From 9ffc0685d74c40397e81ec94f80b81de3acb7fd5 Mon Sep 17 00:00:00 2001 From: Sandro Montanari Date: Wed, 24 Jul 2024 15:50:37 +0000 Subject: [PATCH] Add boilerplate code for CertificateTransparencyService Flag: com.android.ct.flags.certificate_transparency_service Bug: 319829948 Test: m Change-Id: I69dd1b7346a013e9a990c9ae8cec1beb51be074d --- common/FlaggedApi.bp | 17 ++++++ common/networksecurity_flags.aconfig | 9 +++ framework/Android.bp | 4 ++ networksecurity/OWNERS | 4 ++ networksecurity/framework/Android.bp | 31 ++++++++++ .../ct/CertificateTransparencyManager.java | 40 +++++++++++++ .../ct/ICertificateTransparencyManager.aidl | 22 ++++++++ networksecurity/service/Android.bp | 40 +++++++++++++ .../ct/CertificateTransparencyService.java | 56 +++++++++++++++++++ service-t/Android.bp | 1 + .../ConnectivityServiceInitializer.java | 16 ++++++ service/Android.bp | 21 +++++++ 12 files changed, 261 insertions(+) create mode 100644 common/networksecurity_flags.aconfig create mode 100644 networksecurity/OWNERS create mode 100644 networksecurity/framework/Android.bp create mode 100644 networksecurity/framework/src/android/net/ct/CertificateTransparencyManager.java create mode 100644 networksecurity/framework/src/android/net/ct/ICertificateTransparencyManager.aidl create mode 100644 networksecurity/service/Android.bp create mode 100644 networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java diff --git a/common/FlaggedApi.bp b/common/FlaggedApi.bp index d5cfde3717..fef9ac32e7 100644 --- a/common/FlaggedApi.bp +++ b/common/FlaggedApi.bp @@ -47,3 +47,20 @@ aconfig_declarations { srcs: ["nearby_flags.aconfig"], visibility: ["//packages/modules/Connectivity:__subpackages__"], } + +aconfig_declarations { + name: "com.android.networksecurity.flags-aconfig", + package: "com.android.net.ct.flags", + container: "com.android.tethering", + srcs: ["networksecurity_flags.aconfig"], + visibility: ["//packages/modules/Connectivity:__subpackages__"], +} + +java_aconfig_library { + name: "networksecurity_flags_java_lib", + aconfig_declarations: "com.android.networksecurity.flags-aconfig", + min_sdk_version: "30", + defaults: ["framework-minus-apex-aconfig-java-defaults"], + apex_available: ["com.android.tethering"], + visibility: ["//packages/modules/Connectivity:__subpackages__"], +} diff --git a/common/networksecurity_flags.aconfig b/common/networksecurity_flags.aconfig new file mode 100644 index 0000000000..ef8ffcdf67 --- /dev/null +++ b/common/networksecurity_flags.aconfig @@ -0,0 +1,9 @@ +package: "com.android.net.ct.flags" +container: "com.android.tethering" +flag { + name: "certificate_transparency_service" + is_exported: true + namespace: "network_security" + description: "Enable service for certificate transparency log list data" + bug: "319829948" +} diff --git a/framework/Android.bp b/framework/Android.bp index deea6b6ac9..4c4f7920e5 100644 --- a/framework/Android.bp +++ b/framework/Android.bp @@ -63,6 +63,7 @@ java_defaults { ":framework-connectivity-sources", ":net-utils-framework-common-srcs", ":framework-connectivity-api-shared-srcs", + ":framework-networksecurity-sources", ], aidl: { generate_get_transaction_name: true, @@ -93,6 +94,7 @@ java_defaults { "modules-utils-backgroundthread", "modules-utils-build", "modules-utils-preconditions", + "networksecurity_flags_java_lib", "framework-connectivity-javastream-protos", ], impl_only_static_libs: [ @@ -207,6 +209,7 @@ java_sdk_library { }, aconfig_declarations: [ "com.android.net.flags-aconfig", + "com.android.networksecurity.flags-aconfig", ], } @@ -307,6 +310,7 @@ droidstubs { srcs: [ ":framework-connectivity-sources", ":framework-connectivity-tiramisu-updatable-sources", + ":framework-networksecurity-sources", ":framework-nearby-java-sources", ":framework-thread-sources", ], diff --git a/networksecurity/OWNERS b/networksecurity/OWNERS new file mode 100644 index 0000000000..1a4130a3c1 --- /dev/null +++ b/networksecurity/OWNERS @@ -0,0 +1,4 @@ +# Bug component: 1479456 + +sandrom@google.com +tweek@google.com diff --git a/networksecurity/framework/Android.bp b/networksecurity/framework/Android.bp new file mode 100644 index 0000000000..2b77926db2 --- /dev/null +++ b/networksecurity/framework/Android.bp @@ -0,0 +1,31 @@ +// +// Copyright (C) 2024 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +package { + default_team: "trendy_team_platform_security", + default_applicable_licenses: ["Android-Apache-2.0"], +} + +filegroup { + name: "framework-networksecurity-sources", + srcs: [ + "src/**/*.java", + "src/**/*.aidl", + ], + path: "src", + visibility: [ + "//packages/modules/Connectivity:__subpackages__", + ], +} diff --git a/networksecurity/framework/src/android/net/ct/CertificateTransparencyManager.java b/networksecurity/framework/src/android/net/ct/CertificateTransparencyManager.java new file mode 100644 index 0000000000..94521ae0f3 --- /dev/null +++ b/networksecurity/framework/src/android/net/ct/CertificateTransparencyManager.java @@ -0,0 +1,40 @@ +/* + * Copyright (C) 2024 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package android.net.ct; + +import android.annotation.FlaggedApi; +import android.annotation.SystemService; + +import com.android.net.ct.flags.Flags; + +/** + * Provides the primary API for the Certificate Transparency Manager. + * + * @hide + */ +@FlaggedApi(Flags.FLAG_CERTIFICATE_TRANSPARENCY_SERVICE) +@SystemService(CertificateTransparencyManager.SERVICE_NAME) +public final class CertificateTransparencyManager { + + public static final String SERVICE_NAME = "certificate_transparency"; + + /** + * Creates a new CertificateTransparencyManager instance. + * + * @hide + */ + public CertificateTransparencyManager() {} +} diff --git a/networksecurity/framework/src/android/net/ct/ICertificateTransparencyManager.aidl b/networksecurity/framework/src/android/net/ct/ICertificateTransparencyManager.aidl new file mode 100644 index 0000000000..b5bce7faa8 --- /dev/null +++ b/networksecurity/framework/src/android/net/ct/ICertificateTransparencyManager.aidl @@ -0,0 +1,22 @@ +/** + * Copyright (c) 2024, The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package android.net.ct; + +/** +* Interface for communicating with CertificateTransparencyService. +* @hide +*/ +interface ICertificateTransparencyManager {} diff --git a/networksecurity/service/Android.bp b/networksecurity/service/Android.bp new file mode 100644 index 0000000000..66d201a4de --- /dev/null +++ b/networksecurity/service/Android.bp @@ -0,0 +1,40 @@ +// Copyright (C) 2024 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +package { + default_team: "trendy_team_platform_security", + default_applicable_licenses: ["Android-Apache-2.0"], +} + +// Main lib for Certificate Transparency services. +java_library { + name: "service-networksecurity-pre-jarjar", + defaults: ["framework-system-server-module-defaults"], + visibility: ["//packages/modules/Connectivity:__subpackages__"], + + srcs: [ + "src/**/*.java", + ], + + libs: [ + "framework-connectivity-pre-jarjar", + "service-connectivity-pre-jarjar", + ], + + // This is included in service-connectivity which is 30+ + // TODO (b/293613362): allow APEXes to have service jars with higher min_sdk than the APEX + // (service-connectivity is only used on 31+) and use 31 here + min_sdk_version: "30", + sdk_version: "system_server_current", + apex_available: ["com.android.tethering"], +} diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java new file mode 100644 index 0000000000..8c53bf7a02 --- /dev/null +++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java @@ -0,0 +1,56 @@ +/* + * Copyright (C) 2024 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.android.server.net.ct; + +import android.annotation.RequiresApi; +import android.content.Context; +import android.net.ct.ICertificateTransparencyManager; +import android.os.Build; +import android.util.Log; + +import com.android.net.ct.flags.Flags; +import com.android.net.module.util.DeviceConfigUtils; + +/** Implementation of the Certificate Transparency service. */ +@RequiresApi(Build.VERSION_CODES.VANILLA_ICE_CREAM) +public class CertificateTransparencyService extends ICertificateTransparencyManager.Stub { + + private static final String TAG = "CertificateTransparency"; + private static final String CERTIFICATE_TRANSPARENCY_ENABLED = + "certificate_transparency_service_enabled"; + + /** + * @return true if the CertificateTransparency service is enabled. + */ + public static boolean enabled(Context context) { + // TODO: replace isTetheringFeatureEnabled with CT namespace flag. + return DeviceConfigUtils.isTetheringFeatureEnabled( + context, CERTIFICATE_TRANSPARENCY_ENABLED) + && Flags.certificateTransparencyService(); + } + + /** Creates a new {@link CertificateTransparencyService} object. */ + public CertificateTransparencyService(Context context) {} + + /** + * Called by {@link com.android.server.ConnectivityServiceInitializer}. + * + * @see