From 821108b3e2149771c52bb7aaf67588a731e1e6a0 Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Thu, 22 Apr 2021 16:43:23 +0900
Subject: [PATCH] Add AOSP certificates for connectivity resources

Instead of the platform certificate, use a dedicated certificate.

The AOSP certificates are only used for testing as they have known keys,
and are replaced when resigning production images.

Key generated with:
openssl req -x509 -newkey rsa:4096 -nodes -days 999999 -keyout key.pem \
    -out com.android.connectivity.resources.x509.pem
openssl pkcs8 -topk8 -inform PEM -outform DER -in key.pem -out \
    com.android.connectivity.resources.pk8 -nocrypt

Fixes: 184808224
Fixes: 185462051
Test: m
Change-Id: I25cddc8d5ab948da9d3a2dbcd202ece1f61dd5a2
---
 .../ServiceConnectivityResources/Android.bp   |   8 ++-
 .../com.android.connectivity.resources.pk8    | Bin 0 -> 2375 bytes
 ...om.android.connectivity.resources.x509.pem |  36 ++++++++++++
 .../resources-certs/key.pem                   |  52 ++++++++++++++++++
 4 files changed, 94 insertions(+), 2 deletions(-)
 create mode 100644 service/ServiceConnectivityResources/resources-certs/com.android.connectivity.resources.pk8
 create mode 100644 service/ServiceConnectivityResources/resources-certs/com.android.connectivity.resources.x509.pem
 create mode 100644 service/ServiceConnectivityResources/resources-certs/key.pem

diff --git a/service/ServiceConnectivityResources/Android.bp b/service/ServiceConnectivityResources/Android.bp
index fa4501ac7f..552a0778d3 100644
--- a/service/ServiceConnectivityResources/Android.bp
+++ b/service/ServiceConnectivityResources/Android.bp
@@ -30,6 +30,10 @@ android_app {
     apex_available: [
         "com.android.tethering",
     ],
-    // TODO: use a dedicated cert once generated
-    certificate: "platform",
+    certificate: ":com.android.connectivity.resources.certificate",
+}
+
+android_app_certificate {
+    name: "com.android.connectivity.resources.certificate",
