| /* |
| * Copyright (C) 2009 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package com.android.certinstaller; |
| |
| import android.app.Activity; |
| import android.app.AlertDialog; |
| import android.app.Dialog; |
| import android.app.ProgressDialog; |
| import android.content.ActivityNotFoundException; |
| import android.content.DialogInterface; |
| import android.content.Intent; |
| import android.os.Bundle; |
| import android.os.Environment; |
| import android.os.FileObserver; |
| import android.preference.Preference; |
| import android.preference.PreferenceActivity; |
| import android.preference.PreferenceScreen; |
| import android.security.Credentials; |
| import android.security.KeyStore; |
| import android.text.Html; |
| import android.text.TextUtils; |
| import android.util.Log; |
| import android.view.View; |
| import android.widget.TextView; |
| import android.widget.Toast; |
| |
| import org.bouncycastle.asn1.ASN1InputStream; |
| import org.bouncycastle.asn1.ASN1Sequence; |
| import org.bouncycastle.asn1.DEROctetString; |
| import org.bouncycastle.asn1.x509.BasicConstraints; |
| import org.bouncycastle.openssl.PEMWriter; |
| |
| import java.io.ByteArrayInputStream; |
| import java.io.ByteArrayOutputStream; |
| import java.io.File; |
| import java.io.FileFilter; |
| import java.io.FileInputStream; |
| import java.io.IOException; |
| import java.io.ObjectInputStream; |
| import java.io.ObjectOutputStream; |
| import java.io.OutputStreamWriter; |
| import java.io.Serializable; |
| import java.security.KeyStore.PasswordProtection; |
| import java.security.KeyStore.PrivateKeyEntry; |
| import java.security.KeyFactory; |
| import java.security.MessageDigest; |
| import java.security.NoSuchAlgorithmException; |
| import java.security.PrivateKey; |
| import java.security.PublicKey; |
| import java.security.cert.Certificate; |
| import java.security.cert.CertificateFactory; |
| import java.security.cert.X509Certificate; |
| import java.security.spec.PKCS8EncodedKeySpec; |
| import java.util.ArrayList; |
| import java.util.Enumeration; |
| import java.util.LinkedHashMap; |
| import java.util.List; |
| import java.util.Map; |
| |
| /** |
| * Installs certificates to the system keystore. It reacts to the |
| * {@link Credentials#INSTALL_ACTION} intent. |
| */ |
| public class CertInstaller extends PreferenceActivity |
| implements Preference.OnPreferenceClickListener, FileFilter, |
| DialogInterface.OnCancelListener { |
| private static final String TAG = "CertInstaller"; |
| |
| private static final int NAME_CREDENTIAL_DIALOG = 1; |
| private static final int PKCS12_PASSWORD_DIALOG = 2; |
| private static final int PROGRESS_BAR_DIALOG = 3; |
| private static final int REQUEST_SYSTEM_INSTALL_CODE = 1; |
| |
| private static final String DOWNLOAD = "download"; |
| |
| // dialog result |
| private static final int REOPEN = 1; // re-open the dialog |
| private static final int DONE = 2; |
| private static final int CANCELLED = 3; |
| |
| private static final byte[] PKEY_MAP_KEY = "PKEY_MAP".getBytes(); |
| |
| private KeyStore mKeyStore = KeyStore.getInstance(); |
| private View mView; |
| private int mDialogResult = REOPEN; |
| |
| private boolean mIsBrowsingSdCard; |
| private SdCardMonitor mSdCardMonitor; |
