Initial empty repository
Adding KeyChainService and KeyChainActivity

Change-Id: I6c862d3e687cf80fb882966adb3245f2244244fe
Make CertInstaller installed CA certs trusted by applications via default TrustManager (4 of 6)

    frameworks/base

        Adding IKeyChainService APIs for CertInstaller and Settings use
    	keystore/java/android/security/IKeyChainService.aidl

    libcore

        Improve exceptions to include more information
    	luni/src/main/java/javax/security/auth/x500/X500Principal.java

        Move guts of RootKeyStoreSpi to TrustedCertificateStore, leaving only KeyStoreSpi methods.
        Added support for adding user CAs in a separate directory for system.
        Added support for removing system CAs by placing a copy in a sytem directory
    	luni/src/main/java/org/apache/harmony/xnet/provider/jsse/RootKeyStoreSpi.java
    	luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustedCertificateStore.java

        Formerly static methods on RootKeyStoreSpi are now instance methods on TrustedCertificateStore
    	luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java

        Added test for NativeCrypto.X509_NAME_hash_old and X509_NAME_hash
        to make sure the implementing algorithms doe not change since
        TrustedCertificateStore depend on X509_NAME_hash_old (OpenSSL
        changed the algorithm from MD5 to SHA1 when moving from 0.9.8 to
        1.0.0)

    	luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java

        Extensive test of new TrustedCertificateStore behavior
    	luni/src/test/java/org/apache/harmony/xnet/provider/jsse/TrustedCertificateStoreTest.java

        TestKeyStore improvements
        - Refactored TestKeyStore to provide simpler createCA method (and
          internal createCertificate)
        - Cleaned up to remove use of BouncyCastle specific X509Principal
          in the TestKeyStore API when the public X500Principal would do.
        - Cleaned up TestKeyStore support methods to not throw Exception
          to remove need for static blocks for catch clauses in tests.

    	support/src/test/java/libcore/java/security/TestKeyStore.java
    	luni/src/test/java/libcore/java/security/KeyStoreTest.java
    	luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java

        Added private PKIXParameters contructor for use by
        IndexedPKIXParameters to avoid wart of having to lookup and pass
        a TrustAnchor to satisfy the super-class sanity check.

    	luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java
    	luni/src/main/java/org/apache/harmony/xnet/provider/jsse/IndexedPKIXParameters.java
    	luni/src/main/java/java/security/cert/PKIXParameters.java

    packages/apps/CertInstaller

        Change CertInstaller to call IKeyChainService.installCertificate
        for CA certs to pass them to the KeyChainServiceTest which will
        make them available to all apps through the
        TrustedCertificateStore. Change PKCS12 extraction to use AsyncTask.

    	src/com/android/certinstaller/CertInstaller.java

        Added installCaCertsToKeyChain and hasCaCerts accessor for use by
        CertInstaller. Use hasUserCertificate() internally. Cleanup coding
        style.

    	src/com/android/certinstaller/CredentialHelper.java

    packages/apps/KeyChain

        Added MANAGE_ACCOUNTS so that IKeyChainService.reset
        implementation can remove KeyChain accounts.

    	AndroidManifest.xml

        Implement new IKeyChainService methods:
        - Added IKeyChainService.installCaCertificate to install certs
          provided by CertInstaller using the TrustedCertificateStore.
        - Added IKeyChainService.reset to allow Settings to remove the
          KeyChain accounts so that any app granted access to keystore
          credentials are revoked when the keystore is reset.

    	src/com/android/keychain/KeyChainService.java

    packages/apps/Settings

        Changed com.android.credentials.RESET credential reset action to
        also call IKeyChainService.reset to remove any installed user CAs
        and remove KeyChain accounts to have AccountManager revoke
        credential granted to private keys removed during the RESET.

    	src/com/android/settings/CredentialStorage.java

        Added toast text value for failure case

    	res/values/strings.xml

    system/core

        Have init create world readable /data/misc/keychain to allow apps
        to access user added CA certificates installed by the CertInstaller.

