SSLUtils.java revision 7d5e2a7c08966ffd4a9e8c78f504cc4fd5be4216
1/* 2 * Copyright (C) 2010 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17package com.android.emailcommon.utility; 18 19import android.content.ContentUris; 20import android.content.ContentValues; 21import android.content.Context; 22import android.database.Cursor; 23import android.net.SSLCertificateSocketFactory; 24import android.security.KeyChain; 25import android.security.KeyChainException; 26import android.util.Log; 27 28import com.android.emailcommon.provider.EmailContent.HostAuthColumns; 29import com.android.emailcommon.provider.HostAuth; 30import com.google.common.annotations.VisibleForTesting; 31 32import java.io.ByteArrayInputStream; 33import java.io.IOException; 34import java.net.InetAddress; 35import java.net.Socket; 36import java.security.Principal; 37import java.security.PrivateKey; 38import java.security.PublicKey; 39import java.security.cert.Certificate; 40import java.security.cert.CertificateException; 41import java.security.cert.CertificateFactory; 42import java.security.cert.X509Certificate; 43import java.util.Arrays; 44 45import javax.net.ssl.KeyManager; 46import javax.net.ssl.TrustManager; 47import javax.net.ssl.X509ExtendedKeyManager; 48import javax.net.ssl.X509TrustManager; 49 50public class SSLUtils { 51 // All secure factories are the same; all insecure factories are associated with HostAuth's 52 private static SSLCertificateSocketFactory sSecureFactory; 53 54 private static final boolean LOG_ENABLED = false; 55 private static final String TAG = "Email.Ssl"; 56 57 /** 58 * A trust manager specific to a particular HostAuth. The first time a server certificate is 59 * encountered for the HostAuth, its certificate is saved; subsequent checks determine whether 60 * the PublicKey of the certificate presented matches that of the saved certificate 61 * TODO: UI to ask user about changed certificates 62 */ 63 private static class SameCertificateCheckingTrustManager implements X509TrustManager { 64 private final HostAuth mHostAuth; 65 private final Context mContext; 66 // The public key associated with the HostAuth; we'll lazily initialize it 67 private PublicKey mPublicKey; 68 69 SameCertificateCheckingTrustManager(Context context, HostAuth hostAuth) { 70 mContext = context; 71 mHostAuth = hostAuth; 72 // We must load the server cert manually (the ContentCache won't handle blobs 73 Cursor c = context.getContentResolver().query(HostAuth.CONTENT_URI, 74 new String[] {HostAuthColumns.SERVER_CERT}, HostAuth.ID + "=?", 75 new String[] {Long.toString(hostAuth.mId)}, null); 76 if (c != null) { 77 try { 78 if (c.moveToNext()) { 79 mHostAuth.mServerCert = c.getBlob(0); 80 } 81 } finally { 82 c.close(); 83 } 84 } 85 } 86 87 @Override 88 public void checkClientTrusted(X509Certificate[] chain, String authType) 89 throws CertificateException { 90 // We don't check client certificates 91 throw new CertificateException("We don't check client certificates"); 92 } 93 94 @Override 95 public void checkServerTrusted(X509Certificate[] chain, String authType) 96 throws CertificateException { 97 if (chain.length == 0) { 98 throw new CertificateException("No certificates?"); 99 } else { 100 X509Certificate serverCert = chain[0]; 101 if (mHostAuth.mServerCert != null) { 102 // Compare with the current public key 103 if (mPublicKey == null) { 104 ByteArrayInputStream bais = new ByteArrayInputStream(mHostAuth.mServerCert); 105 Certificate storedCert = 106 CertificateFactory.getInstance("X509").generateCertificate(bais); 107 mPublicKey = storedCert.getPublicKey(); 108 try { 109 bais.close(); 110 } catch (IOException e) { 111 // Yeah, right. 