Implement Constellation and Asterism + DroidGuard fixes for RCS support - #3784
Open
naormeit wants to merge 62 commits into
Open
Implement Constellation and Asterism + DroidGuard fixes for RCS support#3784naormeit wants to merge 62 commits into
naormeit wants to merge 62 commits into
Conversation
InstanceID failures could be suppressed into an empty string. The empty credential was then exposed as a successful getIidToken response, signed, and included in a GetVerifiedPhoneNumbers request. Propagate InstanceID failures to the existing error handlers and reject empty credentials before reading the FID, signing, building IIDTokenAuth, or executing GPNV. Regression tests cover exceptions, empty credentials, and the valid request path. PR microg#3388 handles IID failures in a different Constellation implementation. This change applies equivalent error semantics plus explicit empty-token and GPNV guards to the microg#3359 architecture.
A regenerated EC key was allowed to inherit the previous key's server acknowledgement. Validate stored key material before reading that state, and reset it atomically whenever key material is generated. Add instrumentation coverage for corrupt and valid stored key pairs.
Align DG cache naming and VM keys with stock GMS, preserve partial init replies, and fall back to phone number hints during Constellation provisioning.
Introduce shared phone-number and VM cache utilities, wire them into Constellation and DroidGuard, and add offline JUnit coverage for provisioning and tachyon-related logic.
…ctory hasAccount in NetworkHandleProxyFactory.createRequest() was hardcoded to false. This reads the value dynamically from AccountManager for 'com.google' accounts, incorporating a SecurityException fallback to false.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR implements the GMS services required for RCS provisioning, addressing issue #2994 where Google Messages displays "RCS chats aren't available for this device" or hangs on "Setting up...". Previously, Constellation (GmsService 155, phone number verification) and Asterism (GmsService 199, RCS ToS/consent) were bound to DummyService. This also resolves DroidGuard tachyon_registration token rejections caused by cache path discrepancies visible to DG via /proc/self/maps.
Fixes #2994.
Contributors & Changes:
@opstic: Implemented Constellation and Asterism from scratch (Implement
play-services-constellation#3359, Implementplay-services-asterism#3360), including AIDL interfaces, proto definitions, gRPC clients, all verification paths (UPI/OTP, MO-SMS, MT-SMS, TS.43 EAP-AKA), and Phenotype flags for Messages/IMS.@br413: Provided DroidGuard tachyon parity fixes (RCS: DroidGuard tachyon fixes, phone-number fallback, and unit tests (#2994) #3644):
getDir("cache_dg")toapp_dg_cache/(wasapp_cache_dg/).DroidGuardInitReply.createFromParcel()null handling to preserveDroidGuardResultsRequestwhen PFD is null.@camilo-12ch: Fixed the IID empty token issue. getIidToken() no longer returns "" on failure, preventing empty credentials from reaching Google's GPNV endpoint.
@paulcakeface: Fixed the public-key ack ordering bug. The EC key is now validated/regenerated before isPublicKeyAcked() is read, preventing a corrupt stored key from producing a ClientAuth header for an unacknowledged key. Includes regression test.
@nwinkelman2: Integrated and repaired the branches. Fixed all 11 Android lint errors, fixed the instrumentation manifest, removed the unsubstantiated custom DG classloader experiment, and fixed a false JVM Parcel round-trip assertion in tests, achieving a CI-green branch for Debug and Release.
Author (This PR): Implemented hasAccount correctness fix in NetworkHandleProxyFactory.createRequest(). Replaced hardcoded hasAccount = false with dynamic reading from AccountManager for com.google accounts (with SecurityException fallback to false). This prevents incorrect DroidGuard VM execution flows on devices with registered Google accounts.
Out of Scope / Not Claimed:
Locked-bootloader E2E hardware test (requires a microG ROM and real SIM).
TS.43 carrier testing (no SIM available).
X-Goog-Spatula header on Constellation gRPC (architecturally blocked; play-services-constellation-core cannot depend on play-services-core without creating a circular dependency).
Testing:
Lint (all three modules): 0 errors — BUILD SUCCESSFUL locally.
Unit tests: Gradle 8.13/AGP configuration incompatibility locally; CI green on base branch (nwinkelman2/integration/rcs-current-upstream).
Hardware E2E: Pending (no microG ROM available).