                        + engine.getClass().getCanonicalName());
+                return null;
+            }
+            return engine;
+
+        } catch (Exception e) {
+            Log.e(TAG, "Exception while trying to retrieve OpenSSLEngine object: " + e);
+            return null;
+        }
+    }
 
     /**
      * Called when the native OpenSSL engine no longer needs access to the underlying key.
      */
     @CalledByNative
-    void releaseKey(AndroidPrivateKey key);
+    private static void releaseKey(PrivateKey privateKey) {
+        // no-op for in-process. GC will handle key collection
+    }
 }