verifier/security/KeyChainTest.java

/*
 * Copyright (C) 2015 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.android.cts.verifier.security;

import android.app.Activity;
import android.content.Intent;
import android.content.res.Resources;
import android.os.AsyncTask;
import android.os.Bundle;
import android.provider.Settings;
import android.security.KeyChain;
import android.security.KeyChainAliasCallback;
import android.security.KeyChainException;
import android.text.method.ScrollingMovementMethod;
import android.util.Log;
import android.view.View;
import android.widget.Button;
import android.widget.TextView;

import com.android.cts.verifier.PassFailButtons;
import com.android.cts.verifier.R;

import com.google.mockwebserver.MockResponse;
import com.google.mockwebserver.MockWebServer;

import java.io.InputStream;
import java.io.IOException;
import java.io.ByteArrayOutputStream;
import java.net.Socket;
import java.net.URL;
import java.security.GeneralSecurityException;
import java.security.Key;
import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.Principal;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.ArrayList;
import java.util.concurrent.TimeUnit;
import java.util.List;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.X509ExtendedKeyManager;

import libcore.java.security.TestKeyStore;
import libcore.javax.net.ssl.TestSSLContext;

import org.mockito.ArgumentCaptor;
import org.mockito.Mockito;

/**
 * Simple activity based test that exercises the KeyChain API
 */
public class KeyChainTest extends PassFailButtons.Activity implements View.OnClickListener {

    private static final String TAG = "KeyChainTest";

    private static final int REQUEST_CA_INSTALL = 1;

    private TextView mInstructionView;
    private TextView mLogView;
    private Button mResetButton;
    private Button mSkipButton;
    private Button mNextButton;

    private List<Step> mSteps;
    int mCurrentStep;

    private KeyStore mKeyStore;
    private static final char[] KEYSTORE_PASSWORD = "".toCharArray();

    // How long to wait before giving up on the user selecting a key alias.
    private static final int KEYCHAIN_ALIAS_TIMEOUT_MS = (int) TimeUnit.MINUTES.toMillis(5L);

    @Override public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        View root = getLayoutInflater().inflate(R.layout.keychain_main, null);
        setContentView(root);

        setInfoResources(R.string.keychain_test, R.string.keychain_info, -1);
        setPassFailButtonClickListeners();

        mInstructionView = (TextView) root.findViewById(R.id.test_instruction);
        mLogView = (TextView) root.findViewById(R.id.test_log);
        mLogView.setMovementMethod(new ScrollingMovementMethod());

        mNextButton = (Button) root.findViewById(R.id.action_next);
        mNextButton.setOnClickListener(this);

        mResetButton = (Button) root.findViewById(R.id.action_reset);
        mResetButton.setOnClickListener(this);

        mSkipButton = (Button) root.findViewById(R.id.action_skip);
        mSkipButton.setOnClickListener(this);

        resetProgress();
    }

    @Override
    public void onClick(View v) {
        Step step = mSteps.get(mCurrentStep);
        if (v == mNextButton) {
            switch (step.task.getStatus()) {
                case PENDING: {
                    step.task.execute();
                    break;
                }
                case FINISHED: {
                    if (mCurrentStep + 1 < mSteps.size()) {
                        mCurrentStep += 1;
                        updateUi();
                    } else {
                        mSkipButton.setVisibility(View.INVISIBLE);
                        mNextButton.setVisibility(View.INVISIBLE);
                    }
                    break;
                }
            }
        } else if (v == mSkipButton) {
            step.task.cancel(false);
            mCurrentStep += 1;
            updateUi();
        } else if (v == mResetButton) {
            resetProgress();
        }
    }

    @Override
    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
        switch (requestCode) {
            case REQUEST_CA_INSTALL: {
                if (resultCode == RESULT_OK) {
                    log("CA Certificate installed successfully");
                } else {
                    log("REQUEST_CA_INSTALL failed with result code: " + resultCode);
                }
                break;
            }
            default:
                throw new IllegalStateException("requestCode == " + requestCode);
        }
    }

    private void resetProgress() {
        getPassButton().setEnabled(false);
        mLogView.setText("");

        mSteps = new ArrayList<>();
        mSteps.add(new Step(R.string.keychain_setup_desc, false, new SetupTestKeyStoreTask()));
        mSteps.add(new Step(R.string.keychain_install_desc, true, new InstallCredentialsTask()));
        mSteps.add(new Step(R.string.keychain_https_desc, false, new TestHttpsRequestTask()));
        mSteps.add(new Step(R.string.keychain_reset_desc, true, new ClearCredentialsTask()));
        mCurrentStep = 0;

        updateUi();
    }

    private void updateUi() {
        mLogView.setText("");

        if (mCurrentStep >= mSteps.size()) {
            mSkipButton.setVisibility(View.INVISIBLE);
            mNextButton.setVisibility(View.INVISIBLE);
            getPassButton().setEnabled(true);
            return;
        }

