summaryrefslogtreecommitdiffstats
path: root/keystore
diff options
context:
space:
mode:
Diffstat (limited to 'keystore')
-rw-r--r--keystore/java/android/security/CertTool.java68
-rw-r--r--keystore/java/android/security/Keystore.java106
-rw-r--r--keystore/jni/cert.c114
-rw-r--r--keystore/jni/cert.h15
-rw-r--r--keystore/jni/certtool.c97
5 files changed, 274 insertions, 126 deletions
diff --git a/keystore/java/android/security/CertTool.java b/keystore/java/android/security/CertTool.java
index 26d22ae..79418bd 100644
--- a/keystore/java/android/security/CertTool.java
+++ b/keystore/java/android/security/CertTool.java
@@ -16,11 +16,19 @@
package android.security;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+
import android.content.Context;
import android.content.Intent;
import android.security.Keystore;
import android.text.TextUtils;
-
+import android.util.Log;
/**
* The CertTool class provides the functions to list the certs/keys,
@@ -41,12 +49,13 @@ public class CertTool {
public static final String KEY_NAMESPACE = "namespace";
public static final String KEY_DESCRIPTION = "description";
- private static final String TAG = "CertTool";
+ public static final String TITLE_CA_CERT = "CA Certificate";
+ public static final String TITLE_USER_CERT = "User Certificate";
+ public static final String TITLE_PKCS12_KEYSTORE = "PKCS12 Keystore";
+ public static final String TITLE_PRIVATE_KEY = "Private Key";
+ public static final int INCORRECT_PKCS12_PASSPHRASE = -100;
- private static final String TITLE_CA_CERT = "CA Certificate";
- private static final String TITLE_USER_CERT = "User Certificate";
- private static final String TITLE_PKCS12_KEYSTORE = "PKCS12 Keystore";
- private static final String TITLE_PRIVATE_KEY = "Private Key";
+ private static final String TAG = "CertTool";
private static final String UNKNOWN = "Unknown";
private static final String ISSUER_NAME = "Issuer Name:";
private static final String DISTINCT_NAME = "Distinct Name:";
@@ -58,6 +67,11 @@ public class CertTool {
private static final String KEYNAME_DELIMITER = "_";
private static final Keystore sKeystore = Keystore.getInstance();
+ private native int getPkcs12Handle(byte[] data, String password);
+ private native String getPkcs12Certificate(int handle);
+ private native String getPkcs12PrivateKey(int handle);
+ private native String popPkcs12CertificateStack(int handle);
+ private native void freePkcs12Handle(int handle);
private native String generateCertificateRequest(int bits, String subject);
private native boolean isPkcs12Keystore(byte[] data);
private native int generateX509Certificate(byte[] data);
@@ -130,10 +144,52 @@ public class CertTool {
intent.putExtra(KEY_NAMESPACE + "1", namespace);
}
+ private int extractAndStoreKeysFromPkcs12(int handle, String keyname) {
+ int ret, i = 0;
+ String pemData;
+
+ if ((pemData = getPkcs12Certificate(handle)) != null) {
+ if ((ret = sKeystore.put(USER_CERTIFICATE, keyname, pemData)) != 0) {
+ return ret;
+ }
+ }
+ if ((pemData = getPkcs12PrivateKey(handle)) != null) {
+ if ((ret = sKeystore.put(USER_KEY, keyname, pemData)) != 0) {
+ return ret;
+ }
+ }
+ while ((pemData = this.popPkcs12CertificateStack(handle)) != null) {
+ if (i++ > 0) {
+ if ((ret = sKeystore.put(CA_CERTIFICATE, keyname + i, pemData)) != 0) {
+ return ret;
+ }
+ } else {
+ if ((ret = sKeystore.put(CA_CERTIFICATE, keyname, pemData)) != 0) {
+ return ret;
+ }
+ }
+ }
+ return 0;
+ }
+
+ public int addPkcs12Keystore(byte[] p12Data, String password,
+ String keyname) {
+ int handle, ret;
+ Log.i("CertTool", "addPkcs12Keystore()");
+
+ if ((handle = getPkcs12Handle(p12Data, password)) == 0) {
+ return INCORRECT_PKCS12_PASSPHRASE;
+ }
+ ret = extractAndStoreKeysFromPkcs12(handle, keyname);
+ freePkcs12Handle(handle);
+ return ret;
+ }
+
public synchronized void addCertificate(byte[] data, Context context) {
int handle;
Intent intent = null;
+ Log.i("CertTool", "addCertificate()");
if (isPkcs12Keystore(data)) {
intent = prepareIntent(TITLE_PKCS12_KEYSTORE, data, USER_KEY,
UNKNOWN, UNKNOWN);
diff --git a/keystore/java/android/security/Keystore.java b/keystore/java/android/security/Keystore.java
index 1f14da7..a6cfbca 100644
--- a/keystore/java/android/security/Keystore.java
+++ b/keystore/java/android/security/Keystore.java
@@ -48,49 +48,6 @@ public abstract class Keystore {
public abstract int remove(String namespace, String keyname);
public abstract int reset();
- // TODO: for migrating to the mini-keystore, clean up from here
- /**
- */
- public abstract String getCaCertificate(String key);
-
- /**
- */
- public abstract String getUserCertificate(String key);
-
- /**
- */
- public abstract String getUserPrivateKey(String key);
-
- /**
- * Returns the array of the certificate keynames in keystore if successful.