112 } 113 } 114 if (!mPublicKey.equals(serverCert.getPublicKey())) { 115 throw new CertificateException( 116 "PublicKey has changed since initial connection!"); 117 } 118 } else { 119 // First time; save this away 120 byte[] encodedCert = serverCert.getEncoded(); 121 mHostAuth.mServerCert = encodedCert; 122 ContentValues values = new ContentValues(); 123 values.put(HostAuthColumns.SERVER_CERT, encodedCert); 124 mContext.getContentResolver().update( 125 ContentUris.withAppendedId(HostAuth.CONTENT_URI, mHostAuth.mId), 126 values, null, null); 127 } 128 } 129 } 130 131 @Override 132 public X509Certificate[] getAcceptedIssuers() { 133 return null; 134 } 135 } 136 137 /** 138 * Returns a {@link javax.net.ssl.SSLSocketFactory}. 139 * Optionally bypass all SSL certificate checks. 140 * 141 * @param insecure if true, bypass all SSL certificate checks 142 */ 143 public synchronized static SSLCertificateSocketFactory getSSLSocketFactory(Context context, 144 HostAuth hostAuth, boolean insecure) { 145 if (insecure) { 146 SSLCertificateSocketFactory insecureFactory = (SSLCertificateSocketFactory) 147 SSLCertificateSocketFactory.getDefault(0, null); 148 insecureFactory.setTrustManagers( 149 new TrustManager[] { 150 new SameCertificateCheckingTrustManager(context, hostAuth)}); 151 return insecureFactory; 152 } else { 153 if (sSecureFactory == null) { 154 sSecureFactory = (SSLCertificateSocketFactory) 155 SSLCertificateSocketFactory.getDefault(0, null); 156 } 157 return sSecureFactory; 158 } 159 } 160 161 /** 162 * Returns a {@link org.apache.http.conn.ssl.SSLSocketFactory SSLSocketFactory} for use with the 163 * Apache HTTP stack. 164 */ 165 public static SSLSocketFactory getHttpSocketFactory(Context context, HostAuth hostAuth, 166 KeyManager keyManager, boolean insecure) { 167 SSLCertificateSocketFactory underlying = getSSLSocketFactory(context, hostAuth, insecure); 168 if (keyManager != null) { 169 underlying.setKeyManagers(new KeyManager[] { keyManager }); 170 } 171 SSLSocketFactory wrapped = new SSLSocketFactory(underlying); 172 if (insecure) { 173 wrapped.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 174 } 175 return wrapped; 176 } 177 178 /** 179 * Escapes the contents a string to be used as a safe scheme name in the URI according to 180 * http://tools.ietf.org/html/rfc3986#section-3.1 181 * 182 * This does not ensure that the first character is a letter (which is required by the RFC). 183 */ 184 @VisibleForTesting 185 public static String escapeForSchemeName(String s) { 186 // According to the RFC, scheme names are case-insensitive. 187 s = s.toLowerCase(); 188 189 StringBuilder sb = new StringBuilder(); 190 for (int i = 0; i < s.length(); i++) { 191 char c = s.charAt(i); 192 if (Character.isLetter(c) || Character.isDigit(c) 193 || ('-' == c) || ('.' == c)) { 194 // Safe - use as is. 195 sb.append(c); 196 } else if ('+' == c) { 197 // + is used as our escape character, so double it up. 198 sb.append("++"); 199 } else { 200 // Unsafe - escape. 201 sb.append('+').append((int) c); 202 } 203 } 204 return sb.toString(); 205 } 206 207 private static abstract class StubKeyManager extends X509ExtendedKeyManager { 208 @Override public abstract String chooseClientAlias( 209 String[] keyTypes, Principal[] issuers, Socket socket); 210 211 @Override public abstract X509Certificate[] getCertificateChain(String alias); 212 213 @Override public abstract PrivateKey getPrivateKey(String alias); 214 215 216 // The following methods are unused. 217 218 @Override 219 public final String chooseServerAlias( 220 String keyType, Principal[] issuers, Socket socket) { 221 // not a client SSLSocket callback 222 throw new UnsupportedOperationException(); 223 } 224 225 @Override 226 public final String[] getClientAliases(String keyType, Principal[] issuers) { 227 // not a client SSLSocket callback 228 throw new UnsupportedOperationException(); 229 } 230 231 @Override 232 public final String[] getServerAliases(String keyType, Principal[] issuers) { 233 // not a client SSLSocket callback 234 throw new UnsupportedOperationException(); 235 } 236 } 237 238 /** 239 * A dummy {@link KeyManager} which keeps track of the last time a server has requested 240 * a client certificate. 