Android13 系统/用户证书安装相关分析总结(一) 证书分类以及安装流程分析 - IT评测·应用市场-qidao123.com

/**
* Creates a warning dialog explaining the consequences of installing a CA certificate
* This is displayed before a CA certificate can be installed from Settings.
*/
public class InstallCaCertificateWarning extends Activity {
@Override
public void onCreate(@Nullable Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
...
mixin.setSecondaryButton(
new FooterButton.Builder(this)
.setText(R.string.certificate_warning_install_anyway)
.setListener(installCaCertificate())
.setButtonType(FooterButton.ButtonType.OTHER)
.setTheme(R.style.SudGlifButton_Secondary)
.build()
);
mixin.getSecondaryButtonView().setFilterTouchesWhenObscured(true);
...
}
private View.OnClickListener installCaCertificate() {
return v -> {
final Intent intent = new Intent();
intent.setAction(Credentials.INSTALL_ACTION);
intent.putExtra(Credentials.EXTRA_CERTIFICATE_USAGE, Credentials.CERTIFICATE_USAGE_CA);
startActivity(intent);
finish();
};
}
//frameworks/base/keystore/java/android/security/Credentials.java
public static final String INSTALL_ACTION = "android.credentials.INSTALL";
//packages/apps/CertInstaller/AndroidManifest.xml
<activity android:name=".CertInstallerMain"
android:theme="@style/Transparent"
android:configChanges="orientation|keyboardHidden|screenSize"
android:exported="true">
<intent-filter>
<action android:name="android.credentials.INSTALL"/>
<category android:name="android.intent.category.DEFAULT"/>
</intent-filter>
<intent-filter>
<action android:name="android.intent.action.VIEW"/>
<category android:name="android.intent.category.DEFAULT"/>
<data android:mimeType="application/x-x509-ca-cert"/>
<data android:mimeType="application/x-x509-user-cert"/>
<data android:mimeType="application/x-x509-server-cert"/>
<data android:mimeType="application/x-pkcs12"/>
<data android:mimeType="application/x-pem-file"/>
<data android:mimeType="application/pkix-cert"/>
<data android:mimeType="application/x-wifi-config"/>
</intent-filter>
</activity>

复制代码

// packages/apps/CertInstaller/src/com/android/certinstaller/CertInstallerMain.java
private void startInstallActivity(String mimeType, Uri uri) {
if (mimeType == null) {
mimeType = getContentResolver().getType(uri);
}
String target = MIME_MAPPINGS.get(mimeType);
if (target == null) {
Log.e(TAG, "Unknown MIME type: " + mimeType + ". "
+ Log.getStackTraceString(new Throwable()));
Toast.makeText(this, R.string.invalid_certificate_title, Toast.LENGTH_LONG).show();
return;
}
if (WIFI_CONFIG.equals(target)) {
startWifiInstallActivity(mimeType, uri);
}
else {
InputStream in = null;
try {
in = getContentResolver().openInputStream(uri);
final byte[] raw = readWithLimit(in);
Intent intent = getIntent();
intent.putExtra(target, raw);
startInstallActivity(intent);
} catch (IOException e) {
Log.e(TAG, "Failed to read certificate: " + e);
Toast.makeText(this, R.string.cert_read_error, Toast.LENGTH_LONG).show();
} finally {
IoUtils.closeQuietly(in);
}
}
}
//packages/apps/CertInstaller/src/com/android/certinstaller/CredentialHelper.java
boolean installVpnAndAppsTrustAnchors(Context context, IKeyChainService keyChainService) {
final TrustedCertificateStore trustedCertificateStore = new TrustedCertificateStore();
for (X509Certificate caCert : mCaCerts) {
byte[] bytes = null;
try {
bytes = caCert.getEncoded();
} catch (CertificateEncodingException e) {
throw new AssertionError(e);
}
if (bytes != null) {
try {
keyChainService.installCaCertificate(bytes);
} catch (RemoteException e) {
Log.w(TAG, "installCaCertsToKeyChain(): " + e);
return false;
}
String alias = trustedCertificateStore.getCertificateAlias(caCert);
if (alias == null) {
Log.e(TAG, "alias is null");
return false;
}
maybeApproveCaCert(context, alias);
}
}
return true;
}