    	rootdir/init.rc

Change-Id: I8f1c12751085ebf9b993ebd1c1419d792fd047c8
Simplify KeyChain API by removing now unneeded CA certificate lookup (3 of 3)

frameworks/base

   Remove getCaCertificates and findIssuer from IKeyChainService,
   these are now done via libcore's TrustedCertificateStore (as part
   of the default TrustManager implementation)

	keystore/java/android/security/IKeyChainService.aidl

   Simplify KeyChain API. Now that the CA certificates are visible
   through the default TrustManager, the KeyChain is solely focused on
   retrieving PrivateKeys and their associated certificates. The
   calling API for KeyChain to simply a single KeyChain.get() call
   that returns a KeyChainResult, removing the need for a KeyChain
   instance that needs to be closed.

	keystore/java/android/security/KeyChain.java
	keystore/java/android/security/KeyChainResult.java

master/libcore

    Remove getDefaultIndexedPKIXParameters and
    getIndexedPKIXParameters which was used as part of the prototype
    of looking up CAs via the KeyChain but is obsoleted by the new
    default TrustManager implementation.

	luni/src/main/java/org/apache/harmony/xnet/provider/jsse/SSLParametersImpl.java
	luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java

packages/apps/KeyChain

    Tracking simplified IKeyChainService, removing now unneeded
    implementation, updating tests.

	src/com/android/keychain/KeyChainService.java
	tests/src/com/android/keychain/tests/KeyChainServiceTest.java
	tests/src/com/android/keychain/tests/KeyChainTestActivity.java

Change-Id: Ie2cb950783f897d87d39cc38a126068a9d68680a
Change KeyChainTestActivity to use CertInstaller to install CA

Change-Id: I6851db4131a62cb2de9d8e34193ff81af7bebaaf
Make KeyChainActivity fail on empty as well as null list of certs

Change-Id: Ia5bb70c171989043c83e300376836b85a5fe155b
Remove need for onActivityResult from KeyChain API

Change-Id: I5824c1c2dbb0b39a2b78834167570f1e62ae8697
Defend KeyChainActivity again callback exceptions.

Also remove some unnecessary throws in the KeyChainService

Change-Id: I1779229957a2e700effca33e15cea2e71e73b281
Tracking merge of dalvik-dev to master

Change-Id: Idc318eb8f4ca64ea73aa6732e3d4546e7e631019
Integrating keystore with keyguard (Part 3 of 4)

Summary:

frameworks/base
  keystore rewrite
  keyguard integration with keystore on keyguard entry or keyguard change
  KeyStore API simplification

packages/apps/Settings
  Removed com.android.credentials.SET_PASSWORD intent support
  Added keyguard requirement for keystore use

packages/apps/CertInstaller
  Tracking KeyStore API changes
  Fix for NPE in CertInstaller when certificate lacks basic constraints

packages/apps/KeyChain
  Tracking KeyStore API changes

Details:

frameworks/base

   Move keystore from C to C++ while rewriting password
   implementation. Removed global variables. Added many comments.

	cmds/keystore/Android.mk
	cmds/keystore/keystore.h
	cmds/keystore/keystore.c => cmds/keystore/keystore.cpp
	cmds/keystore/keystore_cli.c => cmds/keystore/keystore_cli.cpp

   Changed saveLockPattern and saveLockPassword to notify the keystore
   on changes so that the keystore master key can be reencrypted when
   the keyguard changes.

	core/java/com/android/internal/widget/LockPatternUtils.java

   Changed unlock screens to pass values for keystore unlock or initialization

	policy/src/com/android/internal/policy/impl/PasswordUnlockScreen.java
	policy/src/com/android/internal/policy/impl/PatternUnlockScreen.java

   KeyStore API changes
   - renamed test() to state(), which now return a State enum
   - made APIs with byte[] key arguments private
   - added new KeyStore.isEmpty used to determine if a keyguard is required

	keystore/java/android/security/KeyStore.java

   In addition to tracking KeyStore API changes, added new testIsEmpty
   and improved some existing tests to validate expect values.

	keystore/tests/src/android/security/KeyStoreTest.java

packages/apps/Settings

    Removing com.android.credentials.SET_PASSWORD intent with the
    removal of the ability to set an explicit keystore password now
    that the keyguard value is used. Changed to ensure keyguard is
    enabled for keystore install or unlock. Cleaned up interwoven
    dialog handing into discrete dialog helper classes.