+    certificate: "resources-certs/com.android.connectivity.resources",
 }
diff --git a/service/ServiceConnectivityResources/resources-certs/com.android.connectivity.resources.pk8 b/service/ServiceConnectivityResources/resources-certs/com.android.connectivity.resources.pk8
new file mode 100644
index 0000000000000000000000000000000000000000..bfdc28b313ec197438aa5fa9a0ab16c2a2d711f8
GIT binary patch
literal 2375
zcmXqL;&f(WWH8`m<J4;NX#38~$jHdbz|zF2YtY20$;8OO)WpQdu>Ey#@V6zK+pD_^
zHaNfDcvd(>{Jy4vw2sa0jfUq|<*eASIqh(hs8E1vf784jycs-SOv`(>%N^F6_18jm
zT28K)FaH6vkecQ-POAb`9*ZX(JD{!<5TYVq@>4RUFzacDo3%B&meSjg|CaB2>Qdgd
zi8bYcrb+R#_iOokC96Xd)DtJ{x04jRq_km<bj$bUu{KRHKUObVq0X=QGeNxn@yv~v
z)8FOo4Xs$^{$lUB9}g-oY~^C&YZLsKm816ehW?yvrhk7Hmo~ZER2>(ntMv3-_GVK}
z`@CDBOwvuC9$D~hOk20CRAI`7b8a>N^^ZSntIGde!<`j(<f2C5rq!QQr`^8F^zOjX
zO}}5rpS|#2GJS)f?!i*U%qMpwB1_m(Q<exgMk{G)Yih3!4qpD{4dW$~|MCg-9E@HG
zQ_R9&1U%?FFa754@@=lBa&4*G@>;z9@y*)G&FyhF&$8R<yUPrj;w1hTFMj_m*k+W}
zX0$Bj<c6@KZ=1^%c;qc@1t&53C$HXJo^BQUF4UF3a!SronO7OSJWMf*e<aoJwrE*j
zy0!nQDMz5XX?80Ak5`2T1~V70nIE_?TA5*SP~V#QFLV#(AM*46?|S6q%cS=oE(J|o
zoTQ)-aqt?)%fFkK%{W}fn*YGwi}m~ehaP-t|M!$!@7~v$`gsfIFRqOnojK~gEKaYK
zIqza!{??g^nUR4JoD!xRf9zUyL7b(*&;Rqv%?{h<S40?J2s|CCz$?_NuDIP&M@6xh
zg>%pGR?n4_91VO@H-29CQ$^0)YhN>~!^=5e3eNa{T=(NaA&bzy1zL}tZ!eNa4F1}Z
zZe<wR>bkaMck6-t>Xxes89dv<T&%kqBd%$LOXfY>ANl!qPDHP2xrM|DJHOZMZMRB2
zy6(;RADj7Vf|@U%m_`|oQr^b^-Zh=Z#~<uxeS5_4(-gxao9tFkon`k%F6%&mmw>eb
zyS0CylCEIV7UeZjLGg|M`m%Qk9};JXk~?Xw{!gq=t}klp!6P56PFp2BKGyi|bR+BP
zCsll|+gJHLeK1@9^uzg<KO7iMUYkD4ZcqEIXIru?dWC6@#-4LuWO{<c@5eNT@f%OP
zxF=G4v$(|6DfdN0cq-O&ncQ8Fv&Lr1gM^I>9rDFL+di*Ty~fmcYOmr{K9jk8Dy++H
z&(0CESTOZm(vdBZ)8em$Ub=C8iFYv93LU9vj#HC9-Hu<km|uvk<Ke{l8!ZJ|Z&s|A
zdN)by_6MmSFB7Z6*Yq`;H+`5;=lLW?Xm?0&^67L1Czo0F9EMhP;k;WWGl%+~k>$=j
z$zw6^%<N?ke$8~f+Og|Z8f(sV{_^*RRqZov%{ENA@FT>bNrhWC;j;-FkE)maxkm;k
zPg``n_p$i+ctXjXeSW;6MX%2U1m)hbJEZGeZgXZQQxhX2!*iaJH}9fl1V81STf3Zl
z=0)qyJC8);<X;qA4Qy0y@;I@2|DzqdD=sgrQLZ(;QhYOJ{)2mSC%=?R6%+TC{9Lm(