- * Or return an empty array if error.
- *
- * @return array of the certificate keynames
- */
- public abstract String[] getAllUserCertificateKeys();
-
- /**
- */
- public abstract String[] getAllCaCertificateKeys();
-
- /**
- */
- public abstract String[] getSupportedKeyStrenghs();
-
- /**
- * Generates a key pair and returns the certificate request.
- * @param keyStrengthIndex index to the array of supported key strengths
- * @param challenge the challenge message in the keygen tag
- * @param organizations the organization string, e.g.,
- * "/C=US/ST={state}/L={city}/O={company}/OU={app}/CN={hostname}"
- * @return the certificate request
- */
- public abstract String generateKeyPair(
- int keyStrengthIndex, String challenge, String organizations);
-
- public abstract void addCertificate(byte[] cert);
- // to here
-
private static class FileKeystore extends Keystore {
private static final String SERVICE_NAME = "keystore";
private static final String CA_CERTIFICATE = "CaCertificate";
@@ -100,69 +57,6 @@ public abstract class Keystore {
private static final ServiceCommand mServiceCommand =
new ServiceCommand(SERVICE_NAME);
- // TODO: for migrating to the mini-keystore, start from here
- @Override
- public String getUserPrivateKey(String key) {
- return "";
- }
-
- @Override
- public String getUserCertificate(String key) {
- return "";
- }
-
- @Override
- public String getCaCertificate(String key) {
- return "";
- }
-
- @Override
- public String[] getAllUserCertificateKeys() {
- return new String[0];
- }
-
- @Override
- public String[] getAllCaCertificateKeys() {
- return new String[0];
- }
-
- @Override
- public String[] getSupportedKeyStrenghs() {
- // TODO: real implementation
- return new String[] {"High Grade", "Medium Grade"};
- }
-
- @Override
- public String generateKeyPair(int keyStrengthIndex, String challenge,
- String organizations) {
- // TODO: real implementation
- return "-----BEGIN CERTIFICATE REQUEST-----"
- + "\nMIICzjCCAbYCAQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh"
- + "\nMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKEwpHb29nbGUgSW5jMRYw"
- + "\nFAYDVQQLEw1SZW1vdGUgQWNjZXNzMRAwDgYDVQQLEwdHbGFwdG9wMQ0wCwYDVQQD"
- + "\nEwR0ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAznwy7a16O35u"
- + "\nODLQOw6yHAxozrrX1J+c0reiIh8GYohwKrBedFnQ/FnTls6bxY4fNHD+SZvFFgvU"
- + "\nECBFOfRmRm7AFo51qT0t2a8qgvDLM6L1qGkmy94W28Q3OlcpF2QianHYdjyGT+Ac"
- + "\nYDek1Zi/E/mdPzuVM/K8tkB7n8ktC0PTm1ZtdMRauE5R0WrEhWuF6In/2gy1Q/Zh"
- + "\noy7/zQqpbPl2ouulvkx1Y3OXHM6XPNFLoHS1gH0HyAuBUokO0QmetRn6ngJSvz7e"
- + "\nVD7QYRppGp+g4BxqaV9XSxhaaKrMs4PAld9enV51X9qjvjCRBve2QxtuJgMfGJdU"
- + "\njGr/JweZoQIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBADtxOtEseoLOVYh6sh4b"
- + "\nWCdngK87uHn2bdGipFwKdNTxQDdxNQLAKdoGYIfbVsC1cDgFiufeNwVukxxymdnm"
- + "\nk0GGK+0O0tZKENv8ysgfbgEsHpJH9FoR5Y5XEq1etejkcgCp59dyhrSk0DLyVm0D"
