32c060fc81
This CL adds a check to make sure the public key downloaded by the CTDownloader matches a known allowlist of keys. If the key does not appear in the allowlist, we cannot make guarantee that the key has not been tampered with, so we will not proceed with the downloads of the CT log list and its signature. Bug: 374719543 Test: atest NetworkSecurityUnitTests Change-Id: I185a2330d9a4d138c93522cd4b22920e8a2412a2
61 lines
2.2 KiB
Text
61 lines
2.2 KiB
Text
// Copyright (C) 2024 The Android Open Source Project
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
package {
|
|
default_team: "trendy_team_platform_security",
|
|
default_applicable_licenses: ["Android-Apache-2.0"],
|
|
}
|
|
|
|
// Main lib for Certificate Transparency services.
|
|
java_library {
|
|
name: "service-networksecurity-pre-jarjar",
|
|
defaults: ["framework-system-server-module-defaults"],
|
|
visibility: ["//packages/modules/Connectivity:__subpackages__"],
|
|
|
|
srcs: [
|
|
"src/**/*.java",
|
|
":statslog-certificate-transparency-java-gen",
|
|
],
|
|
|
|
libs: [
|
|
"framework-configinfrastructure.stubs.module_lib",
|
|
"framework-connectivity-pre-jarjar",
|
|
"service-connectivity-pre-jarjar",
|
|
"framework-statsd.stubs.module_lib",
|
|
"ServiceConnectivityResources",
|
|
],
|
|
|
|
static_libs: [
|
|
"auto_value_annotations",
|
|
"android.security.flags-aconfig-java-export",
|
|
],
|
|
|
|
plugins: [
|
|
"auto_value_plugin",
|
|
"auto_annotation_plugin",
|
|
],
|
|
|
|
// This is included in service-connectivity which is 30+
|
|
// TODO (b/293613362): allow APEXes to have service jars with higher min_sdk than the APEX
|
|
// (service-connectivity is only used on 31+) and use 31 here
|
|
min_sdk_version: "30",
|
|
sdk_version: "system_server_current",
|
|
apex_available: ["com.android.tethering"],
|
|
}
|
|
|
|
genrule {
|
|
name: "statslog-certificate-transparency-java-gen",
|
|
tools: ["stats-log-api-gen"],
|
|
cmd: "$(location stats-log-api-gen) --java $(out) --module certificate_transparency --javaPackage com.android.server.net.ct --javaClass CertificateTransparencyStatsLog",
|
|
out: ["com/android/server/net/ct/CertificateTransparencyStatsLog.java"],
|
|
}
|