1 /*
2  * Copyright (C) 2020 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 package android.security;
18 
19 import android.annotation.NonNull;
20 import android.os.ServiceManager;
21 import android.os.ServiceSpecificException;
22 import android.os.StrictMode;
23 import android.security.legacykeystore.ILegacyKeystore;
24 import android.util.Log;
25 
26 /**
27  * @hide This class allows legacy VPN access to its profiles that were stored in Keystore.
28  * The storage of unstructured blobs in Android Keystore is going away, because there is no
29  * architectural or security benefit of storing profiles in keystore over storing them
30  * in the file system. This class allows access to the blobs that still exist in keystore.
31  * And it stores new blob in a database that is still owned by Android Keystore.
32  */
33 public class LegacyVpnProfileStore {
34     private static final String TAG = "LegacyVpnProfileStore";
35 
36     public static final int SYSTEM_ERROR = ILegacyKeystore.ERROR_SYSTEM_ERROR;
37     public static final int PROFILE_NOT_FOUND = ILegacyKeystore.ERROR_ENTRY_NOT_FOUND;
38 
39     private static final String LEGACY_KEYSTORE_SERVICE_NAME = "android.security.legacykeystore";
40 
getService()41     private static ILegacyKeystore getService() {
42         return ILegacyKeystore.Stub.asInterface(
43                     ServiceManager.checkService(LEGACY_KEYSTORE_SERVICE_NAME));
44     }
45 
46     /**
47      * Stores the profile under the alias in the profile database. Existing profiles by the
48      * same name will be replaced.
49      * @param alias The name of the profile
50      * @param profile The profile.
51      * @return true if the profile was successfully added. False otherwise.
52      * @hide
53      */
put(@onNull String alias, @NonNull byte[] profile)54     public static boolean put(@NonNull String alias, @NonNull byte[] profile) {
55         StrictMode.noteDiskWrite();
56         try {
57             getService().put(alias, ILegacyKeystore.UID_SELF, profile);
58             return true;
59         } catch (Exception e) {
60             Log.e(TAG, "Failed to put vpn profile.", e);
61             return false;
62         }
63     }
64 
65     /**
66      * Retrieves a profile by the name alias from the profile database.
67      * @param alias Name of the profile to retrieve.
68      * @return The unstructured blob, that is the profile that was stored using
69      *         LegacyVpnProfileStore#put or with
70      *         android.security.Keystore.put(Credentials.VPN + alias).
71      *         Returns null if no profile was found.
72      * @hide
73      */
get(@onNull String alias)74     public static byte[] get(@NonNull String alias) {
75         StrictMode.noteDiskRead();
76         try {
77             return getService().get(alias, ILegacyKeystore.UID_SELF);
78         } catch (ServiceSpecificException e) {
79             if (e.errorCode != PROFILE_NOT_FOUND) {
80                 Log.e(TAG, "Failed to get vpn profile.", e);
81             }
82         } catch (Exception e) {
83             Log.e(TAG, "Failed to get vpn profile.", e);
84         }
85         return null;
86     }
87 
88     /**
89      * Removes a profile by the name alias from the profile database.
90      * @param alias Name of the profile to be removed.
91      * @return True if a profile was removed. False if no such profile was found.
92      * @hide
93      */
remove(@onNull String alias)94     public static boolean remove(@NonNull String alias) {
95         StrictMode.noteDiskWrite();
96         try {
97             getService().remove(alias, ILegacyKeystore.UID_SELF);
98             return true;
99         } catch (ServiceSpecificException e) {
100             if (e.errorCode != PROFILE_NOT_FOUND) {
101                 Log.e(TAG, "Failed to remove vpn profile.", e);
102             }
103         } catch (Exception e) {
104             Log.e(TAG, "Failed to remove vpn profile.", e);
105         }
106         return false;
107     }
108 
109     /**
110      * Lists the vpn profiles stored in the database.
111      * @return An array of strings representing the aliases stored in the profile database.
112      *         The return value may be empty but never null.
113      * @hide
114      */
list(@onNull String prefix)115     public static @NonNull String[] list(@NonNull String prefix) {
116         StrictMode.noteDiskRead();
117         try {
118             final String[] aliases = getService().list(prefix, ILegacyKeystore.UID_SELF);
119             for (int i = 0; i < aliases.length; ++i) {
120                 aliases[i] = aliases[i].substring(prefix.length());
121             }
122             return aliases;
123         } catch (Exception e) {
124             Log.e(TAG, "Failed to list vpn profiles.", e);
125         }
126         return new String[0];
127     }
128 }
129