- + "\nIfTC/nsK95H7AAGOkbbDFo2otyLNNrthYncQ9diAG0UzzLacA+86JXZmD3HyC48u"
- + "\nI9hsivVnTTfl9afcfVAhfxbQ6HgkhZZjbjFjfABSd4v8wKlAAqK58VxCajNVOVcV"
- + "\ncCzOWf6NpE7xEHCf32i8bWDP6hi0WgQcdpQwnZNKhhTLGNb23Uty6HYlJhbxexC7"
- + "\nUoM="
- + "\n-----END CERTIFICATE REQUEST-----";
- }
-
- @Override
- public void addCertificate(byte[] cert) {
- // TODO: real implementation
- }
-
- // to here
-
@Override
public int lock() {
Reply result = mServiceCommand.execute(ServiceCommand.LOCK, null);
diff --git a/keystore/jni/cert.c b/keystore/jni/cert.c
index cc36b84..0db28fd 100644
--- a/keystore/jni/cert.c
+++ b/keystore/jni/cert.c
@@ -136,30 +136,126 @@ err:
return ret_code;
}
-int is_pkcs12(const char *buf, int bufLen)
+PKCS12 *get_p12_handle(const char *buf, int bufLen)
{
- int ret = 0;
BIO *bp = NULL;
PKCS12 *p12 = NULL;
- if (!buf || bufLen < 1) goto err;
+ if (!buf || (bufLen < 1) || (buf[0] != 48)) goto err;
bp = BIO_new(BIO_s_mem());
if (!bp) goto err;
- if (buf[0] != 48) goto err; // it is not DER.
-
if (!BIO_write(bp, buf, bufLen)) goto err;
- if ((p12 = d2i_PKCS12_bio(bp, NULL)) != NULL) {
- PKCS12_free(p12);
- ret = 1;
- }
+ p12 = d2i_PKCS12_bio(bp, NULL);
+
err:
if (bp) BIO_free(bp);
+ return p12;
+}
+
+PKCS12_KEYSTORE *get_pkcs12_keystore_handle(const char *buf, int bufLen,
+ const char *passwd)
+{
+ PKCS12_KEYSTORE *p12store = NULL;
+ EVP_PKEY *pkey = NULL;
+ X509 *cert = NULL;
+ STACK_OF(X509) *certs = NULL;
+ PKCS12 *p12 = get_p12_handle(buf, bufLen);
+
+ if (p12 == NULL) return NULL;
+ if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) {
+ LOGE("Can not parse PKCS12 content");
+ PKCS12_free(p12);
+ return NULL;
+ }
+ if ((p12store = malloc(sizeof(PKCS12_KEYSTORE))) == NULL) {
+ if (cert) X509_free(cert);
+ if (pkey) EVP_PKEY_free(pkey);
+ if (certs) sk_X509_free(certs);
+ }
+ p12store->p12 = p12;
+ p12store->pkey = pkey;
+ p12store->cert = cert;
+ p12store->certs = certs;
+ return p12store;
+}
+
+void free_pkcs12_keystore(PKCS12_KEYSTORE *p12store)
+{
+ if (p12store != NULL) {
+ if (p12store->cert) X509_free(p12store->cert);
+ if (p12store->pkey) EVP_PKEY_free(p12store->pkey);
+ if (p12store->certs) sk_X509_free(p12store->certs);
+ free(p12store);
+ }
+}
+
+int is_pkcs12(const char *buf, int bufLen)
+{
+ int ret = 0;
+ PKCS12 *p12 = get_p12_handle(buf, bufLen);
+ if (p12 != NULL) ret = 1;
+ PKCS12_free(p12);
return ret;
}
+static int convert_to_pem(void *data, int is_cert, char *buf, int size)
+{
+ int len = 0;
+ BIO *bio = NULL;
+
+ if (data == NULL) return -1;
+
+ if ((bio = BIO_new(BIO_s_mem())) == NULL) goto err;
+ if (is_cert) {
+ if ((len = PEM_write_bio_X509(bio, (X509*)data)) == 0) {
+ goto err;
+ }
+ } else {
+ if ((len = PEM_write_bio_PrivateKey(bio, (EVP_PKEY *)data, NULL,
+ NULL, 0, NULL, NULL)) == 0) {
+ goto err;
+ }
+ }
+ if (len < size && (len = BIO_read(bio, buf, size - 1)) > 0) {