zEjLayf-P<GukXE12bavtKXYso+mVx#1bl<I>$r<-Y-G1_Zz&Jb{5322>zV7bYJ8G^
zy_0$Rm9ICXb{0bbZ_$>bpq`*9uZ}geRNb9?H)o+~aq&m<U42&`gn!XL|9z|NVFt&D
zBc@k4>cwufMZPx8pSJS6eEZU4hi@3KdaKN}^Var0pUs8bPg*@!cKtuQdAGk;pIwgg
z!c)^eb&4td%yqi9yEATH!+n9fs`L0KESePDIBUnh8+>{%cihpxS?+v{`%0BPI1o-B
ze{Z*jr{UY#tdozvEu1R-Fuo(a{(!S;!^+UG75kzMtF|bp$Eb+M@g8^+<?XcfPixRz
zW6M_ue(*eDJ^vth!45&+$?IZTXZCj+cmx=qd}!>hd@x3e-7sh2dfuz<8@;0b$z`iW
zUzOMttQp7Eds?_JE_bRl=i_6S>L&O)R0U}TtT|}6xbONR-oA;`YS~1VaA+95T3%$8
zR_pRu{ccCk->_o-I^Os^gE;ryrf2RvT`SML{}$J`o5so$w;oixd(K<o#@no0w;x1p
z%l2U~59V8A>ny+B`^l3zR@n=>CvBI{*8YCP@WY<-KkN%1*q`_t$uG72bgta=!wYlP
z-u+g-M0)XGrY1%P-qnJ?w^<2K<1nj#+5OXPyE$|Dtt~>&(n8Kvp1Jq&saoQz^^z~9
zy11VRwN+x4s7{KBd!tk1((^<AecV+>{n~$%%=a&>D=%bUwm*H!bl#fO)z_;$*}t!p
zw0z{JIaR-u>&I)hNS<w;oWB+CrN&*foxh^Je~LJZUYwEfZ=r)8FYex}^H`9uTz{h4
z@o6s(mL~s{Y&<pJaO)f6<rfRwl~mT5wyaQCoz!ti`O{7FYyF;^SF<r4s_U0oa%bVZ
z?^|~6{=D#2?s~<@Up2ENxPSk0`&n>nb<8IFe#VKctzx^T>{MuZx~L)eYn&_F)75u)
zC$Us44ekqnzwOSU{kI>S>B_kM!sk0E41~nB_i#<)oN_<8w`WmL;VRFstF>Mx<q1!*
zDpC3${Ov;bI?*pH`jc0$zVU3))ch-JBpmO%?R(v1#Vqw%P}!a{xcBLLjhR(aC(o8w
zUjFiwRhh~9K+LjJ57x!0sM%OOmI&CtsD8~dv7|c>Z%TM6PY7Kl{rFYa-Y+Z*+V!t^
zUl)*YoodiEldaiHbRJ99##yVT<$8TFu3Gy))b{DdHOGQqGkDcy<gfFwY5cWkefd|*
z`-~3@ejZhy!Iq<YN`F)NuPe`+8vZw}dv7H<xkjIn_l5gry{!@_H@%eQ%B=NhjBfg6
z%b%fJv9h7E_nY(UeYN-fZ*9zKp0&zv*3tA^_1&M(3!jw)XNG1yGl_VKG%Mle(}9Q2
zT-fID=#u?GtGEQWg}X{kTazRf|Cq^sOZMiD&4SM)9!RI0(PDWzbw=Eh2OVd89|=|L
z{80Do<;(}dTcmX=mgk?CoW1^v=)2z!XB$5`QTZ?}L!#v3mAAdeH7h4FH{4Wacz3b=
z;?!H}Pw&0RYIar^t=VAf`YkMX_G}jMxnFA!_D+stUdD2F-jV=6rcDJMd>*y&v%Quc
z649xt<LQf<%)9#jW?u0s4fXa@>^mQ>Nb5P_H1|}g#fS5m@eAg<Cqx*|InAbUVTu0k
z>E1gO<M%yR-<ZXI>rPJStm|T8J7bkC{x?6WFHnBsA3HndNzgUVM79&kQ@Wh*0RWSB
Bct`*M

literal 0
HcmV?d00001

diff --git a/service/ServiceConnectivityResources/resources-certs/com.android.connectivity.resources.x509.pem b/service/ServiceConnectivityResources/resources-certs/com.android.connectivity.resources.x509.pem
new file mode 100644
index 0000000000..70eca1cee1
--- /dev/null
