blob: 78669c51f76c8d8e75cdee45ae36201913e58cc3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
/*
* Copyright (C) 2015 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.security.net.config;
import android.content.Context;
import android.util.ArraySet;
import libcore.io.IoUtils;
import java.io.InputStream;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Collection;
import java.util.Collections;
import java.util.Set;
import com.android.org.conscrypt.TrustedCertificateIndex;
/**
* {@link CertificateSource} based on certificates contained in an application resource file.
* @hide
*/
public class ResourceCertificateSource implements CertificateSource {
private final Object mLock = new Object();
private final int mResourceId;
private Set<X509Certificate> mCertificates;
private Context mContext;
private TrustedCertificateIndex mIndex;
public ResourceCertificateSource(int resourceId, Context context) {
mResourceId = resourceId;
mContext = context;
}
private void ensureInitialized() {
synchronized (mLock) {
if (mCertificates != null) {
return;
}
Set<X509Certificate> certificates = new ArraySet<X509Certificate>();
Collection<? extends Certificate> certs;
InputStream in = null;
try {
CertificateFactory factory = CertificateFactory.getInstance("X.509");
in = mContext.getResources().openRawResource(mResourceId);
certs = factory.generateCertificates(in);
} catch (CertificateException e) {
throw new RuntimeException("Failed to load trust anchors from id " + mResourceId,
e);
} finally {
IoUtils.closeQuietly(in);
}
TrustedCertificateIndex indexLocal = new TrustedCertificateIndex();
for (Certificate cert : certs) {
certificates.add((X509Certificate) cert);
indexLocal.index((X509Certificate) cert);
}
mCertificates = certificates;
mIndex = indexLocal;
mContext = null;
}
}
@Override
public Set<X509Certificate> getCertificates() {
ensureInitialized();
return mCertificates;
}
@Override
public X509Certificate findBySubjectAndPublicKey(X509Certificate cert) {
ensureInitialized();
java.security.cert.TrustAnchor anchor = mIndex.findBySubjectAndPublicKey(cert);
if (anchor == null) {
return null;
}
return anchor.getTrustedCert();
}
@Override
public X509Certificate findByIssuerAndSignature(X509Certificate cert) {
ensureInitialized();
java.security.cert.TrustAnchor anchor = mIndex.findByIssuerAndSignature(cert);
if (anchor == null) {
return null;
}
return anchor.getTrustedCert();
}
@Override
public Set<X509Certificate> findAllByIssuerAndSignature(X509Certificate cert) {
ensureInitialized();
Set<java.security.cert.TrustAnchor> anchors = mIndex.findAllByIssuerAndSignature(cert);
if (anchors.isEmpty()) {
return Collections.<X509Certificate>emptySet();
}
Set<X509Certificate> certs = new ArraySet<X509Certificate>(anchors.size());
for (java.security.cert.TrustAnchor anchor : anchors) {
certs.add(anchor.getTrustedCert());
}
return certs;
}
@Override
public void handleTrustStorageUpdate() {
// Nothing to do, resource sources never change.
}
}
|