        final Step step = mSteps.get(mCurrentStep);
        if (step.task.getStatus() == AsyncTask.Status.PENDING) {
            mInstructionView.setText(step.instructionTextId);
        }
        mSkipButton.setVisibility(step.skippable ? View.VISIBLE : View.INVISIBLE);
        mNextButton.setVisibility(View.VISIBLE);
    }

    private class SetupTestKeyStoreTask extends AsyncTask<Void, Void, Void> {
        @Override
        protected Void doInBackground(Void... params) {
            final Certificate[] chain = new Certificate[2];
            final Key privKey;

            log("Reading resources");
            Resources res = getResources();
            ByteArrayOutputStream userKey = new ByteArrayOutputStream();
            try {
                InputStream is = res.openRawResource(R.raw.userkey);
                byte[] buffer = new byte[4096];
                for (int n; (n = is.read(buffer, 0, buffer.length)) != -1;) {
                    userKey.write(buffer, 0, n);
                }
            } catch (IOException e) {
                Log.e(TAG, "Reading private key failed", e);
                return null;
            }
            log("Private key length: " + userKey.size() + " bytes");

            log("Setting up KeyStore");
            try {
                KeyFactory keyFact = KeyFactory.getInstance("RSA");
                privKey = keyFact.generatePrivate(new PKCS8EncodedKeySpec(userKey.toByteArray()));

                final CertificateFactory f = CertificateFactory.getInstance("X.509");
                chain[0] = f.generateCertificate(res.openRawResource(R.raw.usercert));
                chain[1] = f.generateCertificate(res.openRawResource(R.raw.cacert));
            } catch (GeneralSecurityException gse) {
                Log.w(TAG, "Certificate generation failed", gse);
                return null;
            }

            try {
                // Create a PKCS12 keystore populated with key + certificate chain
                KeyStore ks = KeyStore.getInstance("PKCS12");
                ks.load(null, null);
                ks.setKeyEntry("alias", privKey, KEYSTORE_PASSWORD, chain);
                mKeyStore = ks;
                log("KeyStore initialized");
            } catch (Exception e) {
                log("KeyStore initialization failed");
                Log.e(TAG, "", e);
            }
            return null;
        }
    }

    private class InstallCredentialsTask extends AsyncTask<Void, Void, Void> {
        @Override
        protected Void doInBackground(Void... params) {
            try {
                Intent intent = KeyChain.createInstallIntent();
                intent.putExtra(KeyChain.EXTRA_NAME, TAG);

                // Write keystore to byte array for installation
                ByteArrayOutputStream pkcs12 = new ByteArrayOutputStream();
                mKeyStore.store(pkcs12, KEYSTORE_PASSWORD);
                if (pkcs12.size() == 0) {
                    throw new AssertionError("Credential archive is empty");
                }
                log("Requesting install of server's credentials");
                intent.putExtra(KeyChain.EXTRA_PKCS12, pkcs12.toByteArray());
                startActivityForResult(intent, REQUEST_CA_INSTALL);
            } catch (Exception e) {
                log("Failed to install credentials: " + e);
            }
            return null;
        }
    }

    private class TestHttpsRequestTask extends AsyncTask<Void, Void, Void> {
        @Override
        protected Void doInBackground(Void... params) {
            try {
                URL url = startWebServer();
                makeHttpsRequest(url);
            } catch (Exception e) {
                Log.e(TAG, "HTTPS request unsuccessful", e);
                log("Connection failed");
                return null;
            }

            runOnUiThread(new Runnable() {
                @Override public void run() {
                    getPassButton().setEnabled(true);
                }
            });
            return null;
        }

        /**
         * Create a mock web server.
         * The server authenticates itself to the client using the key pair and certificate from the
         * PKCS#12 keystore used in this test. Client authentication uses default trust management:
         * the server trusts only the certificates installed in the credential storage of this
         * user/profile.
         */
        private URL startWebServer() throws Exception {
            log("Starting web server");
            String kmfAlgoritm = KeyManagerFactory.getDefaultAlgorithm();
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(kmfAlgoritm);
            kmf.init(mKeyStore, KEYSTORE_PASSWORD);
            SSLContext serverContext = SSLContext.getInstance("TLS");
            serverContext.init(kmf.getKeyManagers(),
                    null /* TrustManager[] */,
                    null /* SecureRandom */);
            SSLSocketFactory sf = serverContext.getSocketFactory();
            SSLSocketFactory needsClientAuth = TestSSLContext.clientAuth(sf,
                    false /* Want client auth */,
                    true /* Need client auth */);
            MockWebServer server = new MockWebServer();
            server.useHttps(needsClientAuth, false /* tunnelProxy */);
            server.enqueue(new MockResponse().setBody("this response comes via HTTPS"));
            server.play();
            return server.getUrl("/");
        }

