diff options
7 files changed, 64 insertions, 0 deletions
diff --git a/core/java/android/security/net/config/CertificateSource.java b/core/java/android/security/net/config/CertificateSource.java index 2b7829eb6a31..7e3601e1fbea 100644 --- a/core/java/android/security/net/config/CertificateSource.java +++ b/core/java/android/security/net/config/CertificateSource.java @@ -23,4 +23,5 @@ import java.security.cert.X509Certificate; public interface CertificateSource { Set<X509Certificate> getCertificates(); X509Certificate findBySubjectAndPublicKey(X509Certificate cert); + X509Certificate findByIssuerAndSignature(X509Certificate cert); } diff --git a/core/java/android/security/net/config/CertificatesEntryRef.java b/core/java/android/security/net/config/CertificatesEntryRef.java index 1d15e19a99f2..ff728efc2d93 100644 --- a/core/java/android/security/net/config/CertificatesEntryRef.java +++ b/core/java/android/security/net/config/CertificatesEntryRef.java @@ -51,4 +51,13 @@ public final class CertificatesEntryRef { return new TrustAnchor(foundCert, mOverridesPins); } + + public TrustAnchor findByIssuerAndSignature(X509Certificate cert) { + X509Certificate foundCert = mSource.findByIssuerAndSignature(cert); + if (foundCert == null) { + return null; + } + + return new TrustAnchor(foundCert, mOverridesPins); + } } diff --git a/core/java/android/security/net/config/DirectoryCertificateSource.java b/core/java/android/security/net/config/DirectoryCertificateSource.java index 92c70920e040..bf88e582999c 100644 --- a/core/java/android/security/net/config/DirectoryCertificateSource.java +++ b/core/java/android/security/net/config/DirectoryCertificateSource.java @@ -94,6 +94,21 @@ abstract class DirectoryCertificateSource implements CertificateSource { }); } + @Override + public X509Certificate findByIssuerAndSignature(final X509Certificate cert) { + return findCert(cert.getIssuerX500Principal(), new CertSelector() { + @Override + public boolean match(X509Certificate ca) { + try { + cert.verify(ca.getPublicKey()); + return true; + } catch (Exception e) { + return false; + } + } + }); + } + private static interface CertSelector { boolean match(X509Certificate cert); } diff --git a/core/java/android/security/net/config/KeyStoreCertificateSource.java b/core/java/android/security/net/config/KeyStoreCertificateSource.java index 7a01a6488a04..b6105cd5da4c 100644 --- a/core/java/android/security/net/config/KeyStoreCertificateSource.java +++ b/core/java/android/security/net/config/KeyStoreCertificateSource.java @@ -80,4 +80,14 @@ class KeyStoreCertificateSource implements CertificateSource { } return anchor.getTrustedCert(); } + + @Override + public X509Certificate findByIssuerAndSignature(X509Certificate cert) { + ensureInitialized(); + java.security.cert.TrustAnchor anchor = mIndex.findByIssuerAndSignature(cert); + if (anchor == null) { + return null; + } + return anchor.getTrustedCert(); + } } diff --git a/core/java/android/security/net/config/NetworkSecurityConfig.java b/core/java/android/security/net/config/NetworkSecurityConfig.java index 2ab07b5abf18..0a2edff2295f 100644 --- a/core/java/android/security/net/config/NetworkSecurityConfig.java +++ b/core/java/android/security/net/config/NetworkSecurityConfig.java @@ -134,6 +134,17 @@ public final class NetworkSecurityConfig { return null; } + /** @hide */ + public TrustAnchor findTrustAnchorByIssuerAndSignature(X509Certificate cert) { + for (CertificatesEntryRef ref : mCertificatesEntryRefs) { + TrustAnchor anchor = ref.findByIssuerAndSignature(cert); + if (anchor != null) { + return anchor; + } + } + return null; + } + /** * Return a {@link Builder} for the default {@code NetworkSecurityConfig}. * diff --git a/core/java/android/security/net/config/ResourceCertificateSource.java b/core/java/android/security/net/config/ResourceCertificateSource.java index b007f8f00a55..e489c2c529eb 100644 --- a/core/java/android/security/net/config/ResourceCertificateSource.java +++ b/core/java/android/security/net/config/ResourceCertificateSource.java @@ -90,4 +90,14 @@ public class ResourceCertificateSource implements CertificateSource { } return anchor.getTrustedCert(); } + + @Override + public X509Certificate findByIssuerAndSignature(X509Certificate cert) { + ensureInitialized(); + java.security.cert.TrustAnchor anchor = mIndex.findByIssuerAndSignature(cert); + if (anchor == null) { + return null; + } + return anchor.getTrustedCert(); + } } diff --git a/tests/NetworkSecurityConfigTest/src/android/security/net/config/TestCertificateSource.java b/tests/NetworkSecurityConfigTest/src/android/security/net/config/TestCertificateSource.java index 69b2a9d55642..0c360631c294 100644 --- a/tests/NetworkSecurityConfigTest/src/android/security/net/config/TestCertificateSource.java +++ b/tests/NetworkSecurityConfigTest/src/android/security/net/config/TestCertificateSource.java @@ -44,4 +44,12 @@ public class TestCertificateSource implements CertificateSource { } return anchor.getTrustedCert(); } + + public X509Certificate findByIssuerAndSignature(X509Certificate cert) { + java.security.cert.TrustAnchor anchor = mIndex.findByIssuerAndSignature(cert); + if (anchor == null) { + return null; + } + return anchor.getTrustedCert(); + } } |