joy/android_packages_modules_Connectivity
Watch
1
Fork
You've already forked android_packages_modules_Connectivity
 0
Code Issues Pull requests Projects Releases Wiki Activity

Fix the string encoding issues with logging the signature

Browse source 
The signature should be logged _before_ decoded from the Base64
encoding in order to properly compare with what is published on gstatic.

Bug: 391327942
Bug: 378626065
Flag: com.android.net.ct.flags.certificate_transparency_service
Test: atest NetworkSecurityUnitTests
Change-Id: Ibde2d4f45b998f764e2cb8d0772a0536ff763a4a
This commit is contained in:
Bessie Jiang 2025-02-10 15:26:10 +00:00
commit 20293a86ef
2 changed files with 5 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

4
networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java
View file

@ -32,7 +32,6 @@ import androidx.annotation.VisibleForTesting;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.InvalidKeyException;
import java.security.KeyFactory;
@ -105,9 +104,9 @@ public class SignatureVerifier {
verifier.update(fileStream.readAllBytes());
byte[] signatureBytes = signatureStream.readAllBytes();
statusBuilder.setSignature(new String(signatureBytes));
try {
byte[] decodedSigBytes = Base64.getDecoder().decode(signatureBytes);
statusBuilder.setSignature(new String(decodedSigBytes, StandardCharsets.UTF_8));
if (!verifier.verify(decodedSigBytes)) {
// Leave the UpdateState as UNKNOWN_STATE if successful as there are other
@ -116,7 +115,6 @@ public class SignatureVerifier {
}
} catch (IllegalArgumentException e) {
Log.w(TAG, "Invalid signature base64 encoding", e);
statusBuilder.setSignature(new String(signatureBytes, StandardCharsets.UTF_8));
statusBuilder.setState(SIGNATURE_INVALID);
return statusBuilder.build();
}

19
networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
View file

@ -24,8 +24,6 @@ import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import static java.nio.charset.StandardCharsets.UTF_8;
import android.app.DownloadManager;
import android.app.DownloadManager.Query;
import android.app.DownloadManager.Request;
@ -56,7 +54,6 @@ import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
@ -399,14 +396,12 @@ public class CertificateTransparencyDownloaderTest {
mContext, makeContentDownloadCompleteIntent(mCompatVersion, logListFile));
// Assert
byte[] signatureBytes = Base64.getDecoder().decode(toByteArray(metadataFile));
verify(mLogger, times(1))
.logCTLogListUpdateStateChangedEvent(mUpdateStatusCaptor.capture());
LogListUpdateStatus statusValue = mUpdateStatusCaptor.getValue();
assertThat(statusValue.state())
.isEqualTo(CTLogListUpdateState.SIGNATURE_VERIFICATION_FAILED);
assertThat(statusValue.signature())
.isEqualTo(new String(signatureBytes, StandardCharsets.UTF_8));
assertThat(statusValue.signature()).isEqualTo(new String(toByteArray(metadataFile)));
}
@Test
@ -423,13 +418,11 @@ public class CertificateTransparencyDownloaderTest {
mCertificateTransparencyDownloader.onReceive(
mContext, makeContentDownloadCompleteIntent(mCompatVersion, invalidLogListFile));
byte[] signatureBytes = Base64.getDecoder().decode(toByteArray(metadataFile));
verify(mLogger, times(1))
.logCTLogListUpdateStateChangedEvent(mUpdateStatusCaptor.capture());
LogListUpdateStatus statusValue = mUpdateStatusCaptor.getValue();
assertThat(statusValue.state()).isEqualTo(CTLogListUpdateState.LOG_LIST_INVALID);
assertThat(statusValue.signature())
.isEqualTo(new String(signatureBytes, StandardCharsets.UTF_8));
assertThat(statusValue.signature()).isEqualTo(new String(toByteArray(metadataFile)));
}
@Test
@ -501,11 +494,7 @@ public class CertificateTransparencyDownloaderTest {
LogListUpdateStatus statusValue = mUpdateStatusCaptor.getValue();
assertThat(statusValue.state()).isEqualTo(CTLogListUpdateState.SUCCESS);
assertThat(statusValue.signature())
.isEqualTo(
new String(
Base64.getDecoder().decode(toByteArray(metadataFile)),
StandardCharsets.UTF_8));
assertThat(statusValue.signature()).isEqualTo(new String(toByteArray(metadataFile)));
assertThat(statusValue.logListTimestamp()).isEqualTo(LOG_LIST_TIMESTAMP);
}
@ -619,7 +608,7 @@ public class CertificateTransparencyDownloaderTest {
new JSONObject()
.put("version", version)
.put("log_list_timestamp", LOG_LIST_TIMESTAMP);
outputStream.write(contentJson.toString().getBytes(UTF_8));
outputStream.write(contentJson.toString().getBytes());
}
return logListFile;