	AndroidManifest.xml
	src/com/android/settings/CredentialStorage.java

    Remove layout for entering new password

	res/layout/credentials_dialog.xml

    Remove enable credentials checkbox

	res/xml/security_settings_misc.xml
	src/com/android/settings/SecuritySettings.java

    Added ability to specify minimum quality key to ChooseLockGeneric
    Activity. Used by CredentialStorage, but could also be used by
    CryptKeeperSettings. Changed ChooseLockGeneric to understand
    minimum quality for keystore in addition to DPM and device
    encryption.

	src/com/android/settings/ChooseLockGeneric.java

    Changed to use getActivePasswordQuality from
    getKeyguardStoredPasswordQuality based on experience in
    CredentialStorage. Removed bogus class javadoc.

	src/com/android/settings/CryptKeeperSettings.java

    Tracking KeyStore API changes

	src/com/android/settings/vpn/VpnSettings.java
	src/com/android/settings/wifi/WifiSettings.java

   Removing now unused string resources

	res/values-af/strings.xml
	res/values-am/strings.xml
	res/values-ar/strings.xml
	res/values-bg/strings.xml
	res/values-ca/strings.xml
	res/values-cs/strings.xml
	res/values-da/strings.xml
	res/values-de/strings.xml
	res/values-el/strings.xml
	res/values-en-rGB/strings.xml
	res/values-es-rUS/strings.xml
	res/values-es/strings.xml
	res/values-fa/strings.xml
	res/values-fi/strings.xml
	res/values-fr/strings.xml
	res/values-hr/strings.xml
	res/values-hu/strings.xml
	res/values-in/strings.xml
	res/values-it/strings.xml
	res/values-iw/strings.xml
	res/values-ja/strings.xml
	res/values-ko/strings.xml
	res/values-lt/strings.xml
	res/values-lv/strings.xml
	res/values-ms/strings.xml
	res/values-nb/strings.xml
	res/values-nl/strings.xml
	res/values-pl/strings.xml
	res/values-pt-rPT/strings.xml
	res/values-pt/strings.xml
	res/values-rm/strings.xml
	res/values-ro/strings.xml
	res/values-ru/strings.xml
	res/values-sk/strings.xml
	res/values-sl/strings.xml
	res/values-sr/strings.xml
	res/values-sv/strings.xml
	res/values-sw/strings.xml
	res/values-th/strings.xml
	res/values-tl/strings.xml
	res/values-tr/strings.xml
	res/values-uk/strings.xml
	res/values-vi/strings.xml
	res/values-zh-rCN/strings.xml
	res/values-zh-rTW/strings.xml
	res/values-zu/strings.xml
	res/values/strings.xml

packages/apps/CertInstaller

  Tracking KeyStore API changes
	src/com/android/certinstaller/CertInstaller.java

  Fix for NPE in CertInstaller when certificate lacks basic constraints
	src/com/android/certinstaller/CredentialHelper.java

packages/apps/KeyChain

  Tracking KeyStore API changes
	src/com/android/keychain/KeyChainActivity.java
	src/com/android/keychain/KeyChainService.java
	support/src/com/android/keychain/tests/support/IKeyChainServiceTestSupport.aidl
	support/src/com/android/keychain/tests/support/KeyChainServiceTestSupport.java
	tests/src/com/android/keychain/tests/KeyChainServiceTest.java