| private File mCertFile; |
| |
| private CredentialHelper mCredentials; |
| private Runnable mBottomHalf; |
| |
| @Override |
| protected void onCreate(Bundle savedInstanceState) { |
| super.onCreate(savedInstanceState); |
| handleIntents(getIntent()); |
| } |
| |
| @Override |
| protected void onResume() { |
| super.onResume(); |
| if (mBottomHalf != null) { |
| Runnable r = mBottomHalf; |
| mBottomHalf = null; |
| r.run(); |
| } |
| } |
| |
| @Override |
| protected void onDestroy() { |
| super.onDestroy(); |
| stopSdCardMonitor(); |
| } |
| |
| @Override |
| protected Dialog onCreateDialog (int id) { |
| switch (id) { |
| case PKCS12_PASSWORD_DIALOG: |
| return createPkcs12PasswordDialog(); |
| |
| case NAME_CREDENTIAL_DIALOG: |
| return createNameCredentialDialog(); |
| |
| case PROGRESS_BAR_DIALOG: |
| ProgressDialog dialog = new ProgressDialog(this); |
| dialog.setMessage(getString(R.string.extracting_pkcs12)); |
| dialog.setIndeterminate(true); |
| dialog.setCancelable(false); |
| return dialog; |
| |
| default: |
| return null; |
| } |
| } |
| |
| @Override |
| protected void onActivityResult(int requestCode, int resultCode, Intent data) { |
| super.onActivityResult(requestCode, resultCode, data); |
| |
| if (requestCode == REQUEST_SYSTEM_INSTALL_CODE) { |
| if (resultCode == RESULT_OK) { |
| Log.d(TAG, "credential is added: " + mCredentials.getName()); |
| Toast.makeText(this, |
| getString(R.string.cert_is_added, |
| mCredentials.getName()), |
| Toast.LENGTH_LONG).show(); |
| deleteCert(mCertFile); |
| if (!mIsBrowsingSdCard) finish(); |
| } else { |
| Log.d(TAG, "credential not saved, err: " + resultCode); |
| toastErrorAndFinish(R.string.cert_not_saved); |
| } |
| } else { |
| Log.w(TAG, "unknown request code: " + requestCode); |
| return; |
| } |
| } |
| |
| private void handleIntents(Intent intent) { |
| if (intent == null) return; |
| String action = intent.getAction(); |
| |
| if (Credentials.INSTALL_ACTION.equals(action)) { |
| mCredentials = new CredentialHelper(intent); |
| |
| if (!mCredentials.containsAny()) { |
| mIsBrowsingSdCard = true; |
| addPreferencesFromResource(R.xml.pick_file_pref); |
| startSdCardMonitor(); |
| createFileList(); |
| } else if (mCredentials.isPkcs12KeyStore()) { |
| showDialog(PKCS12_PASSWORD_DIALOG); |
| } else { |
| installAskingKeyStoreAccess(); |
| } |
| } |
| } |
| |
| private void installAskingKeyStoreAccess() { |
| if (mCredentials.isKeyPair()) { |
| if (isKeyStoreLocked()) { |
| unlockKeyStoreWithBottomHalf(); |
| return; |
| } |
| saveKeyPair(); |
| finish(); |
| } else { |
| X509Certificate crt = mCredentials.getUserCertificate(); |
| if (crt != null) { |
| // find matched private key |
| String key = toMd5(crt.getPublicKey().getEncoded()); |
| Map<String, byte[]> map = getPkeyMap(); |
| byte[] privatekey = map.get(key); |
| if (privatekey != null) { |
| if (isKeyStoreLocked()) { |
| unlockKeyStoreWithBottomHalf(); |
| return; |
| } |
| Log.d(TAG, "found matched key: " + privatekey); |
| map.remove(key); |
| setPkeyMap(map); |
| |
| mCredentials.setPrivateKey(privatekey); |
| } else { |
| Log.d(TAG, "didn't find matched private key: " + key); |
| } |
| } |
| nameCredential(); |
| } |
| } |
| |
| private void unlockKeyStoreWithBottomHalf() { |