+++ b/service/ServiceConnectivityResources/resources-certs/com.android.connectivity.resources.x509.pem
@@ -0,0 +1,36 @@
+-----BEGIN CERTIFICATE-----
+MIIGQzCCBCugAwIBAgIUZY8nxBMINp/79sziXU77MLPpEXowDQYJKoZIhvcNAQEL
+BQAwga8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQH
+DA1Nb3VudGFpbiBWaWV3MRAwDgYDVQQKDAdBbmRyb2lkMRAwDgYDVQQLDAdBbmRy
+b2lkMSswKQYDVQQDDCJjb20uYW5kcm9pZC5jb25uZWN0aXZpdHkucmVzb3VyY2Vz
+MSIwIAYJKoZIhvcNAQkBFhNhbmRyb2lkQGFuZHJvaWQuY29tMCAXDTIxMDQyMjA3
+MjkxMFoYDzQ3NTkwMzE5MDcyOTEwWjCBrzELMAkGA1UEBhMCVVMxEzARBgNVBAgM
+CkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEDAOBgNVBAoMB0Fu
+ZHJvaWQxEDAOBgNVBAsMB0FuZHJvaWQxKzApBgNVBAMMImNvbS5hbmRyb2lkLmNv
+bm5lY3Rpdml0eS5yZXNvdXJjZXMxIjAgBgkqhkiG9w0BCQEWE2FuZHJvaWRAYW5k
+cm9pZC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC361NT9qSz
+h3uLcLBD67HNE1QX3ykwGyw8u7ExzqpsqLCzZsOCFRJQJY+CnrgNaAz0NXeNtx7D
+Lpr9OCWWbG1KTQ/ANlR8g6xCqlAk4xdixsAnIlBUJB90+RlkcWrliEY7OwcqIu3x
+/qe+5UR3irIFZOApNHOm760PjRl7VWAnYZC/PhkW0iKwnBuE96ddPIJc+KuiqCcP
+KflgF4/jmbHTZ+5uvVV4qkfovc744HnQtQoCDoYR8WpsJv3YL5xrAv78o3WCRzx6
+xxB+eUlJpuyyfIee2lUCG4Ly4jgOsWaupnUglLDORnz/L8fhhnpv83wLal7E0Shx
+sqvzZZbb1QLuwMWy++gfzdDvGWewES3BdSFp5NwYWXQGZWSkEEFbIiorKSurU1On
+9OwB0jT/H2B/CAFKYJQ2V+hQ4I7PG+z9p7ZFNR6GZbZuhEr+Dpq1CwtI3W45izr3
+RJgcc2IP6Oj7/XC2MmKGMqZkybBWcvazdyAMHzk9EZIBT2Oru3dnOl3uVUUPeZRs
+xRzqaA0MAlyj+GJ9uziEr3W1j+U1CFEnNWtlD/jqcTAwmaOsn1GhWyMAo1KOrJ/o
+LcJvwk5P/0XEyeli7/DSUpGjYiAgWMHWCOn9s6aYw3YFb+A/SgX3/+FIDib/vHTX
+i76JZfO0CfoKsbFDCH9KOMupHM9EO3ftQwIDAQABo1MwUTAdBgNVHQ4EFgQU/KGg
+gmMqXD5YOe5+B0W+YezN9LcwHwYDVR0jBBgwFoAU/KGggmMqXD5YOe5+B0W+YezN
+9LcwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAhr+AaNaIlRyM
+WKyJ+2Aa35fH5e44Xr/xPpriM5HHxsj0evjMCODqCQ7kzfwSEmtXh5uZYYNKb/JP
+ZMDHIFcYi1QCvm6E6YOd+Qn9CVxrwaDhigJv7ylhVf8q201GTvHhJIU99yFIrzJQ
+RNhxw+pNo7FYMZr3J7JZPAy60DN1KZvRV4FjZx5qiPUMyu4zVygzDkr0v5Ilncdp
+l9VVjOi7ocHyBKI+7RkXl97xN4SUe3vszwZQHCVyVopBw+YrMbDBCrknrQzUEgie
+BuI+kj5oOeiQ0P1i1K+UCCAjrLwhNyc9H02rKUtBHxa2AVjw7YpAJlBesb49Qvq+
