Merge branch 'main' into graalvm-support

awslabs · Feb 12, 2024 · 5153e02 · 5153e02
2 parents c720d1b + 7126375
commit 5153e02
Show file tree

Hide file tree

Showing 16 changed files with 289 additions and 157 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
       - 'docs'
 
 env:
-  BUILDER_VERSION: v0.9.46
+  BUILDER_VERSION: v0.9.54
   BUILDER_SOURCE: releases
   BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net
   PACKAGE_NAME: aws-crt-java

diff --git a/...crt/src/main/java/software/amazon/awssdk/crt/io/TlsAndroidPrivateKeyOperationHandler.java b/...crt/src/main/java/software/amazon/awssdk/crt/io/TlsAndroidPrivateKeyOperationHandler.java
@@ -0,0 +1,105 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+package software.amazon.awssdk.crt.io;
+
+import java.security.PrivateKey;
+import java.security.Signature;
+import java.io.ByteArrayOutputStream;
+
+/*
+ * TlsKeyOperationHandler implementation for using an Android PrivateKey on TlsKeyOperations
+ */
+public class TlsAndroidPrivateKeyOperationHandler implements TlsKeyOperationHandler {
+    private PrivateKey privateKey;
+
+    /*
+    * DER encoded DigestInfo value to be prefixed to the hash, used for RSA signing
+    * See https://tools.ietf.org/html/rfc3447#page-43
+    */
+    static byte[] sha1PrefixToRsaSig = { (byte)0x30, (byte)0x21, (byte)0x30, (byte)0x09, (byte)0x06, (byte)0x05, (byte)0x2b, (byte)0x0e, (byte)0x03, (byte)0x02, (byte)0x1a, (byte)0x05, (byte)0x00, (byte)0x04, (byte)0x14 };
+    static byte[] sha224PrefixToRsaSig = { (byte)0x30, (byte)0x2d, (byte)0x30, (byte)0x0d, (byte)0x06, (byte)0x09, (byte)0x60, (byte)0x86, (byte)0x48, (byte)0x01, (byte)0x65, (byte)0x03, (byte)0x04, (byte)0x02, (byte)0x04, (byte)0x05, (byte)0x00, (byte)0x04, (byte)0x1c };
+    static byte[] sha256PrefixToRsaSig = { (byte)0x30, (byte)0x31, (byte)0x30, (byte)0x0d, (byte)0x06, (byte)0x09, (byte)0x60, (byte)0x86, (byte)0x48, (byte)0x01, (byte)0x65, (byte)0x03, (byte)0x04, (byte)0x02, (byte)0x01, (byte)0x05, (byte)0x00, (byte)0x04, (byte)0x20 };
+    static byte[] sha384PrefixToRsaSig = { (byte)0x30, (byte)0x41, (byte)0x30, (byte)0x0d, (byte)0x06, (byte)0x09, (byte)0x60, (byte)0x86, (byte)0x48, (byte)0x01, (byte)0x65, (byte)0x03, (byte)0x04, (byte)0x02, (byte)0x02, (byte)0x05, (byte)0x00, (byte)0x04, (byte)0x30 };
+    static byte[] sha512PrefixToRsaSig = { (byte)0x30, (byte)0x51, (byte)0x30, (byte)0x0d, (byte)0x06, (byte)0x09, (byte)0x60, (byte)0x86, (byte)0x48, (byte)0x01, (byte)0x65, (byte)0x03, (byte)0x04, (byte)0x02, (byte)0x03, (byte)0x05, (byte)0x00, (byte)0x04, (byte)0x40 };
+
+    public TlsAndroidPrivateKeyOperationHandler(PrivateKey privateKey) {
+        this.privateKey = privateKey;
+    }
+
+    public void performOperation(TlsKeyOperation operation){
+        try{
+            if (operation.getType() != TlsKeyOperation.Type.SIGN) {
+                operation.completeExceptionally(new Throwable("Android KeyChain PrivateKey only handles SIGN operations."));
+                return;
+            }
+
+            // A SIGN operation's inputData is the 32bytes of the SHA-256 digest.
+            // Before doing the RSA signature, we need to construct a PKCS1 v1.5 DigestInfo.
+            // See https://datatracker.ietf.org/doc/html/rfc3447#section-9.2
+            byte[] dataToSign = operation.getInput();
+
+            Signature signature = Signature.getInstance("NONEwith" + operation.getSignatureAlgorithm().name());;
+
+            switch(operation.getSignatureAlgorithm()){
+                case RSA:
+                    /*
+                     * DER encoded DigestInfo value to be prefixed to the hash, used for RSA signing
+                     * See https://tools.ietf.org/html/rfc3447#page-43
+                     */
+                    byte[] digestAlgorithm;
+                    switch(operation.getDigestAlgorithm()){
+                        case SHA1:
+                            digestAlgorithm = sha1PrefixToRsaSig;
+                        break;
+                        case SHA224:
+                            digestAlgorithm = sha224PrefixToRsaSig;
+                        break;
+                        case SHA256:
+                            digestAlgorithm = sha256PrefixToRsaSig;
+                        break;
+                        case SHA384:
+                            digestAlgorithm = sha384PrefixToRsaSig;
+                        break;
+                        case SHA512:
+                            digestAlgorithm = sha512PrefixToRsaSig;
+                        break;
+                        case UNKNOWN:
+                        default:
+                            operation.completeExceptionally(new Throwable("An UNKNOWN digest algorithm was encountered during a SIGN operation against an Android KeyChain PrivateKey."));
+                            return;
+                    }
+
+                    ByteArrayOutputStream digestInfoStream = new ByteArrayOutputStream();
+                    digestInfoStream.write(digestAlgorithm);
+                    digestInfoStream.write(dataToSign);
+                    byte[] digestInfo = digestInfoStream.toByteArray();
+
+                    signature.initSign(privateKey);
+                    signature.update(digestInfo);
+                    byte[] signatureBytesRSA = signature.sign();
+
+                    operation.complete(signatureBytesRSA);
+                    return;
+
+                case ECDSA:
+
+                    signature.initSign(privateKey);
+                    signature.update(dataToSign);
+                    byte[] signatureBytesECC = signature.sign();
+
+                    operation.complete(signatureBytesECC);
+                    return;
+
+                case UNKNOWN:
+                default:
+
+                    operation.completeExceptionally(new Throwable("An UNKNOWN signature algorithm was encountered during a SIGN operation against an Android KeyChain PrivateKey."));
+                    return;
+            }
+        } catch (Exception ex){
+            operation.completeExceptionally(new Throwable("Exception caught during Android KeyChain PrivateKey operation.", ex));
+        }
+    }
+}
diff --git a/crt/aws-c-auth b/crt/aws-c-auth
diff --git a/crt/aws-c-io b/crt/aws-c-io
diff --git a/crt/s2n b/crt/s2n
diff --git a/src/main/java/software/amazon/awssdk/crt/Log.java b/src/main/java/software/amazon/awssdk/crt/Log.java
@@ -103,7 +103,8 @@ public enum LogSubject {
         // aws-crt-java, we're authoritative
         JavaCrtGeneral(0x2400),
         JavaCrtResource(0x2401),
-        JavaCrtS3(0x2402)
+        JavaCrtS3(0x2402),
+        JavaAndroidKeychain(0x2403)
         ;
 