| mBottomHalf = new Runnable() { |
| public void run() { |
| if (!isKeyStoreLocked()) { |
| installAskingKeyStoreAccess(); |
| } else { |
| toastErrorAndFinish(R.string.cert_not_saved); |
| } |
| } |
| }; |
| Credentials.getInstance().unlock(this); |
| } |
| |
| private void nameCredential() { |
| if (!mCredentials.readyForSystemInstall()) { |
| toastErrorAndFinish(R.string.no_cert_to_saved); |
| } else { |
| showDialog(NAME_CREDENTIAL_DIALOG); |
| } |
| } |
| |
| private void saveKeyPair() { |
| byte[] privatekey = mCredentials.getData(Credentials.PRIVATE_KEY); |
| String key = toMd5(mCredentials.getData(Credentials.PUBLIC_KEY)); |
| Map<String, byte[]> map = getPkeyMap(); |
| map.put(key, privatekey); |
| setPkeyMap(map); |
| Log.d(TAG, "privatekey key: " + key + " --> #keys:" + map.size()); |
| } |
| |
| private void setPkeyMap(Map<String, byte[]> map) { |
| try { |
| ByteArrayOutputStream baos = new ByteArrayOutputStream(); |
| ObjectOutputStream os = new ObjectOutputStream(baos); |
| os.writeObject(map); |
| os.close(); |
| if (!mKeyStore.put(PKEY_MAP_KEY, baos.toByteArray())) { |
| Log.w(TAG, "setPkeyMap(): failed to write pkey map"); |
| } |
| } catch (Exception e) { |
| // if anything wrong, we lost the private key |
| Log.w(TAG, "setPkeyMap(): " + e); |
| } |
| } |
| |
| private Map<String, byte[]> getPkeyMap() { |
| byte[] bytes = mKeyStore.get(PKEY_MAP_KEY); |
| if (bytes != null) { |
| try { |
| ObjectInputStream is = |
| new ObjectInputStream(new ByteArrayInputStream(bytes)); |
| Map<String, byte[]> map = (Map<String, byte[]>) is.readObject(); |
| if (map != null) return map; |
| } catch (Exception e) { |
| // if anything wrong, create a new map |
| Log.w(TAG, "getPkeyMap(): " + e); |
| } |
| } |
| |
| return new MyMap(); |
| } |
| |
| public void onCancel(DialogInterface dialog) { |
| mDialogResult = CANCELLED; |
| } |
| |
| private Dialog createPkcs12PasswordDialog() { |
| mView = View.inflate(this, R.layout.password_dialog, null); |
| mDialogResult = REOPEN; |
| |
| DialogInterface.OnClickListener onClickHandler = |
| new DialogInterface.OnClickListener() { |
| public void onClick(DialogInterface dialog, int which) { |
| if (which == DialogInterface.BUTTON_NEGATIVE) { |
| onCancel(dialog); |
| return; |
| } |
| |
| String passwd = getViewText(R.id.credential_password); |
| |
| hideError(); |
| if (TextUtils.isEmpty(passwd)) { |
| showError(R.string.password_empty_error); |
| } else { |
| mDialogResult = DONE; |
| } |
| } |
| }; |
| |
| DialogInterface.OnDismissListener onDismissHandler = |
| new DialogInterface.OnDismissListener() { |
| public void onDismiss(DialogInterface dialog) { |
| if (isFinishing()) mDialogResult = CANCELLED; |
| |
| // Original code without progress bar: |
| //if (mDialogResult == DONE) { |
| // String passwd = getViewText(R.id.credential_password); |
| // if (!mCredentials.extractFromPkcs12(passwd)) { |
| // mDialogResult = REOPEN; |
| // showError(R.string.password_error); |
| // } |
| //} |
| //enterPasswdDialogBottomHalf(); |
| |
| // show progress bar and extract certs in a background thread |
| if (mDialogResult == DONE) { |
| showDialog(PROGRESS_BAR_DIALOG); |
| |
| final String passwd = getViewText(R.id.credential_password); |
| new Thread(new Runnable() { |