+5L6JjHFVSSOEbIjboNib26zNackjbiefF74meSUbGVGfcJ1OdkZsXZWphmER8V7X
+Wz3Z8JwOXW1RLPgcbjilHUR5g8pEmWBv4KrTCSg5IvOJr4w3pyyMBiiVI9NI5sB7
+g5Mi9v3ifPD1OHA4Y3wYCb26mMEpRb8ogOhMHcGNbdnL3QtIUg4cmXGqGSY/LbpU
+np0sIQDSjc46o79F0boPsLlaN3US5WZIu0nc9SHkjoNhd0CJQ5r9aEn4/wNrZgxs
+s8OEKsqcS7OsWiIE6nG51TMDsCuyRBrGedtSUyFFSVSpivpYIrPVNKKlHsJ/o+Nv
+Udb6dBjCraPvJB8binB1aojwya3MwRs=
+-----END CERTIFICATE-----
diff --git a/service/ServiceConnectivityResources/resources-certs/key.pem b/service/ServiceConnectivityResources/resources-certs/key.pem
new file mode 100644
index 0000000000..38771c2615
--- /dev/null
+++ b/service/ServiceConnectivityResources/resources-certs/key.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQC361NT9qSzh3uL
+cLBD67HNE1QX3ykwGyw8u7ExzqpsqLCzZsOCFRJQJY+CnrgNaAz0NXeNtx7DLpr9
+OCWWbG1KTQ/ANlR8g6xCqlAk4xdixsAnIlBUJB90+RlkcWrliEY7OwcqIu3x/qe+
+5UR3irIFZOApNHOm760PjRl7VWAnYZC/PhkW0iKwnBuE96ddPIJc+KuiqCcPKflg
+F4/jmbHTZ+5uvVV4qkfovc744HnQtQoCDoYR8WpsJv3YL5xrAv78o3WCRzx6xxB+
+eUlJpuyyfIee2lUCG4Ly4jgOsWaupnUglLDORnz/L8fhhnpv83wLal7E0Shxsqvz
+ZZbb1QLuwMWy++gfzdDvGWewES3BdSFp5NwYWXQGZWSkEEFbIiorKSurU1On9OwB
+0jT/H2B/CAFKYJQ2V+hQ4I7PG+z9p7ZFNR6GZbZuhEr+Dpq1CwtI3W45izr3RJgc
+c2IP6Oj7/XC2MmKGMqZkybBWcvazdyAMHzk9EZIBT2Oru3dnOl3uVUUPeZRsxRzq
+aA0MAlyj+GJ9uziEr3W1j+U1CFEnNWtlD/jqcTAwmaOsn1GhWyMAo1KOrJ/oLcJv
+wk5P/0XEyeli7/DSUpGjYiAgWMHWCOn9s6aYw3YFb+A/SgX3/+FIDib/vHTXi76J
+ZfO0CfoKsbFDCH9KOMupHM9EO3ftQwIDAQABAoICAQCXM/GKqtAXBIBOT/Ops0C2
+n3hYM9BRy1UgDRKNJyG3OSwkIY0ECbzHhUmpkkEwTGWx8675JB43Sr6DBUDpnPRw
+zE/xrvjgcQQSvqAq40PbohhhU/WEZzoxWYVFrXS7hcBve4TVYGgMtlZEO4qBWNYo
+Vxlu5r9Z89tsWI0ldzgYyD5O64eG2nVIit6Y/11p6pAmTQ4WKHYMIm7xUA2siTPH
+4L8F7cQx8pQxxLI+q5WaPuweasBQShA7IAc7T1EiLRFitCOsWlJfgf6Oa7oTwhcA
+Wh7JOyf+Fo4ejlqVwcTwOss6YOPGge7LgQWr5HoORbeqTuXgmy/L4Z85+EABNOs1
+5muHZvsuPXSmW6g1bCi8zvQcjFIX31yBVg8zkdG8WRezFxiVlN8UFAx4rwo03aBs
+rDyU4GCxoUBvF/M9534l1gKOyr0hlQ40nQ4kBabbm2wWOKCVzmLEtFmWX9RV0tjX
+pEtTCqgsGlsIypLy21+uow8SBojhkZ+xORCF2XivGu6SKtvwGvjpYXpXrI6DN4Lw