+ buf[len] = 0;
+ }
+err:
+ if (bio) BIO_free(bio);
+ return (len == 0) ? -1 : 0;
+}
+
+int get_pkcs12_certificate(PKCS12_KEYSTORE *p12store, char *buf, int size)
+{
+ if ((p12store != NULL) && (p12store->cert != NULL)) {
+ return convert_to_pem((void*)p12store->cert, 1, buf, size);
+ }
+ return -1;
+}
+
+int get_pkcs12_private_key(PKCS12_KEYSTORE *p12store, char *buf, int size)
+{
+ if ((p12store != NULL) && (p12store->pkey != NULL)) {
+ return convert_to_pem((void*)p12store->pkey, 0, buf, size);
+ }
+ return -1;
+}
+
+int pop_pkcs12_certs_stack(PKCS12_KEYSTORE *p12store, char *buf, int size)
+{
+ X509 *cert = NULL;
+
+ if ((p12store != NULL) && (p12store->certs != NULL) &&
+ ((cert = sk_X509_pop(p12store->certs)) != NULL)) {
+ int ret = convert_to_pem((void*)cert, 1, buf, size);
+ X509_free(cert);
+ return ret;
+ }
+ return -1;
+}
+
X509* parse_cert(const char *buf, int bufLen)
{
X509 *cert = NULL;
diff --git a/keystore/jni/cert.h b/keystore/jni/cert.h
index a9807b1..aaa7602 100644
--- a/keystore/jni/cert.h
+++ b/keystore/jni/cert.h
@@ -41,6 +41,13 @@ typedef struct {
int key_len;
} PKEY_STORE;
+typedef struct {
+ PKCS12 *p12;
+ EVP_PKEY *pkey;
+ X509 *cert;
+ STACK_OF(X509) *certs;
+} PKCS12_KEYSTORE;
+
#define PKEY_STORE_free(x) { \
if(x.pkey) EVP_PKEY_free(x.pkey); \
if(x.public_key) free(x.public_key); \
@@ -49,8 +56,14 @@ typedef struct {
#define nelem(x) (sizeof (x) / sizeof *(x))
int gen_csr(int bits, const char *organizations, char reply[REPLY_MAX]);
+PKCS12_KEYSTORE *get_pkcs12_keystore_handle(const char *buf, int bufLen,
+ const char *passwd);
+int get_pkcs12_certificate(PKCS12_KEYSTORE *p12store, char *buf, int size);
+int get_pkcs12_private_key(PKCS12_KEYSTORE *p12store, char *buf, int size);
+int pop_pkcs12_certs_stack(PKCS12_KEYSTORE *p12store, char *buf, int size);
+void free_pkcs12_keystore(PKCS12_KEYSTORE *p12store);
int is_pkcs12(const char *buf, int bufLen);
-X509* parse_cert(const char *buf, int bufLen);
+X509 *parse_cert(const char *buf, int bufLen);
int get_cert_name(X509 *cert, char *buf, int size);
int get_issuer_name(X509 *cert, char *buf, int size);
int is_ca_cert(X509 *cert);
diff --git a/keystore/jni/certtool.c b/keystore/jni/certtool.c
index fabf5cd..1ae8dab 100644
--- a/keystore/jni/certtool.c
+++ b/keystore/jni/certtool.c
@@ -19,10 +19,13 @@
#include <string.h>
#include <jni.h>
#include <cutils/log.h>
+#include <openssl/pkcs12.h>
#include <openssl/x509v3.h>
#include "cert.h"
+typedef int PKCS12_KEYSTORE_FUNC(PKCS12_KEYSTORE *store, char *buf, int size);
+
jstring
android_security_CertTool_generateCertificateRequest(JNIEnv* env,
jobject thiz,
@@ -42,12 +45,88 @@ android_security_CertTool_isPkcs12Keystore(JNIEnv* env,
jobject thiz,
jbyteArray data)
{
- char buf[REPLY_MAX];
int len = (*env)->GetArrayLength(env, data);
- if (len > REPLY_MAX) return 0;