241 */ 242 public static class TrackingKeyManager extends StubKeyManager { 243 private volatile long mLastTimeCertRequested = 0L; 244 245 @Override 246 public String chooseClientAlias(String[] keyTypes, Principal[] issuers, Socket socket) { 247 if (LOG_ENABLED) { 248 InetAddress address = socket.getInetAddress(); 249 Log.i(TAG, "TrackingKeyManager: requesting a client cert alias for " 250 + address.getCanonicalHostName()); 251 } 252 mLastTimeCertRequested = System.currentTimeMillis(); 253 return null; 254 } 255 256 @Override 257 public X509Certificate[] getCertificateChain(String alias) { 258 if (LOG_ENABLED) { 259 Log.i(TAG, "TrackingKeyManager: returning a null cert chain"); 260 } 261 return null; 262 } 263 264 @Override 265 public PrivateKey getPrivateKey(String alias) { 266 if (LOG_ENABLED) { 267 Log.i(TAG, "TrackingKeyManager: returning a null private key"); 268 } 269 return null; 270 } 271 272 /** 273 * @return the last time that this {@link KeyManager} detected a request by a server 274 * for a client certificate (in millis since epoch). 275 */ 276 public long getLastCertReqTime() { 277 return mLastTimeCertRequested; 278 } 279 } 280 281 /** 282 * A {@link KeyManager} that reads uses credentials stored in the system {@link KeyChain}. 283 */ 284 public static class KeyChainKeyManager extends StubKeyManager { 285 private final String mClientAlias; 286 private final X509Certificate[] mCertificateChain; 287 private final PrivateKey mPrivateKey; 288 289 /** 290 * Builds an instance of a KeyChainKeyManager using the given certificate alias. 291 * If for any reason retrieval of the credentials from the system {@link KeyChain} fails, 292 * a {@code null} value will be returned. 293 */ 294 public static KeyChainKeyManager fromAlias(Context context, String alias) 295 throws CertificateException { 296 X509Certificate[] certificateChain; 297 try { 298 certificateChain = KeyChain.getCertificateChain(context, alias); 299 } catch (KeyChainException e) { 300 logError(alias, "certificate chain", e); 301 throw new CertificateException(e); 302 } catch (InterruptedException e) { 303 logError(alias, "certificate chain", e); 304 throw new CertificateException(e); 305 } 306 307 PrivateKey privateKey; 308 try { 309 privateKey = KeyChain.getPrivateKey(context, alias); 310 } catch (KeyChainException e) { 311 logError(alias, "private key", e); 312 throw new CertificateException(e); 313 } catch (InterruptedException e) { 314 logError(alias, "private key", e); 315 throw new CertificateException(e); 316 } 317 318 if (certificateChain == null || privateKey == null) { 319 throw new CertificateException("Can't access certificate from keystore"); 320 } 321 322 return new KeyChainKeyManager(alias, certificateChain, privateKey); 323 } 324 325 private static void logError(String alias, String type, Exception ex) { 326 // Avoid logging PII when explicit logging is not on. 327 if (LOG_ENABLED) { 328 Log.e(TAG, "Unable to retrieve " + type + " for [" + alias + "] due to " + ex); 329 } else { 330 Log.e(TAG, "Unable to retrieve " + type + " due to " + ex); 331 } 332 } 333 334 private KeyChainKeyManager( 335 String clientAlias, X509Certificate[] certificateChain, PrivateKey privateKey) { 336 mClientAlias = clientAlias; 337 mCertificateChain = certificateChain; 338 mPrivateKey = privateKey; 339 } 340 341 342 @Override 343 public String chooseClientAlias(String[] keyTypes, Principal[] issuers, Socket socket) { 344 if (LOG_ENABLED) { 345 Log.i(TAG, "Requesting a client cert alias for " + Arrays.toString(keyTypes)); 346 } 347 return mClientAlias; 348 } 349 350 @Override 351 public X509Certificate[] getCertificateChain(String alias) { 352 if (LOG_ENABLED) { 353 Log.i(TAG, "Requesting a client certificate chain for alias [" + alias + "]"); 354 } 355 return mCertificateChain; 356 } 357 358 @Override 359 public PrivateKey getPrivateKey(String alias) { 360 if (LOG_ENABLED) { 361 Log.i(TAG, "Requesting a client private key for alias [" + alias + "]"); 362 } 363 return mPrivateKey; 364 } 365 } 366} 367