在 Robolectric 测试中使用 Android KeyStore

Question

我正在尝试编写一些针对 Android 密钥库 的测试用例。但是，当我编写以下测试用例时：

@RunWith(RobolectricGradleTestRunner.class)
@Config(constants = BuildConfig.class, sdk = 21)
public class FancyPantsUnitTest {
   @Test
   public void buildKey() {
        keyPairGenerator = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore");
        keyPairGenerator.initialize(4096);
        final KeyPair keyPair = keyPairGenerator.generateKeyPair();
   }
}

这会失败，但有以下例外：

org.junit.ComparisonFailure: expected:<null> but was:<java.security.KeyStoreException: AndroidKeyStore not found>

我的目标是 API 级别 23（如果有帮助的话）。

Answer 1

Matthew Dolan 在他的文章中提出了一个出色的解决方案。

以下是创建 FakeAndroidKeyStore 的代码，

import java.io.InputStream
import java.io.OutputStream
import java.security.Key
import java.security.KeyStore
import java.security.KeyStoreSpi
import java.security.Provider
import java.security.SecureRandom
import java.security.Security
import java.security.cert.Certificate
import java.security.spec.AlgorithmParameterSpec
import java.util.Date
import java.util.Enumeration
import javax.crypto.KeyGenerator
import javax.crypto.KeyGeneratorSpi
import javax.crypto.SecretKey

object FakeAndroidKeyStore {

    val setup by lazy {
        Security.addProvider(object : Provider("AndroidKeyStore", 1.0, "") {
            init {
                put("KeyStore.AndroidKeyStore", FakeKeyStore::class.java.name)
                put("KeyGenerator.AES", FakeAesKeyGenerator::class.java.name)
            }
        })
    }

    @Suppress("unused")
    class FakeKeyStore : KeyStoreSpi() {
        private val wrapped = KeyStore.getInstance(KeyStore.getDefaultType())

        override fun engineIsKeyEntry(alias: String?): Boolean = wrapped.isKeyEntry(alias)
        override fun engineIsCertificateEntry(alias: String?): Boolean = wrapped.isCertificateEntry(alias)
        override fun engineGetCertificate(alias: String?): Certificate = wrapped.getCertificate(alias)
        override fun engineGetCreationDate(alias: String?): Date = wrapped.getCreationDate(alias)
        override fun engineDeleteEntry(alias: String?) = wrapped.deleteEntry(alias)
        override fun engineSetKeyEntry(alias: String?, key: Key?, password: CharArray?, chain: Array<out Certificate>?) =
            wrapped.setKeyEntry(alias, key, password, chain)

        override fun engineSetKeyEntry(alias: String?, key: ByteArray?, chain: Array<out Certificate>?) = wrapped.setKeyEntry(alias, key, chain)
        override fun engineStore(stream: OutputStream?, password: CharArray?) = wrapped.store(stream, password)
        override fun engineSize(): Int = wrapped.size()
        override fun engineAliases(): Enumeration<String> = wrapped.aliases()
        override fun engineContainsAlias(alias: String?): Boolean = wrapped.containsAlias(alias)
        override fun engineLoad(stream: InputStream?, password: CharArray?) = wrapped.load(stream, password)
        override fun engineGetCertificateChain(alias: String?): Array<Certificate> = wrapped.getCertificateChain(alias)
        override fun engineSetCertificateEntry(alias: String?, cert: Certificate?) = wrapped.setCertificateEntry(alias, cert)
        override fun engineGetCertificateAlias(cert: Certificate?): String = wrapped.getCertificateAlias(cert)
        override fun engineGetKey(alias: String?, password: CharArray?): Key = wrapped.getKey(alias, password)
    }

    @Suppress("unused")
    class FakeAesKeyGenerator : KeyGeneratorSpi() {
        private val wrapped = KeyGenerator.getInstance("AES")

        override fun engineInit(random: SecureRandom?) = Unit
        override fun engineInit(params: AlgorithmParameterSpec?, random: SecureRandom?) = Unit
        override fun engineInit(keysize: Int, random: SecureRandom?) = Unit
        override fun engineGenerateKey(): SecretKey = wrapped.generateKey()
    }
}

在调用 java.security.KeyStore 之前使用。

在示例中：

@Before
fun setup() {
  FakeAndroidKeyStore.setup
  KeyStore.getInstance(...)
  ...
}

Answer 2

https://github.com/robolectric/robolectric/issues/1518 已经对此进行了讨论。

简而言之：

来自 java.security.Security javadoc：

<块引用>

安全属性的默认值是从
特定于实现的位置，通常是属性
Java 安装目录中的 lib/security/java.security 文件。

...我们可能不想鼓励人们胡闹。

看起来这需要一个方法拦截规则...

尝试 PowerMockito 时也会发生同样的情况。

Answer 3

您可以模拟 KeyStore 及其行为。这是一个代码示例

@RunWith(RobolectricTestRunner.class)
@Config(sdk = 30)

public class FancyPantsUnitTest {

@Mock
KeyStore mockKeyStore;

@Mock
KeyPairGenerator mockKeyPairGenerator;

@Before
public void setup() {
    MockitoAnnotations.initMocks(this);
    MockedStatic<KeyStore> mockedKeyStore = mockStatic(KeyStore.class);
    mockedKeyStore.when(() -> KeyStore.getInstance("AndroidKeyStore"))
            .thenReturn(mockKeyStore);

    MockedStatic<KeyPairGenerator> mockedKeyPairGen = mockStatic(KeyPairGenerator.class);
    mockedKeyPairGen.when(() -> KeyPairGenerator.getInstance("RSA", "AndroidKeyStore"))
            .thenReturn(mockKeyPairGenerator);
}

@Test
public void testBuildKey() throws Exception {
    when(mockKeyPairGenerator.generateKeyPair()).thenReturn(new KeyPair(...));
    KeyPair keyPair = mockKeyPairGenerator.generateKeyPair();
}
}