Change-Id: Id7250fdb29c8a6d52d599c39a869ab22b1cc53da
Skip KeyStore unlock in chooser if it is empty

Change-Id: Ic909a93b68e4791bcdf5fd40a946c9072bbef9d0
Make KeyChainActivity.onBackPressed return null response

Also add some negative permissions tests to KeyChainServiceTest

Change-Id: I17d8c5e624db71b45f70c7c46ed49b8571ce323b
Change KeyChain tests to use PEM format in keystore to match CertInstaller

Change-Id: I2900526376dafca2dabc9beec300e80add2a14a3
Throw IllegalStateException when authtoken has not been generated

Change-Id: I408fe3032d6a4d2244c3d5d590b96ef74f9c9b4e
Use external/mockwebserver in packages/apps/KeyChain

Change-Id: I29ba8ca992560be254e1fa3fa35739c39e99cd79
Tracking KeyChain API refinements

Change-Id: Ib19f16bd7c9e9790e1183d3d2a9a84789661d7cf
Replace KeyChainActivity placeholder UI with more polished dialog (5 of 5)

frameworks/base

    Extended KeyChain.chooserPrivateKeyAlias to allow caller to supply
    preferred choice to be selected in chooser. This allows Email
    settings to highlight the current choice when allowing user to
    change settings.
	keystore/java/android/security/KeyChain.java
	api/current.txt

    Implemented KeyChain functionality to pass host and port
    information to KeyChainActivity for display.
	keystore/java/android/security/KeyChain.java

    KeyChain now sends a PendingIntent as part of the Intent it sends
    to the KeyChainActivity which can be used to identify the caller
    in reliable way.
	keystore/java/android/security/KeyChain.java

    Moved .pfx/.p12/.cer/.crt constants to Credentials for reuse.
    Added Credentials.install variant with no value for use from KeyChainActivity
	keystore/java/android/security/Credentials.java

packages/apps/CertInstaller
    Source of extension constants now in Credentials
	src/com/android/certinstaller/CertFile.java

packages/apps/Browser
    Have browser supply host and port information to KeyChain.choosePrivateKeyAlias
    Tracking KeyChain.choosePrivateKeyAlias API change
	src/com/android/browser/Tab.java

packages/apps/Email
    Tracking KeyChain.choosePrivateKeyAlias API change
	src/com/android/email/view/CertificateSelector.java

packages/apps/KeyChain

    KeyChain now depends on bouncycastle X509Name for formatting
    X500Principals, since the 4 X500Principal formatting options could
    not format emailAddress attributes in a human readable way and its
    the most important attribute to display for client certificates in
    most cases.
	Android.mk

    Changing the UI to a dialog, make the activity style transparent.
	AndroidManifest.xml
	res/values/styles.xml

    Layout for chooser dialog
	res/layout/cert_chooser.xml

    Layout for list items in chooser
	res/layout/cert_item.xml

    New resources for dialog including comments for translators.
	res/values/strings.xml

    New dialog based KeyChainActivity. Now also shows requesting app
    and requesting server. Now can preselect a specified alias. New
    link directly to CertInstaller.

	src/com/android/keychain/KeyChainActivity.java

    Fix KeyChainTestActivity to work with TestKeyStore changes that
    were causing network activity on the UI to look up the name of
    localhost. Also track KeyChain.choosePrivateKeyAlias API change.

	tests/src/com/android/keychain/tests/KeyChainTestActivity.java

Change-Id: I6923e5bf77041500a8ebb44a7972f5d01d297263
Use cancel instead deny when only one button

Change-Id: I2b77a343508d6e38a3d25ebc0c24d1df5da2f5d5
Add KeyChainService.deleteCaCertificate
Allow system to call KeyChainService.installCaCertificate

Change-Id: Idd3d97d7972f066368079f6b996cf2bc658cca4f
Add missing application label for KeyChain
The resource already existed, it just was not referenced in the manifest

Change-Id: I7c54859047f1abb44fbc80375a5e21e1fcb297c9