        /**
         * Open a new connection to the server.
         * The client authenticates itself to the server using a private key and certificate
         * supplied by KeyChain. Server authentication uses default trust management: the client
         * trusts only certificates installed in the credential storage of this user/profile. This
         * setup is expected to work because the server uses a private key whose certificate was
         * installed earlier during this test.
         */
        private void makeHttpsRequest(URL url) throws Exception {
            log("Making https request to " + url);
            SSLContext clientContext = SSLContext.getInstance("TLS");
            clientContext.init(new KeyManager[] { new KeyChainKeyManager() },
                    null /* TrustManager[] */,
                    null /* SecureRandom */);
            HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
            connection.setSSLSocketFactory(clientContext.getSocketFactory());
            if (connection.getResponseCode() != 200) {
                log("Connection failed. Response code: " + connection.getResponseCode());
                throw new AssertionError();
            }
            log("Connection succeeded.");
        }
    }

    private class ClearCredentialsTask extends AsyncTask<Void, Void, Void> {
        @Override
        protected Void doInBackground(Void... params) {
            final Intent securitySettingsIntent = new Intent(Settings.ACTION_SECURITY_SETTINGS);
            startActivity(securitySettingsIntent);
            log("Started action: " + Settings.ACTION_SECURITY_SETTINGS);
            log("All tests complete!");
            return null;
        }
    }

    /**
     * Key manager which synchronously prompts for its aliases via KeyChain
     */
    private class KeyChainKeyManager extends X509ExtendedKeyManager {
        @Override
        public String chooseClientAlias(String[] keyTypes, Principal[] issuers, Socket socket) {
            log("KeyChainKeyManager chooseClientAlias");
            KeyChainAliasCallback aliasCallback = Mockito.mock(KeyChainAliasCallback.class);
            KeyChain.choosePrivateKeyAlias(KeyChainTest.this, aliasCallback,
                                           keyTypes, issuers,
                                           socket.getInetAddress().getHostName(), socket.getPort(),
                                           null);

            ArgumentCaptor<String> aliasCaptor = ArgumentCaptor.forClass(String.class);
            Mockito.verify(aliasCallback, Mockito.timeout((int) KEYCHAIN_ALIAS_TIMEOUT_MS))
                    .alias(aliasCaptor.capture());

            log("Certificate alias: \"" + aliasCaptor.getValue() + "\"");
            return aliasCaptor.getValue();
        }

        @Override
        public String chooseServerAlias(String keyType,
                                                  Principal[] issuers,
                                                  Socket socket) {
            // Not a client SSLSocket callback
            throw new UnsupportedOperationException();
        }

        @Override
        public X509Certificate[] getCertificateChain(String alias) {
            try {
                log("KeyChainKeyManager getCertificateChain");
                X509Certificate[] certificateChain =
                        KeyChain.getCertificateChain(KeyChainTest.this, alias);
                if (certificateChain == null) {
                    log("Null certificate chain!");
                    return null;
                }
                log("Returned " + certificateChain.length + " certificates in chain");
                for (int i = 0; i < certificateChain.length; i++) {
                    Log.d(TAG, "certificate[" + i + "]=" + certificateChain[i]);
                }
                return certificateChain;
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
                return null;
            } catch (KeyChainException e) {
                throw new RuntimeException(e);
            }
        }

        @Override
        public String[] getClientAliases(String keyType, Principal[] issuers) {
            // not a client SSLSocket callback
            throw new UnsupportedOperationException();
        }

        @Override
        public String[] getServerAliases(String keyType, Principal[] issuers) {
            // not a client SSLSocket callback
            throw new UnsupportedOperationException();
        }

        @Override
        public PrivateKey getPrivateKey(String alias) {
            try {
                log("KeyChainKeyManager.getPrivateKey(\"" + alias + "\")");
                PrivateKey privateKey = KeyChain.getPrivateKey(KeyChainTest.this, alias);
                Log.d(TAG, "privateKey = " + privateKey);
                return privateKey;
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
                return null;
            } catch (KeyChainException e) {
                throw new RuntimeException(e);
            }
        }
    }

    /**
     * Write a message to the log, also to a visible TextView if available.
     */
    private void log(final String message) {
        Log.d(TAG, message);
        if (mLogView != null) {
            runOnUiThread(new Runnable() {
                @Override public void run() {
                    mLogView.append(message + "\n");
                }
            });
        }
    }

    /**
     * Utility class to store one step per object.
     */
    private static class Step {
        // Instruction message to show before running
        int instructionTextId;

        // Whether to allow a 'skip' button for this step
        boolean skippable;

        // Set of commands to run when 'next' is pressed
        AsyncTask<Void, Void, Void> task;

        public Step(int instructionTextId, boolean skippable, AsyncTask<Void, Void, Void> task) {
            this.instructionTextId = instructionTextId;
            this.skippable = skippable;
            this.task = task;
        }
    }
}