1 /*
2  * Copyright (C) 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 package android.security.keystore.recovery;
18 
19 import android.annotation.NonNull;
20 import android.os.Parcel;
21 import android.os.Parcelable;
22 
23 import java.io.ByteArrayInputStream;
24 import java.security.cert.CertPath;
25 import java.security.cert.CertificateEncodingException;
26 import java.security.cert.CertificateException;
27 import java.security.cert.CertificateFactory;
28 import java.util.Objects;
29 
30 /**
31  * The certificate path of the recovery service.
32  *
33  * @hide
34  */
35 public final class RecoveryCertPath implements Parcelable {
36 
37     private static final String CERT_PATH_ENCODING = "PkiPath";
38 
39     private final byte[] mEncodedCertPath;
40 
41     /**
42      * Wraps a {@code CertPath} to create a {@code Parcelable} for Binder calls.
43      *
44      * @param certPath The certificate path to be wrapped.
45      * @throws CertificateException if the given certificate path cannot be encoded properly.
46      */
createRecoveryCertPath(@onNull CertPath certPath)47     public static @NonNull RecoveryCertPath createRecoveryCertPath(@NonNull CertPath certPath)
48             throws CertificateException {
49         // Perform the encoding here to avoid throwing exceptions in writeToParcel
50         try {
51             return new RecoveryCertPath(encodeCertPath(certPath));
52         } catch (CertificateEncodingException e) {
53             throw new CertificateException("Failed to encode the given CertPath", e);
54         }
55     }
56 
57     /**
58      * Obtains the {@code CertPath} wrapped in the Parcelable.
59      *
60      * @return the wrapped certificate path.
61      * @throws CertificateException if the wrapped certificate path cannot be decoded properly.
62      */
getCertPath()63     public @NonNull CertPath getCertPath() throws CertificateException {
64         // Perform the decoding here to avoid throwing exceptions in createFromParcel
65         return decodeCertPath(mEncodedCertPath);
66     }
67 
RecoveryCertPath(@onNull byte[] encodedCertPath)68     private RecoveryCertPath(@NonNull byte[] encodedCertPath) {
69         mEncodedCertPath = Objects.requireNonNull(encodedCertPath);
70     }
71 
RecoveryCertPath(Parcel in)72     private RecoveryCertPath(Parcel in) {
73         mEncodedCertPath = in.createByteArray();
74     }
75 
76     public static final @NonNull Parcelable.Creator<RecoveryCertPath> CREATOR =
77             new Parcelable.Creator<RecoveryCertPath>() {
78         public RecoveryCertPath createFromParcel(Parcel in) {
79             return new RecoveryCertPath(in);
80         }
81 
82         public RecoveryCertPath[] newArray(int length) {
83             return new RecoveryCertPath[length];
84         }
85     };
86 
87     @Override
writeToParcel(Parcel out, int flags)88     public void writeToParcel(Parcel out, int flags) {
89         out.writeByteArray(mEncodedCertPath);
90     }
91 
92     @Override
describeContents()93     public int describeContents() {
94         return 0;
95     }
96 
97     @NonNull
encodeCertPath(@onNull CertPath certPath)98     private static byte[] encodeCertPath(@NonNull CertPath certPath)
99             throws CertificateEncodingException {
100         Objects.requireNonNull(certPath);
101         return certPath.getEncoded(CERT_PATH_ENCODING);
102     }
103 
104     @NonNull
decodeCertPath(@onNull byte[] bytes)105     private static CertPath decodeCertPath(@NonNull byte[] bytes) throws CertificateException {
106         Objects.requireNonNull(bytes);
107         CertificateFactory certFactory;
108         try {
109             certFactory = CertificateFactory.getInstance("X.509");
110         } catch (CertificateException e) {
111             // Should not happen, as X.509 is mandatory for all providers.
112             throw new RuntimeException(e);
113         }
114         return certFactory.generateCertPath(new ByteArrayInputStream(bytes), CERT_PATH_ENCODING);
115     }
116 }
117