         LogSubject(int value) {

diff --git a/src/main/java/software/amazon/awssdk/crt/io/TlsContextCustomKeyOperationOptions.java b/src/main/java/software/amazon/awssdk/crt/io/TlsContextCustomKeyOperationOptions.java
@@ -51,7 +51,7 @@ public TlsContextCustomKeyOperationOptions withCertificateFileContents(String co
     }
 
     /**
-     * Returns the path to the X.509 certificate file on desk if it has been set.
+     * Returns the path to the X.509 certificate file on disk if it has been set.
      *
      * @return The path to the certificate file
      */

diff --git a/src/main/java/software/amazon/awssdk/crt/mqtt/MqttClientConnection.java b/src/main/java/software/amazon/awssdk/crt/mqtt/MqttClientConnection.java
@@ -226,17 +226,6 @@ private void onConnectionComplete(int errorCode, boolean sessionPresent) {
             }
             connectAck = null;
         }
-
-        MqttClientConnectionEvents callbacks = config.getConnectionCallbacks();
-        if (callbacks != null) {
-            if (errorCode == 0) {
-                OnConnectionSuccessReturn returnData = new OnConnectionSuccessReturn(sessionPresent);
-                callbacks.onConnectionSuccess(returnData);
-            } else {
-                OnConnectionFailureReturn returnData = new OnConnectionFailureReturn(errorCode);
-                callbacks.onConnectionFailure(returnData);
-            }
-        }
     }
 
     // Called when the connection drops or is disconnected. If errorCode == 0, the

diff --git a/src/native/crt.c b/src/native/crt.c
@@ -484,6 +484,8 @@ static struct aws_log_subject_info s_crt_log_subject_infos[] = {
         AWS_LS_JAVA_CRT_RESOURCE, "JavaCrtResource", "Subject for CrtResource"),
     DEFINE_LOG_SUBJECT_INFO(
         AWS_LS_JAVA_CRT_S3, "JavaCrtS3", "Subject for the layer binding aws-c-s3 to Java"),
+    DEFINE_LOG_SUBJECT_INFO(
+        AWS_LS_JAVA_ANDROID_KEYCHAIN, "android-keychain", "Subject for Android KeyChain"),
     /* clang-format on */
 };
 

diff --git a/src/native/crt.h b/src/native/crt.h
@@ -19,6 +19,7 @@ enum aws_java_crt_log_subject {
     AWS_LS_JAVA_CRT_GENERAL = AWS_LOG_SUBJECT_BEGIN_RANGE(AWS_CRT_JAVA_PACKAGE_ID),
     AWS_LS_JAVA_CRT_RESOURCE,
     AWS_LS_JAVA_CRT_S3,
+    AWS_LS_JAVA_ANDROID_KEYCHAIN,
 
     AWS_LS_JAVA_CRT_LAST = AWS_LOG_SUBJECT_END_RANGE(AWS_CRT_JAVA_PACKAGE_ID),
 };