com.android.server.SystemService#onBootPhase + */ + public void onBootPhase(int phase) { + Log.d(TAG, "CertificateTransparencyService#onBootPhase " + phase); + } +} diff --git a/service-t/Android.bp b/service-t/Android.bp index 779f354fd1..e00b7cfe6a 100644 --- a/service-t/Android.bp +++ b/service-t/Android.bp @@ -59,6 +59,7 @@ java_library { "framework-wifi", "service-connectivity-pre-jarjar", "service-nearby-pre-jarjar", + "service-networksecurity-pre-jarjar", "service-thread-pre-jarjar", service_remoteauth_pre_jarjar_lib, "ServiceConnectivityResources", diff --git a/service-t/src/com/android/server/ConnectivityServiceInitializer.java b/service-t/src/com/android/server/ConnectivityServiceInitializer.java index 1ac2f6e039..5d23fdc34e 100644 --- a/service-t/src/com/android/server/ConnectivityServiceInitializer.java +++ b/service-t/src/com/android/server/ConnectivityServiceInitializer.java @@ -28,6 +28,7 @@ import com.android.server.connectivity.ConnectivityNativeService; import com.android.server.ethernet.EthernetService; import com.android.server.ethernet.EthernetServiceImpl; import com.android.server.nearby.NearbyService; +import com.android.server.net.ct.CertificateTransparencyService; import com.android.server.thread.ThreadNetworkService; /** @@ -43,6 +44,7 @@ public final class ConnectivityServiceInitializer extends SystemService { private final NearbyService mNearbyService; private final EthernetServiceImpl mEthernetServiceImpl; private final ThreadNetworkService mThreadNetworkService; + private final CertificateTransparencyService mCertificateTransparencyService; public ConnectivityServiceInitializer(Context context) { super(context); @@ -55,6 +57,7 @@ public final class ConnectivityServiceInitializer extends SystemService { mNsdService = createNsdService(context); mNearbyService = createNearbyService(context); mThreadNetworkService = createThreadNetworkService(context); + mCertificateTransparencyService = createCertificateTransparencyService(context); } @Override @@ -111,6 +114,10 @@ public final class ConnectivityServiceInitializer extends SystemService { if (mThreadNetworkService != null) { mThreadNetworkService.onBootPhase(phase); } + + if (SdkLevel.isAtLeastV() && mCertificateTransparencyService != null) { + mCertificateTransparencyService.onBootPhase(phase); + } } /** @@ -186,4 +193,13 @@ public final class ConnectivityServiceInitializer extends SystemService { } return new ThreadNetworkService(context); } + + /** Return CertificateTransparencyService instance if enable, otherwise null. */ + @Nullable + private CertificateTransparencyService createCertificateTransparencyService( + final Context context) { + return SdkLevel.isAtLeastV() && CertificateTransparencyService.enabled(context) + ? new CertificateTransparencyService(context) + : null; + } } diff --git a/service/Android.bp b/service/Android.bp index 1a0e04555c..c68f0b8de7 100644 --- a/service/Android.bp +++ b/service/Android.bp @@ -206,6 +206,7 @@ java_library { }, visibility: [ "//packages/modules/Connectivity/service-t", + "//packages/modules/Connectivity/networksecurity:__subpackages__", "//packages/modules/Connectivity/tests:__subpackages__", "//packages/modules/Connectivity/thread/service:__subpackages__", "//packages/modules/Connectivity/thread/tests:__subpackages__", @@ -247,6 +248,7 @@ java_defaults { "service-connectivity-pre-jarjar", "service-connectivity-tiramisu-pre-jarjar", "service-nearby-pre-jarjar", + "service-networksecurity-pre-jarjar", service_remoteauth_pre_jarjar_lib, "service-thread-pre-jarjar", ], @@ -315,6 +317,7 @@ genrule { ":framework-connectivity-jarjar-rules", ":service-connectivity-jarjar-gen", ":service-nearby-jarjar-gen", + ":service-networksecurity-jarjar-gen", ":service-remoteauth-jarjar-gen", ":service-thread-jarjar-gen", ], @@ -404,6 +407,24 @@ java_genrule { visibility: ["//visibility:private"], } +java_genrule { + name: "service-networksecurity-jarjar-gen", + tool_files: [ + ":service-networksecurity-pre-jarjar{.jar}", + "jarjar-excludes.txt", + ], + tools: [ + "jarjar-rules-generator", + ], + out: ["service_ct_jarjar_rules.txt"], + cmd: "$(location jarjar-rules-generator) " + + "$(location :service-networksecurity-pre-jarjar{.jar}) " + + "--prefix com.android.server.net.ct " + + "--excludes $(location jarjar-excludes.txt) " + + "--output $(out)", + visibility: ["//visibility:private"], +} + genrule { name: "statslog-connectivity-java-gen", tools: ["stats-log-api-gen"],