From 473ee1358deac95b094a40fd47397ab97b975751 Mon Sep 17 00:00:00 2001
From: Chad Brubaker <cbrubaker@google.com>
Date: Mon, 20 Jun 2016 12:41:47 -0700
Subject: Use calling app's Network Security Config for HTTPS downloads

Bug:29505888
Change-Id: Ifc33fd75e44d1dbc5a4ce5caa8e1ff938b94623e
---
 .../providers/downloads/DownloadThread.java        | 16 ++++++++++++++++
 .../providers/downloads/RealSystemFacade.java      | 22 ++++++++++++++++++++++
 .../android/providers/downloads/SystemFacade.java  | 10 ++++++++++
 3 files changed, 48 insertions(+)

(limited to 'src/com/android/providers/downloads')

diff --git a/src/com/android/providers/downloads/DownloadThread.java b/src/com/android/providers/downloads/DownloadThread.java
index da51e9d4..34d6ad1a 100644
--- a/src/com/android/providers/downloads/DownloadThread.java
+++ b/src/com/android/providers/downloads/DownloadThread.java
@@ -85,6 +85,10 @@ import java.net.MalformedURLException;
 import java.net.ProtocolException;
 import java.net.URL;
 import java.net.URLConnection;
+import java.security.GeneralSecurityException;
+
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
 
 /**
  * Task which executes a given {@link DownloadInfo}: making network requests,
@@ -403,6 +407,13 @@ public class DownloadThread extends Thread {
         }
 
         boolean cleartextTrafficPermitted = mSystemFacade.isCleartextTrafficPermitted(mInfo.mUid);
+        SSLContext appContext;
+        try {
+            appContext = mSystemFacade.getSSLContextForPackage(mContext, mInfo.mPackage);
+        } catch (GeneralSecurityException e) {
+            // This should never happen.
+            throw new StopRequestException(STATUS_UNKNOWN_ERROR, "Unable to create SSLContext.");
+        }
         int redirectionCount = 0;
         while (redirectionCount++ < Constants.MAX_REDIRECTS) {
             // Enforce the cleartext traffic opt-out for the UID. This cannot be enforced earlier
@@ -424,6 +435,11 @@ public class DownloadThread extends Thread {
                 conn.setInstanceFollowRedirects(false);
                 conn.setConnectTimeout(DEFAULT_TIMEOUT);
                 conn.setReadTimeout(DEFAULT_TIMEOUT);
+                // If this is going over HTTPS configure the trust to be the same as the calling
+                // package.
+                if (conn instanceof HttpsURLConnection) {
+                    ((HttpsURLConnection)conn).setSSLSocketFactory(appContext.getSocketFactory());
+                }
 
                 addRequestHeaders(conn, resuming);
 
diff --git a/src/com/android/providers/downloads/RealSystemFacade.java b/src/com/android/providers/downloads/RealSystemFacade.java
index 2203eefc..df1d245f 100644
--- a/src/com/android/providers/downloads/RealSystemFacade.java
+++ b/src/com/android/providers/downloads/RealSystemFacade.java
@@ -26,6 +26,13 @@ import android.content.pm.PackageManager.NameNotFoundException;
 import android.net.ConnectivityManager;
 import android.net.Network;
 import android.net.NetworkInfo;
+import android.security.NetworkSecurityPolicy;
+import android.security.net.config.ApplicationConfig;
+
+import java.security.GeneralSecurityException;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
 
 import com.android.internal.util.ArrayUtils;
 
@@ -94,6 +101,21 @@ class RealSystemFacade implements SystemFacade {
         return false;
     }
 
+    @Override
+    public SSLContext getSSLContextForPackage(Context context, String packageName)
+            throws GeneralSecurityException {
+        ApplicationConfig appConfig;
+        try {
+            appConfig = NetworkSecurityPolicy.getApplicationConfigForPackage(context, packageName);
+        } catch (NameNotFoundException e) {
+            // Unknown package -- fallback to the default SSLContext
+            return SSLContext.getDefault();
+        }
+        SSLContext ctx = SSLContext.getInstance("TLS");
+        ctx.init(null, new TrustManager[] {appConfig.getTrustManager()}, null);
+        return ctx;
+    }
+
     /**
      * Returns whether cleartext network traffic (HTTP) is permitted for the provided package.
      */
diff --git a/src/com/android/providers/downloads/SystemFacade.java b/src/com/android/providers/downloads/SystemFacade.java
index 5f020b1a..c34317cb 100644
--- a/src/com/android/providers/downloads/SystemFacade.java
+++ b/src/com/android/providers/downloads/SystemFacade.java
@@ -16,11 +16,15 @@
 
 package com.android.providers.downloads;
 
+import android.content.Context;
 import android.content.Intent;
 import android.content.pm.PackageManager.NameNotFoundException;
 import android.net.Network;
 import android.net.NetworkInfo;
 
+import java.security.GeneralSecurityException;
+import javax.net.ssl.SSLContext;
+
 interface SystemFacade {
     /**
      * @see System#currentTimeMillis()
@@ -58,4 +62,10 @@ interface SystemFacade {
      * Returns true if cleartext network traffic is permitted for the specified UID.
      */
     public boolean isCleartextTrafficPermitted(int uid);
+
+    /**
+     * Return a {@link SSLContext} configured using the specified package's configuration.
+     */
+    public SSLContext getSSLContextForPackage(Context context, String pckg)
+            throws GeneralSecurityException;
 }
-- 
cgit v1.2.3