+kH5J5FwSu1SNY8tnIEJEmj8IMTp+Vw20kwNVTcwdC2nJDDiezJum4PqZRdWIuupm
+BWzXD3fvMXqHmT02sJTQ+FRAgiQLLWDzNAYMJUofzuIwycs4iO9MOPHjkHScvk4N
+FXLrzFBSbdw+wi1DdzzMuQKCAQEA5wx07O5bHBHybs6tpwuZ0TuJ3OIVXh/ocNVR
+gSOCSMirv+K4u3jToXwjfTXUc9lcn+DenZPpGmUWF0sZ83ytZm1eFVgGZpP6941C
+waSeb8zGsgbEyZIQTVILfgtyPDwdtgu0d1Ip+ppj9czXmnxMY/ruHOX1Do1UfZoA
+UA1ytHJSjFKU6saAhHrdk91soTVzc/E3uo7U4Ff0L8/3tT3DAEFYxDXUCH8W2IZZ
+6zVvlqnPH4elxsPYM6rtIwq52reOTLNxC+SFSamK/82zu09Kjj5sQ6HKlvKJFiL5
+bULWu4lenoDfEN0lng+QopJTgZq4/tgOLum43C/Zd0PGC9R6PwKCAQEAy8fvPqwM
+gPbNasni9qGVG+FfiFd/wEMlgKlVVqi+WzF6tCAnXCQXXg3A7FpLQrX8hVKdMznq
+wPgM5AXP4FOguBFNk65chZmPizBIUDPJ4TNHI8FcGgcxbKGvDdVHsUpa/h5rJlvV
+GLJTKV4KjcsTjl5tlRsJ48bSfpBNQHpSKlCswT6jjteiDY6Rln0GFKQIKDHqp3I6
+Zn1E4yfdiIz9VnMPfg1fbjBeR7s1zNzlrR8Dv9oK9tkzI5G1wSbdzksg2O1q2tvg
+WrZrTAA3Uw6sPUMft0vk5Jw6a6CLkrcfayv3xDHwvM/4P3HgP8j9WQ8at8ttHpfD
+oWyt3fZ3pBuj/QKCAQANqxH7tjoTlgg2f+mL+Ua3NwN32rQS5mZUznnM3vHlJmHq
+rxnolURHyFU9IgMYe2JcXuwsfESM+C/vXtUBL33+kje/oX53cQemv2eUlw18ZavX
+ekkH96kZOeJOKZUvdQr46wZZDLZJCfsh3mVe0T2fqIePlBcELl4yM/sSwUjo3d5+
+SKBgpy+RJseW6MF1Y/kZgcqfMbXsM6fRcEciJK41hKggq2KIwiPy2TfWj0mzqwYC
+wn6PHKTcoZ73tLm786Hqba8hWfp8mhgL+/pG+XDaq1yyP48BkQWFFrqUuSCE5aKA
+U/VeRQblq9wNkgR4pVOOV++23MK/2+DMimjb6Ez3AoIBABIXK7wKlgmU32ONjKKM
+capJ9asq6WJuE5Q6dCL/U/bQi64V9KiPY6ur2OailW/UrBhB30a+64I6AxrzESM/
+CVON5a8omXoayc13edP05QUjAjvAXKbK4K5eJCY8OuMYUL+if6ymFmLc4dkYSiOQ
+Vaob4+qKvfQEoIcv1EvXEBhFlTCKmQaDShWeBHqxmqqWbUr0M3qt/1U95bGsxlPr
+AEp+aG+uTDyB+ryvd/U53wHhcPnFJ5gGbC3KL7J3+tTngoD/gq7vOhmTfC8BDehH
+sy61GMmy6R0KaX1IgVuC+j0PaC14qYB5jfZD675930/asWqDmqpOmsVn2n+L888T
+zRkCggEBAIMuNhhfGGY6E4PLUcPM0LZA4tI/wTpeYEahunU1hWIYo/iZB9od2biz
+EeYY4BtkzCoE5ZWYXqTgiMxN4hJ4ufB+5umZ4BO0Gyx4p2/Ik2uv1BXu++GbM+TI
+eeFmaBh00dTtjccpeZEDgNkjAO7Rh9GV2ifl3uhqg0MnFXywPUX2Vm2bmwQXnfV9
+wY2TXgOmBN2epFBOArJwiA5IfV+bSqXCFCx8fgyOWpMNq9+zDRd6KCeHyge54ahm
+jMhCncp1OPDPaV+gnUdgWDGcywYg0KQvu5dLuCFfvucnsWoH2txsVZrXFha5XSM4
+/4Pif3Aj5E9dm1zkUtZJYQbII5SKQ94=
+-----END PRIVATE KEY-----