- (*env)->GetByteArrayRegion(env, data, 0, len, (jbyte*)buf);
- return (jboolean) is_pkcs12(buf, len);
+ if (len > 0) {
+ PKCS12 *handle = NULL;
+ char buf[len];
+
+ (*env)->GetByteArrayRegion(env, data, 0, len, (jbyte*)buf);
+ return (jboolean)is_pkcs12(buf, len);
+ } else {
+ return 0;
+ }
+}
+
+jint
+android_security_CertTool_getPkcs12Handle(JNIEnv* env,
+ jobject thiz,
+ jbyteArray data,
+ jstring jPassword)
+{
+ jboolean bIsCopy;
+ int len = (*env)->GetArrayLength(env, data);
+ const char* passwd = (*env)->GetStringUTFChars(env, jPassword , &bIsCopy);
+
+ if (len > 0) {
+ PKCS12_KEYSTORE *handle = NULL;
+ char buf[len];
+
+ (*env)->GetByteArrayRegion(env, data, 0, len, (jbyte*)buf);
+ handle = get_pkcs12_keystore_handle(buf, len, passwd);
+ (*env)->ReleaseStringUTFChars(env, jPassword, passwd);
+ return (jint)handle;
+ } else {
+ return 0;
+ }
+}
+
+jstring call_pkcs12_ks_func(PKCS12_KEYSTORE_FUNC *func,
+ JNIEnv* env,
+ jobject thiz,
+ jint phandle)
+{
+ char buf[REPLY_MAX];
+
+ if (phandle == 0) return NULL;
+ if (func((PKCS12_KEYSTORE*)phandle, buf, sizeof(buf)) == 0) {
+ return (*env)->NewStringUTF(env, buf);
+ }
+ return NULL;
+}
+
+jstring
+android_security_CertTool_getPkcs12Certificate(JNIEnv* env,
+ jobject thiz,
+ jint phandle)
+{
+ return call_pkcs12_ks_func((PKCS12_KEYSTORE_FUNC *)get_pkcs12_certificate,
+ env, thiz, phandle);
+}
+
+jstring
+android_security_CertTool_getPkcs12PrivateKey(JNIEnv* env,
+ jobject thiz,
+ jint phandle)
+{
+ return call_pkcs12_ks_func((PKCS12_KEYSTORE_FUNC *)get_pkcs12_private_key,
+ env, thiz, phandle);
+}
+
+jstring
+android_security_CertTool_popPkcs12CertificateStack(JNIEnv* env,
+ jobject thiz,
+ jint phandle)
+{
+ return call_pkcs12_ks_func((PKCS12_KEYSTORE_FUNC *)pop_pkcs12_certs_stack,
+ env, thiz, phandle);
+}
+
+void android_security_CertTool_freePkcs12Handle(JNIEnv* env,
+ jobject thiz,
+ jint handle)
+{
+ if (handle != 0) free_pkcs12_keystore((PKCS12_KEYSTORE*)handle);
}
jint
@@ -117,6 +196,16 @@ static JNINativeMethod gCertToolMethods[] = {
(void*)android_security_CertTool_generateCertificateRequest},
{"isPkcs12Keystore", "([B)Z",
(void*)android_security_CertTool_isPkcs12Keystore},
+ {"getPkcs12Handle", "([BLjava/lang/String;)I",
+ (void*)android_security_CertTool_getPkcs12Handle},
+ {"getPkcs12Certificate", "(I)Ljava/lang/String;",
+ (void*)android_security_CertTool_getPkcs12Certificate},
+ {"getPkcs12PrivateKey", "(I)Ljava/lang/String;",
+ (void*)android_security_CertTool_getPkcs12PrivateKey},
+ {"popPkcs12CertificateStack", "(I)Ljava/lang/String;",
+ (void*)android_security_CertTool_popPkcs12CertificateStack},
+ {"freePkcs12Handle", "(I)V",
+ (void*)android_security_CertTool_freePkcs12Handle},
{"generateX509Certificate", "([B)I",
(void*)android_security_CertTool_generateX509Certificate},
{"isCaCertificate", "(I)Z",
generated by cgit v1.1 at 2025-08-21 03:45:41 +0000