3 files changed, 38 insertions, 21 deletions

diff --git a/app/src/main/java/org/pacien/tincapp/context/AppPaths.kt b/app/src/main/java/org/pacien/tincapp/context/AppPaths.kt
index 1efb7cf..2394586 100644
--- a/app/src/main/java/org/pacien/tincapp/context/AppPaths.kt
+++ b/app/src/main/java/org/pacien/tincapp/context/AppPaths.kt
@@ -1,6 +1,6 @@
 /*
  * Tinc App, an Android binding and user interface for the tinc mesh VPN daemon
- * Copyright (C) 2017-2018 Pacien TRAN-GIRARD
+ * Copyright (C) 2017-2020 Pacien TRAN-GIRARD
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -25,7 +25,7 @@ import java.io.FileNotFoundException
 /**
  * @author pacien
  *
- * @implNote Logs and PID files are stored in the cache directory for easy clean up.
+ * @implNote Logs and PID files are stored in the cache directory for automatic collection.
  */
 object AppPaths {
   private const val TINCD_BIN = "libtincd.so"
@@ -40,15 +40,16 @@ object AppPaths {
   private const val NET_TINC_CONF_FILE = "tinc.conf"
   private const val NET_HOSTS_DIR = "hosts"
   private const val NET_INVITATION_FILE = "invitation-data"
-  private const val NET_DEFAULT_ED25519_PRIVATE_KEY_FILE = "ed25519_key.priv"
-  private const val NET_DEFAULT_RSA_PRIVATE_KEY_FILE = "rsa_key.priv"
+
+  const val NET_DEFAULT_ED25519_PRIVATE_KEY_FILE = "ed25519_key.priv"
+  const val NET_DEFAULT_RSA_PRIVATE_KEY_FILE = "rsa_key.priv"
 
   private val context by lazy { App.getContext() }
 
   fun storageAvailable() =
     Environment.getExternalStorageState().let { it == Environment.MEDIA_MOUNTED && it != Environment.MEDIA_MOUNTED_READ_ONLY }
 
-  private fun internalCacheDir() = context.cacheDir!!
+  fun internalCacheDir() = context.cacheDir!!
   fun cacheDir() = context.externalCacheDir!!
   fun confDir() = context.getExternalFilesDir(null)!!
   private fun binDir() = File(context.applicationInfo.nativeLibraryDir)
diff --git a/app/src/main/java/org/pacien/tincapp/service/TincVpnService.kt b/app/src/main/java/org/pacien/tincapp/service/TincVpnService.kt
index 48cb1df..c688742 100644
--- a/app/src/main/java/org/pacien/tincapp/service/TincVpnService.kt
+++ b/app/src/main/java/org/pacien/tincapp/service/TincVpnService.kt
@@ -102,12 +102,17 @@ class TincVpnService : VpnService() {
     log.info("Starting tinc daemon for network \"$netName\".")
     if (isConnected() || getCurrentNetName() != null) stopVpn().join()
 
-    // FIXME: pass decrypted private keys via temp file
     val privateKeys = try {
       TincConfiguration.fromTincConfiguration(AppPaths.existing(AppPaths.tincConfFile(netName))).let { tincCfg ->
         Pair(
-          TincKeyring.openPrivateKey(tincCfg.ed25519PrivateKeyFile ?: AppPaths.defaultEd25519PrivateKeyFile(netName), passphrase),
-          TincKeyring.openPrivateKey(tincCfg.privateKeyFile ?: AppPaths.defaultRsaPrivateKeyFile(netName), passphrase))
+          TincKeyring.unlockKey(
+            AppPaths.NET_DEFAULT_ED25519_PRIVATE_KEY_FILE,
+            tincCfg.ed25519PrivateKeyFile ?: AppPaths.defaultEd25519PrivateKeyFile(netName),
+            passphrase),
+          TincKeyring.unlockKey(
+            AppPaths.NET_DEFAULT_RSA_PRIVATE_KEY_FILE,
+            tincCfg.privateKeyFile ?: AppPaths.defaultRsaPrivateKeyFile(netName),
+            passphrase))
       }
     } catch (e: FileNotFoundException) {
       Pair(null, null)
@@ -143,15 +148,12 @@ class TincVpnService : VpnService() {
     val serverSocket = LocalServerSocket(DEVICE_FD_ABSTRACT_SOCKET)
     Executor.runAsyncTask { serveDeviceFd(serverSocket, deviceFd) }
 
-    // FIXME: pass decrypted private keys via temp file
-    val daemon = Tincd.start(netName, DEVICE_FD_ABSTRACT_SOCKET, null, null)
+    val daemon = Tincd.start(netName, DEVICE_FD_ABSTRACT_SOCKET, privateKeys.first, privateKeys.second)
     setState(netName, passphrase, interfaceCfg, deviceFd, daemon)
 
     waitForDaemonStartup().whenComplete { _, exception ->
       serverSocket.close()
       deviceFd.close()
-      privateKeys.first?.close()
-      privateKeys.second?.close()
 
       if (exception != null) {
         reportError(resources.getString(R.string.notification_error_message_daemon_exited, exception.cause!!.defaultMessage()), exception)
diff --git a/app/src/main/java/org/pacien/tincapp/utils/TincKeyring.kt b/app/src/main/java/org/pacien/tincapp/utils/TincKeyring.kt
index bae38ac..89bb246 100644
--- a/app/src/main/java/org/pacien/tincapp/utils/TincKeyring.kt
+++ b/app/src/main/java/org/pacien/tincapp/utils/TincKeyring.kt
@@ -1,6 +1,6 @@
 /*
  * Tinc App, an Android binding and user interface for the tinc mesh VPN daemon
- * Copyright (C) 2017-2018 Pacien TRAN-GIRARD
+ * Copyright (C) 2017-2020 Pacien TRAN-GIRARD
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -18,10 +18,11 @@
 
 package org.pacien.tincapp.utils
 
-import android.os.ParcelFileDescriptor
 import org.pacien.tincapp.commands.TincApp
+import org.pacien.tincapp.context.AppPaths
 import java.io.File
 import java.io.FileNotFoundException
+import java.io.FileWriter
 
 /**
  * @author pacien
@@ -33,12 +34,25 @@ object TincKeyring {
     false
   }
 
-  fun openPrivateKey(f: File?, passphrase: String?): ParcelFileDescriptor? {
-    if (f == null || !f.exists() || passphrase == null) return null
-    val pipe = ParcelFileDescriptor.createPipe()
-    val decryptedKey = PemUtils.decrypt(PemUtils.read(f), passphrase)
-    val outputStream = ParcelFileDescriptor.AutoCloseOutputStream(pipe[1])
-    PemUtils.write(decryptedKey, outputStream.writer())
-    return pipe[0]
+  fun unlockKey(target: String, input: File?, passphrase: String?): File? {
+    if (input == null || !input.exists() || passphrase == null) return null
+    val decryptedKey = PemUtils.decrypt(PemUtils.read(input), passphrase)
+    val decryptedFile = tempKey(target)
+    PemUtils.write(decryptedKey, FileWriter(decryptedFile, false))
+    return decryptedFile
+  }
+
+  private fun tempKey(name: String): File {
+    val file = File(AppPaths.internalCacheDir(), name)
+    file.createNewFile()
+    file.deleteOnExit()
+    file.makePrivate()
+    return file
+  }
+
+  private fun File.makePrivate() {
+    this.setExecutable(false, false)
+    this.setReadable(true, true)
+    this.setWritable(true, true)
   }
 }