| public void run() { |
| if (!mCredentials.extractFromPkcs12(passwd)) { |
| mDialogResult = REOPEN; |
| showError(R.string.password_error); |
| } |
| removeDialog(PROGRESS_BAR_DIALOG); |
| runOnUiThread(new Runnable() { |
| public void run() { |
| enterPasswdDialogBottomHalf(); |
| } |
| }); |
| } |
| }).start(); |
| } else { |
| enterPasswdDialogBottomHalf(); |
| } |
| } |
| }; |
| |
| String title = (mCertFile == null) |
| ? getString(R.string.pkcs12_password_dialog_title) |
| : getString(R.string.pkcs12_file_password_dialog_title, |
| mCertFile.getName()); |
| Dialog d = new AlertDialog.Builder(this) |
| .setView(mView) |
| .setTitle(title) |
| .setPositiveButton(android.R.string.ok, onClickHandler) |
| .setNegativeButton(android.R.string.cancel, onClickHandler) |
| .setOnCancelListener(this) |
| .create(); |
| d.setOnDismissListener(onDismissHandler); |
| return d; |
| } |
| |
| private void enterPasswdDialogBottomHalf() { |
| if (mDialogResult == DONE) { |
| nameCredential(); |
| } else if (mDialogResult == REOPEN) { |
| showDialog(PKCS12_PASSWORD_DIALOG); |
| return; |
| } else { |
| toastErrorAndFinish(R.string.cert_not_saved); |
| } |
| removeDialog(PKCS12_PASSWORD_DIALOG); |
| } |
| |
| private Dialog createNameCredentialDialog() { |
| mView = View.inflate(this, R.layout.name_credential_dialog, null); |
| mDialogResult = REOPEN; |
| |
| setViewText(R.id.credential_name_title, R.string.credential_name); |
| setViewText(R.id.credential_info_title, R.string.credential_info); |
| setViewText(R.id.credential_info, |
| mCredentials.getDescription().toString()); |
| |
| DialogInterface.OnClickListener onClickHandler = |
| new DialogInterface.OnClickListener() { |
| public void onClick(DialogInterface dialog, int which) { |
| if (which == DialogInterface.BUTTON_NEGATIVE) { |
| onCancel(dialog); |
| return; |
| } |
| |
| hideError(); |
| |
| String name = getViewText(R.id.credential_name); |
| if (TextUtils.isEmpty(name)) { |
| showError(R.string.name_empty_error); |
| } else { |
| mCredentials.setName(name); |
| mDialogResult = DONE; |
| } |
| } |
| }; |
| |
| DialogInterface.OnDismissListener onDismissHandler = |
| new DialogInterface.OnDismissListener() { |
| public void onDismiss(DialogInterface dialog) { |
| if (isFinishing()) mDialogResult = CANCELLED; |
| |
| if (mDialogResult == DONE) { |
| // install everything to system keystore |
| try { |
| startActivityForResult( |
| mCredentials.createSystemInstallIntent(), |
| REQUEST_SYSTEM_INSTALL_CODE); |
| } catch (ActivityNotFoundException e) { |
| Log.w(TAG, "systemInstall(): " + e); |
| toastErrorAndFinish(R.string.cert_not_saved); |
| } |
| } else if (mDialogResult == REOPEN) { |
| showDialog(NAME_CREDENTIAL_DIALOG); |
| return; |
| } else { |
| toastErrorAndFinish(R.string.cert_not_saved); |
| } |
| removeDialog(NAME_CREDENTIAL_DIALOG); |
| } |
| }; |
| |
| Dialog d = new AlertDialog.Builder(this) |
| .setView(mView) |
| .setTitle(R.string.name_credential_dialog_title) |
| .setPositiveButton(android.R.string.ok, onClickHandler) |
| .setNegativeButton(android.R.string.cancel, onClickHandler) |
| .setOnCancelListener(this) |
| .create(); |
| d.setOnDismissListener(onDismissHandler); |
| return d; |
| } |
| |
