Refactoring AndroidKeyStore to support a KeyStore running in another process

net/android/java/src/org/chromium/net/AndroidKeyStoreInProcessImpl.java

+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.net;
+
+import android.util.Log;
+
+import java.lang.reflect.Method;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.Signature;
+import java.security.interfaces.DSAKey;
+import java.security.interfaces.DSAParams;
+import java.security.interfaces.DSAPrivateKey;
+import java.security.interfaces.ECKey;
+import java.security.interfaces.ECPrivateKey;
+import java.security.interfaces.RSAKey;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.spec.ECParameterSpec;
+
+/**
+ * Simple implementation of the AndroidKeyStoreInterface for use with an in-process Java KeyStore.
+ */
+public class AndroidKeyStoreInProcessImpl implements AndroidKeyStore {

[Ryan Sleevi, 2014/02/14 20:57:51]

Naming wise, this seems unduly verbose.

I would just go with DefaultAndroidKeyStore and RemoteAndroidKeyStore

The "impl" seems needed if-f you're keeping the name the same (eg: an
alternative scheme is "AndroidKeyStoreImpl" and "AndroidKeyStoreRemote")

[Yaron, 2014/02/14 22:06:59]

Fair enough. Default* and Remote* it is. ALso updated the aidl files..

+
+    private static final String TAG = "AndroidKeyStoreInProcessImpl";
+
+    private static class InProcessPrivateKey implements AndroidPrivateKey {
+        // The actual Java key being wrapped.
+        final PrivateKey mKey;
+        // Key store handling this key.
+        final AndroidKeyStoreInProcessImpl mStore;
+
+        InProcessPrivateKey(PrivateKey key, AndroidKeyStoreInProcessImpl store) {
+            mKey = key;
+            mStore = store;
+        }
+
+        PrivateKey getJavaKey() {
+            return mKey;
+        }
+
+        @Override
+        public AndroidKeyStore getKeyStore() {
+            return mStore;
+        }
+    }
+
+    public AndroidPrivateKey createKey(PrivateKey javaKey) {
+        return new InProcessPrivateKey(javaKey, this);
+    }
+
+    @Override
+    public byte[] getRSAKeyModulus(AndroidPrivateKey key) {
+        PrivateKey javaKey = ((InProcessPrivateKey) key).getJavaKey();
+        if (javaKey instanceof RSAKey) {
+            return ((RSAKey) javaKey).getModulus().toByteArray();
+        }
+        Log.w(TAG, "Not a RSAKey instance!");
+        return null;
+    }
+
+    @Override
+    public byte[] getDSAKeyParamQ(AndroidPrivateKey key) {
+        PrivateKey javaKey = ((InProcessPrivateKey) key).getJavaKey();
+        if (javaKey instanceof DSAKey) {
+            DSAParams params = ((DSAKey) javaKey).getParams();
+            return params.getQ().toByteArray();
+        }
+        Log.w(TAG, "Not a DSAKey instance!");
+        return null;
+    }
+
+    @Override
+    public byte[] getECKeyOrder(AndroidPrivateKey key) {
+        PrivateKey javaKey = ((InProcessPrivateKey) key).getJavaKey();
+        if (javaKey instanceof ECKey) {
+            ECParameterSpec params = ((ECKey) javaKey).getParams();
+            return params.getOrder().toByteArray();
+        }
+        Log.w(TAG, "Not an ECKey instance!");
+        return null;
+    }
+
+   @Override
+    public byte[] getPrivateKeyEncodedBytes(AndroidPrivateKey key) {
+        PrivateKey javaKey = ((InProcessPrivateKey) key).getJavaKey();
+        return javaKey.getEncoded();
+    }
+
+    @Override
+    public byte[] rawSignDigestWithPrivateKey(AndroidPrivateKey key,
+                                                     byte[] message) {
+        PrivateKey javaKey = ((InProcessPrivateKey) key).getJavaKey();
+        // Get the Signature for this key.
+        Signature signature = null;
+        // Hint: Algorithm names come from:
+        // http://docs.oracle.com/javase/6/docs/technotes/guides/security/StandardNames.html
+        try {
+            if (javaKey instanceof RSAPrivateKey) {
+                // IMPORTANT: Due to a platform bug, this will throw NoSuchAlgorithmException
+                // on Android 4.0.x and 4.1.x. Fixed in 4.2 and higher.
+                // See https://android-review.googlesource.com/#/c/40352/
+                signature = Signature.getInstance("NONEwithRSA");
+            } else if (javaKey instanceof DSAPrivateKey) {
+                signature = Signature.getInstance("NONEwithDSA");
+            } else if (javaKey instanceof ECPrivateKey) {
+                signature = Signature.getInstance("NONEwithECDSA");
+            }
+        } catch (NoSuchAlgorithmException e) {
+            ;
+        }
+
+        if (signature == null) {
+            Log.e(TAG, "Unsupported private key algorithm: " + javaKey.getAlgorithm());