复制代码

//xqt552_sys/packages/apps/KeyChain/src/com/android/keychain/KeyChainService.java
@Override public String installCaCertificate(byte[] caCertificate) {
final CallerIdentity caller = getCaller();
Preconditions.checkCallAuthorization(isSystemUid(caller) || isCertInstaller(caller),
MSG_NOT_SYSTEM_OR_CERT_INSTALLER);
final String alias;
String subject = null;
final boolean isSecurityLoggingEnabled = mInjector.isSecurityLoggingEnabled();
final X509Certificate cert;
try {
cert = parseCertificate(caCertificate);
final boolean isDebugLoggable = Log.isLoggable(TAG, Log.DEBUG);
subject = cert.getSubjectX500Principal().getName(X500Principal.CANONICAL);
if (isDebugLoggable) {
Log.d(TAG, String.format("Installing CA certificate: %s", subject));
}
synchronized (mTrustedCertificateStore) {
mTrustedCertificateStore.installCertificate(cert);
alias = mTrustedCertificateStore.getCertificateAlias(cert);
}
} catch (IOException | CertificateException e) {
Log.w(TAG, "Failed installing CA certificate", e);
if (isSecurityLoggingEnabled && subject != null) {
mInjector.writeSecurityEvent(
TAG_CERT_AUTHORITY_INSTALLED, 0 /*result*/, subject,
UserHandle.myUserId());
}
throw new IllegalStateException(e);
}
if (isSecurityLoggingEnabled && subject != null) {
mInjector.writeSecurityEvent(
TAG_CERT_AUTHORITY_INSTALLED, 1 /*result*/, subject,
UserHandle.myUserId());
}
// If the caller is the cert installer, install the CA certificate into KeyStore.
// This is a temporary solution to enable CA certificates to be used as VPN trust
// anchors. Ultimately, the user should explicitly choose to install the VPN trust
// anchor separately and independently of CA certificates, at which point this code
// should be removed.
if (CERT_INSTALLER_PACKAGE.equals(caller.mPackageName)|| "android.uid.system:1000".equals(caller.mPackageName)) {
try {
mKeyStore.setCertificateEntry(String.format("%s %s", subject, alias), cert);
} catch(KeyStoreException e) {
Log.e(TAG, String.format(
"Attempted installing %s (subject: %s) to KeyStore. Failed", alias,
subject), e);
}
}
broadcastLegacyStorageChange();
broadcastTrustStoreChange();
return alias;
}
// external/conscrypt/repackaged/platform/src/main/java/com/android/org/conscrypt/TrustedCertificateStore.java
/**
* This non-{@code KeyStoreSpi} public interface is used by the
* {@code KeyChainService} to install new CA certificates. It
* silently ignores the certificate if it already exists in the
* store.
*/
@libcore.api.CorePlatformApi(status = libcore.api.CorePlatformApi.Status.STABLE)
public void installCertificate(X509Certificate cert) throws IOException, CertificateException {
if (cert == null) {
throw new NullPointerException("cert == null");
}
File system = getCertificateFile(systemDir, cert);
if (system.exists()) {
File deleted = getCertificateFile(deletedDir, cert);
if (deleted.exists()) {
// we have a system cert that was marked deleted.
// remove the deleted marker to expose the original
if (!deleted.delete()) {
throw new IOException("Could not remove " + deleted);
}
return;
}
// otherwise we just have a dup of an existing system cert.
// return taking no further action.
return;
}
File user = getCertificateFile(addedDir, cert);
if (user.exists()) {
// we have an already installed user cert, bail.
return;
}
// install the user cert
writeCertificate(user, cert);
}
private void writeCertificate(File file, X509Certificate cert)
throws IOException, CertificateException {
File dir = file.getParentFile();
dir.mkdirs();
dir.setReadable(true, false);
dir.setExecutable(true, false);
OutputStream os = null;
try {
os = new FileOutputStream(file);
os.write(cert.getEncoded());
} finally {
IoUtils.closeQuietly(os);
}
file.setReadable(true, false);
}

复制代码

版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。

复制代码