| private void setAllFilesEnabled(boolean enabled) { |
| PreferenceScreen root = getPreferenceScreen(); |
| for (int i = 0, n = root.getPreferenceCount(); i < n; i++) { |
| root.getPreference(i).setEnabled(enabled); |
| } |
| } |
| |
| public boolean onPreferenceClick(Preference pref) { |
| File file = new File(Environment.getExternalStorageDirectory(), |
| pref.getTitle().toString()); |
| if (file.isDirectory()) { |
| Log.w(TAG, "impossible to pick a directory! " + file); |
| } else { |
| setAllFilesEnabled(false); |
| installFromSdCard(file); |
| } |
| return true; |
| } |
| |
| private void createFileList() { |
| if (isFinishing()) { |
| Log.d(TAG, "finishing, exit createFileList()"); |
| return; |
| } |
| try { |
| PreferenceScreen root = getPreferenceScreen(); |
| root.removeAll(); |
| File dir = Environment.getExternalStorageDirectory(); |
| createPreferencesFor(new File(dir, DOWNLOAD)); |
| createPreferencesFor(dir); |
| if (root.getPreferenceCount() == 0) { |
| Toast.makeText(this, R.string.no_pkcs12_found, |
| Toast.LENGTH_SHORT).show(); |
| } |
| } catch (IOException e) { |
| // should not occur |
| Log.w(TAG, "createFileList(): " + e); |
| throw new RuntimeException(e); |
| } |
| } |
| |
| private void createPreferencesFor(File dir) throws IOException { |
| if ((dir == null) || !dir.isDirectory()) return; |
| |
| PreferenceScreen root = getPreferenceScreen(); |
| int prefixEnd = Environment.getExternalStorageDirectory() |
| .getCanonicalPath().length() + 1; |
| for (File f : dir.listFiles(this)) { |
| Preference p = new Preference(this); |
| p.setTitle(f.getCanonicalPath().substring(prefixEnd)); |
| root.addPreference(p); |
| p.setOnPreferenceClickListener(this); |
| } |
| } |
| |
| public boolean accept(File file) { |
| if (!file.isDirectory()) { |
| return file.getPath().endsWith(".p12"); |
| } else { |
| return false; |
| } |
| } |
| |
| private void toastErrorAndFinish(int msgId) { |
| if (msgId == R.string.cert_not_saved) { |
| toastErrorAndFinish(msgId, Toast.LENGTH_SHORT); |
| } else { |
| toastErrorAndFinish(msgId, Toast.LENGTH_LONG); |
| } |
| } |
| |
| private void toastErrorAndFinish(int msgId, int duration) { |
| toastErrorAndFinish(getString(msgId), duration); |
| } |
| |
| private void toastErrorAndFinish(String msg, int duration) { |
| Toast.makeText(this, msg, duration).show(); |
| |
| if (mIsBrowsingSdCard) { |
| setAllFilesEnabled(true); |
| } else { |
| finish(); |
| } |
| } |
| |
| private void installFromSdCard(File file) { |
| Log.d(TAG, "install cert from " + file); |
| |
| mCertFile = file; |
| if (file.exists()) { |
| long length = file.length(); |
| if (length < 1000000) { |
| byte[] data = readCert(file); |
| if (data == null) { |
| toastErrorAndFinish(R.string.cert_read_error); |
| return; |
| } |
| mCredentials.putData(Credentials.PKCS12, data); |
| showDialog(PKCS12_PASSWORD_DIALOG); |
| } else { |
| Log.w(TAG, "cert file is too large: " + length); |
| toastErrorAndFinish(R.string.cert_too_large_error); |
| } |
| } else { |
| Log.w(TAG, "cert file does not exist"); |
| toastErrorAndFinish(R.string.cert_missing_error); |
| } |
| } |
| |
| private byte[] readCert(File file) { |
| try { |
| byte[] data = new byte[(int) file.length()]; |
| FileInputStream fis = new FileInputStream(file); |