+            return null;
+        }
+
+        // Sign the message.
+        try {
+            signature.initSign(javaKey);
+            signature.update(message);
+            return signature.sign();
+        } catch (Exception e) {
+            Log.e(TAG, "Exception while signing message with " + javaKey.getAlgorithm() +
+                        " private key: " + e);
+            return null;
+        }
+    }
+
+    @Override
+    public int getPrivateKeyType(AndroidPrivateKey key) {
+        PrivateKey javaKey = ((InProcessPrivateKey) key).getJavaKey();
+        if (javaKey instanceof RSAPrivateKey)
+            return PrivateKeyType.RSA;
+        if (javaKey instanceof DSAPrivateKey)
+            return PrivateKeyType.DSA;
+        if (javaKey instanceof ECPrivateKey)
+            return PrivateKeyType.ECDSA;
+        else
+            return PrivateKeyType.INVALID;
+    }
+
+    @Override
+    public int getOpenSSLHandleForPrivateKey(AndroidPrivateKey key) {
+        PrivateKey javaKey = ((InProcessPrivateKey) key).getJavaKey();
+        // Sanity checks
+        if (javaKey == null) {
+            Log.e(TAG, "key == null");
+            return 0;
+        }
+        if (!(javaKey instanceof RSAPrivateKey)) {
+            Log.e(TAG, "does not implement RSAPrivateKey");
+            return 0;
+        }
+        // First, check that this is a proper instance of OpenSSLRSAPrivateKey
+        // or one of its sub-classes.
+        Class<?> superClass;
+        try {
+            superClass = Class.forName(
+                    "org.apache.harmony.xnet.provider.jsse.OpenSSLRSAPrivateKey");
+        } catch (Exception e) {
+            // This may happen if the target device has a completely different
+            // implementation of the java.security APIs, compared to vanilla
+            // Android. Highly unlikely, but still possible.
+            Log.e(TAG, "Cannot find system OpenSSLRSAPrivateKey class: " + e);
+            return 0;
+        }
+        if (!superClass.isInstance(key)) {
+            // This may happen if the PrivateKey was not created by the "AndroidOpenSSL"
+            // provider, which should be the default. That could happen if an OEM decided
+            // to implement a different default provider. Also highly unlikely.
+            Log.e(TAG, "Private key is not an OpenSSLRSAPrivateKey instance, its class name is:" +
+                       javaKey.getClass().getCanonicalName());
+            return 0;
+        }
+
+        try {
+            // Use reflection to invoke the 'getOpenSSLKey()' method on
+            // the private key. This returns another Java object that wraps
+            // a native EVP_PKEY. Note that the method is final, so calling
+            // the superclass implementation is ok.
+            Method getKey = superClass.getDeclaredMethod("getOpenSSLKey");
+            getKey.setAccessible(true);
+            Object opensslKey = null;
+            try {
+                opensslKey = getKey.invoke(javaKey);
+            } finally {
+                getKey.setAccessible(false);
+            }
+            if (opensslKey == null) {
+                // Bail when detecting OEM "enhancement".
+                Log.e(TAG, "getOpenSSLKey() returned null");
+                return 0;
+            }
+
+            // Use reflection to invoke the 'getPkeyContext' method on the
+            // result of the getOpenSSLKey(). This is an 32-bit integer
+            // which is the address of an EVP_PKEY object.
+            Method getPkeyContext;
+            try {
+                getPkeyContext = opensslKey.getClass().getDeclaredMethod("getPkeyContext");
+            } catch (Exception e) {
+                // Bail here too, something really not working as expected.
+                Log.e(TAG, "No getPkeyContext() method on OpenSSLKey member:" + e);
+                return 0;
+            }
+            getPkeyContext.setAccessible(true);
+            int evp_pkey = 0;
+            try {
+                evp_pkey = (Integer) getPkeyContext.invoke(opensslKey);
+            } finally {
+                getPkeyContext.setAccessible(false);
+            }
+            if (evp_pkey == 0) {
+                // The PrivateKey is probably rotten for some reason.
+                Log.e(TAG, "getPkeyContext() returned null");
+            }
+            return evp_pkey;
+
+        } catch (Exception e) {
+            Log.e(TAG, "Exception while trying to retrieve system EVP_PKEY handle: " + e);
+            return 0;
+        }
+    }
+
+    @Override
+    public void releaseKey(AndroidPrivateKey key) {
+        // no-op for in-process. GC will handle key collection
+    }
+}