| fis.read(data); |
| fis.close(); |
| return data; |
| } catch (Exception e) { |
| Log.w(TAG, "cert file read error: " + e); |
| return null; |
| } |
| } |
| |
| private void deleteCert(File file) { |
| if ((file != null) && !file.delete()) { |
| Log.w(TAG, "cannot delete cert: " + file); |
| } |
| } |
| |
| private boolean isKeyStoreLocked() { |
| return (mKeyStore.test() != KeyStore.NO_ERROR); |
| } |
| |
| private TextView showError(int msgId) { |
| TextView v = (TextView) mView.findViewById(R.id.error); |
| v.setText(msgId); |
| if (v != null) v.setVisibility(View.VISIBLE); |
| return v; |
| } |
| |
| private void hide(int viewId) { |
| View v = mView.findViewById(viewId); |
| if (v != null) v.setVisibility(View.GONE); |
| } |
| |
| private void hideError() { |
| hide(R.id.error); |
| } |
| |
| private String getViewText(int viewId) { |
| return ((TextView) mView.findViewById(viewId)).getText().toString(); |
| } |
| |
| private void setViewText(int viewId, String text) { |
| TextView v = (TextView) mView.findViewById(viewId); |
| if (v != null) v.setText(text); |
| } |
| |
| private void setViewText(int viewId, int textId) { |
| TextView v = (TextView) mView.findViewById(viewId); |
| if (v != null) v.setText(textId); |
| } |
| |
| private void startSdCardMonitor() { |
| if (mSdCardMonitor == null) mSdCardMonitor = new SdCardMonitor(); |
| mSdCardMonitor.startWatching(); |
| } |
| |
| private void stopSdCardMonitor() { |
| if (mSdCardMonitor != null) mSdCardMonitor.stopWatching(); |
| } |
| |
| private static String toMd5(byte[] bytes) { |
| try { |
| MessageDigest algorithm = MessageDigest.getInstance("MD5"); |
| algorithm.reset(); |
| algorithm.update(bytes); |
| return toHexString(algorithm.digest(), ""); |
| } catch(NoSuchAlgorithmException e){ |
| // should not occur |
| Log.w(TAG, "toMd5(): " + e); |
| throw new RuntimeException(e); |
| } |
| } |
| |
| private static String toHexString(byte[] bytes, String separator) { |
| StringBuilder hexString = new StringBuilder(); |
| for (byte b : bytes) { |
| hexString.append(Integer.toHexString(0xFF & b)).append(separator); |
| } |
| return hexString.toString(); |
| } |
| |
| private class CredentialHelper { |
| private Bundle mBundle; |
| private String mName; |
| |
| private PrivateKey mUserKey; |
| private X509Certificate mUserCert; |
| private List<X509Certificate> mCaCerts = |
| new ArrayList<X509Certificate>(); |
| |
| CredentialHelper(Intent intent) { |
| mBundle = intent.getExtras(); |
| if (mBundle == null) { |
| mBundle = new Bundle(); |
| return; |
| } |
| |
| // debug |
| Log.d(TAG, "# extras: " + mBundle.size()); |
| for (String key : mBundle.keySet()) { |
| Log.d(TAG, " " + key + ": " + mBundle.getByteArray(key)); |
| } |
| parseCert(getData(Credentials.CERTIFICATE)); |
| } |
| |
| X509Certificate getUserCertificate() { |
| return mUserCert; |
| } |
| |
| PrivateKey getUserKey() { |
| return mUserKey; |
| } |
| |
| private void parseCert(byte[] bytes) { |
| if (bytes == null) return; |
| try { |
| CertificateFactory crtFactory = |
| CertificateFactory.getInstance("X.509"); |
| X509Certificate crt = (X509Certificate) |
| crtFactory.generateCertificate( |
| new ByteArrayInputStream(bytes)); |
| if (isCa(crt)) { |
| Log.d(TAG, "got a CA cert"); |
| mCaCerts.add(crt); |
| } else { |
| Log.d(TAG, "got a user cert"); |
| mUserCert = crt; |
| } |
| } catch (Exception e) { |
| Log.w(TAG, "parseCert(): " + e); |
| toastErrorAndFinish( |
| getString(R.string.intent_parse_error, e.toString()), |
| Toast.LENGTH_LONG); |
| } |
| } |
| |
| private boolean isCa(X509Certificate crt) { |
| try { |
| // TODO: add a test about this |
| byte[] basicConstraints = crt.getExtensionValue("2.5.29.19"); |
| Object obj = new ASN1InputStream(basicConstraints).readObject(); |
| basicConstraints = ((DEROctetString) obj).getOctets(); |
| obj = new ASN1InputStream(basicConstraints).readObject(); |
| return new BasicConstraints((ASN1Sequence) obj).isCA(); |
| } catch (Exception e) { |
| return false; |
| } |
| } |
| |
| boolean isPkcs12KeyStore() { |
| return mBundle.containsKey(Credentials.PKCS12); |
| } |
| |
| boolean isKeyPair() { |
| return mBundle.containsKey(Credentials.PUBLIC_KEY) |
| && mBundle.containsKey(Credentials.PRIVATE_KEY); |
| } |
| |
| boolean readyForSystemInstall() { |
| return ((mUserKey != null) || (mUserCert != null) |
| || !mCaCerts.isEmpty()); |
| } |
| |
| private void setPrivateKey(byte[] bytes) { |
| try { |
| KeyFactory keyFactory = KeyFactory.getInstance("RSA"); |
| mUserKey = keyFactory.generatePrivate( |
| new PKCS8EncodedKeySpec(bytes)); |
| } catch (Exception e) { |
| // should not occur |
| Log.w(TAG, "setPrivateKey(): " + e); |
| throw new RuntimeException(e); |
| } |
| } |
| |
| // notes: only this method checks if mBundle is null |
| boolean containsAny() { |
| if (mBundle == null) return false; |
| return !mBundle.isEmpty(); |
| } |
| |
| byte[] getData(String key) { |
| return mBundle.getByteArray(key); |
| } |
| |
| void putData(String key, byte[] data) { |
| mBundle.putByteArray(key, data); |
| } |
| |
| CharSequence getDescription() { |
| // TODO: create more descriptive string |
| StringBuilder sb = new StringBuilder(); |
| String newline = "<br>"; |
| if (mUserKey != null) { |
| sb.append(getString(R.string.one_userkey)).append(newline); |
| } |
| if (mUserCert != null) { |
| sb.append(getString(R.string.one_usercrt)).append(newline); |
| } |
| int n = mCaCerts.size(); |
| if (n > 0) { |
| if (n == 1) { |
| sb.append(getString(R.string.one_cacrt)); |
| } else { |
| sb.append(getString(R.string.n_cacrts, n)); |
| } |
| } |
| return Html.fromHtml(sb.toString()); |
| } |
| |
| void setName(String name) { |
| mName = name; |
| } |
| |
| String getName() { |
| return mName; |
| } |
| |
| Intent createSystemInstallIntent() { |
| Intent intent = new Intent(Credentials.SYSTEM_INSTALL_ACTION); |
| if (mUserKey != null) { |
| intent.putExtra(Credentials.USER_PRIVATE_KEY + mName, |
| convertToPem(mUserKey)); |
| } |
| if (mUserCert != null) { |
| intent.putExtra(Credentials.USER_CERTIFICATE + mName, |
| convertToPem(mUserCert)); |
| } |
| if (!mCaCerts.isEmpty()) { |
| Object[] cacrts = (Object[]) |
| mCaCerts.toArray(new X509Certificate[mCaCerts.size()]); |
| intent.putExtra(Credentials.CA_CERTIFICATE + mName, |
| convertToPem(cacrts)); |
| } |
| return intent; |
| } |
| |
| boolean extractFromPkcs12(String passwd) { |
| try { |
| return extractFromPkcs12Internal(passwd); |
| } catch (Exception e) { |
| Log.w(TAG, "extractFromPkcs12(): " + e); |
| return false; |
| } |
| } |
| |
| private boolean extractFromPkcs12Internal(String passwd) |
| throws Exception { |
| // TODO: add test about this |
| java.security.KeyStore keystore = |
| java.security.KeyStore.getInstance("PKCS12"); |
| PasswordProtection passwdProtection = |
| new PasswordProtection(passwd.toCharArray()); |
| keystore.load(new ByteArrayInputStream(getData(Credentials.PKCS12)), |
| passwdProtection.getPassword()); |
| |
| Enumeration<String> aliases = keystore.aliases(); |
| if (!aliases.hasMoreElements()) return false; |
| |
| String alias = aliases.nextElement(); |
| Log.d(TAG, "extracted alias = " + alias); |
| PrivateKeyEntry entry = (PrivateKeyEntry) |
| keystore.getEntry(alias, passwdProtection); |
| mUserKey = entry.getPrivateKey(); |
| mUserCert = (X509Certificate) entry.getCertificate(); |
| |
| Certificate[] crts = entry.getCertificateChain(); |
| Log.d(TAG, "# certs extracted = " + crts.length); |
| List<X509Certificate> caCerts = mCaCerts = |
| new ArrayList<X509Certificate>(crts.length); |
| for (Certificate c : crts) { |
| X509Certificate crt = (X509Certificate) c; |
| if (isCa(crt)) caCerts.add(crt); |
| } |
| Log.d(TAG, "# ca certs extracted = " + mCaCerts.size()); |
| return true; |
| } |
| |
| private byte[] convertToPem(Object... objects) { |
| try { |
| ByteArrayOutputStream bao = new ByteArrayOutputStream(); |
| OutputStreamWriter osw = new OutputStreamWriter(bao); |
| PEMWriter pw = new PEMWriter(osw); |
| for (Object o : objects) pw.writeObject(o); |
| pw.close(); |
| return bao.toByteArray(); |
| } catch (IOException e) { |
| // should not occur |
| Log.w(TAG, "convertToPem(): " + e); |
| throw new RuntimeException(e); |
| } |
| } |
| } |
| |
| private static class MyMap extends LinkedHashMap<String, byte[]> |
| implements Serializable { |
| private static final long serialVersionUID = 1L; |
| |
| protected boolean removeEldestEntry(Map.Entry eldest) { |
| // Note: one key takes about 1300 bytes in the keystore, so be |
| // cautious about allowing more outstanding keys in the map that |
| // may go beyond keystore's max space for one entry. |
| return (size() > 3); |
| } |
| } |
| |
| private class SdCardMonitor { |
| FileObserver mRootMonitor; |
| FileObserver mDownloadMonitor; |
| |
| SdCardMonitor() { |
| File root = Environment.getExternalStorageDirectory(); |
| mRootMonitor = new FileObserver(root.getPath()) { |
| @Override |
| public void onEvent(int evt, String path) { |
| commonHandler(evt, path); |
| } |
| }; |
| |
| File download = new File(root, DOWNLOAD); |
| mDownloadMonitor = new FileObserver(download.getPath()) { |
| @Override |
| public void onEvent(int evt, String path) { |
| commonHandler(evt, path); |
| } |
| }; |
| } |
| |
| private void commonHandler(int evt, String path) { |
| switch (evt) { |
| case FileObserver.CREATE: |
| case FileObserver.DELETE: |
| if (path.endsWith(".p12")) { |
| runOnUiThread(new Runnable() { |
| public void run() { |
| createFileList(); |
| } |
| }); |
| } |
| break; |
| } |
| }; |
| |
| void startWatching() { |
| mRootMonitor.startWatching(); |
| mDownloadMonitor.startWatching(); |
| } |
| |
| void stopWatching() { |
| mRootMonitor.stopWatching(); |
| mDownloadMonitor.stopWatching(); |
| } |
| } |
| } |
