1 /*
2  **
3  ** Copyright 2018, The Android Open Source Project
4  **
5  ** Licensed under the Apache License, Version 2.0 (the "License");
6  ** you may not use this file except in compliance with the License.
7  ** You may obtain a copy of the License at
8  **
9  **     http://www.apache.org/licenses/LICENSE-2.0
10  **
11  ** Unless required by applicable law or agreed to in writing, software
12  ** distributed under the License is distributed on an "AS IS" BASIS,
13  ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  ** See the License for the specific language governing permissions and
15  ** limitations under the License.
16  */
17 
18 #define LOG_TAG "android.hardware.keymaster@3.0-impl.trusty"
19 
20 #include <authorization_set.h>
21 #include <cutils/log.h>
22 #include <keymaster/android_keymaster_messages.h>
23 #include <trusty_keymaster/TrustyKeymaster3Device.h>
24 #include <trusty_keymaster/ipc/trusty_keymaster_ipc.h>
25 
26 using ::keymaster::AbortOperationRequest;
27 using ::keymaster::AbortOperationResponse;
28 using ::keymaster::AddEntropyRequest;
29 using ::keymaster::AddEntropyResponse;
30 using ::keymaster::AttestKeyRequest;
31 using ::keymaster::AttestKeyResponse;
32 using ::keymaster::AuthorizationSet;
33 using ::keymaster::BeginOperationRequest;
34 using ::keymaster::BeginOperationResponse;
35 using ::keymaster::ExportKeyRequest;
36 using ::keymaster::ExportKeyResponse;
37 using ::keymaster::FinishOperationRequest;
38 using ::keymaster::FinishOperationResponse;
39 using ::keymaster::GenerateKeyRequest;
40 using ::keymaster::GenerateKeyResponse;
41 using ::keymaster::GetKeyCharacteristicsRequest;
42 using ::keymaster::GetKeyCharacteristicsResponse;
43 using ::keymaster::ImportKeyRequest;
44 using ::keymaster::ImportKeyResponse;
45 using ::keymaster::UpdateOperationRequest;
46 using ::keymaster::UpdateOperationResponse;
47 using ::keymaster::ng::Tag;
48 
49 namespace keymaster {
50 
51 namespace {
52 
legacy_enum_conversion(const Tag value)53 inline keymaster_tag_t legacy_enum_conversion(const Tag value) {
54     return keymaster_tag_t(value);
55 }
legacy_enum_conversion(const keymaster_tag_t value)56 inline Tag legacy_enum_conversion(const keymaster_tag_t value) {
57     return Tag(value);
58 }
legacy_enum_conversion(const KeyPurpose value)59 inline keymaster_purpose_t legacy_enum_conversion(const KeyPurpose value) {
60     return keymaster_purpose_t(value);
61 }
legacy_enum_conversion(const KeyFormat value)62 inline keymaster_key_format_t legacy_enum_conversion(const KeyFormat value) {
63     return keymaster_key_format_t(value);
64 }
legacy_enum_conversion(const keymaster_error_t value)65 inline ErrorCode legacy_enum_conversion(const keymaster_error_t value) {
66     return ErrorCode(value);
67 }
68 
typeFromTag(const keymaster_tag_t tag)69 inline keymaster_tag_type_t typeFromTag(const keymaster_tag_t tag) {
70     return keymaster_tag_get_type(tag);
71 }
72 
73 class KmParamSet : public keymaster_key_param_set_t {
74   public:
KmParamSet(const hidl_vec<KeyParameter> & keyParams)75     KmParamSet(const hidl_vec<KeyParameter>& keyParams) {
76         params = new keymaster_key_param_t[keyParams.size()];
77         length = keyParams.size();
78         for (size_t i = 0; i < keyParams.size(); ++i) {
79             auto tag = legacy_enum_conversion(keyParams[i].tag);
80             switch (typeFromTag(tag)) {
81                 case KM_ENUM:
82                 case KM_ENUM_REP:
83                     params[i] = keymaster_param_enum(tag, keyParams[i].f.integer);
84                     break;
85                 case KM_UINT:
86                 case KM_UINT_REP:
87                     params[i] = keymaster_param_int(tag, keyParams[i].f.integer);
88                     break;
89                 case KM_ULONG:
90                 case KM_ULONG_REP:
91                     params[i] = keymaster_param_long(tag, keyParams[i].f.longInteger);
92                     break;
93                 case KM_DATE:
94                     params[i] = keymaster_param_date(tag, keyParams[i].f.dateTime);
95                     break;
96                 case KM_BOOL:
97                     if (keyParams[i].f.boolValue)
98                         params[i] = keymaster_param_bool(tag);
99                     else
100                         params[i].tag = KM_TAG_INVALID;
101                     break;
102                 case KM_BIGNUM:
103                 case KM_BYTES:
104                     params[i] = keymaster_param_blob(tag, &keyParams[i].blob[0],
105                                                      keyParams[i].blob.size());
106                     break;
107                 case KM_INVALID:
108                 default:
109                     params[i].tag = KM_TAG_INVALID;
110                     /* just skip */
111                     break;
112             }
113         }
114     }
KmParamSet(KmParamSet && other)115     KmParamSet(KmParamSet&& other) noexcept
116         : keymaster_key_param_set_t{other.params, other.length} {
117         other.length = 0;
118         other.params = nullptr;
119     }
120     KmParamSet(const KmParamSet&) = delete;
~KmParamSet()121     ~KmParamSet() { delete[] params; }
122 };
123 
kmBlob2hidlVec(const keymaster_key_blob_t & blob)124 inline hidl_vec<uint8_t> kmBlob2hidlVec(const keymaster_key_blob_t& blob) {
125     hidl_vec<uint8_t> result;
126     result.setToExternal(const_cast<unsigned char*>(blob.key_material), blob.key_material_size);
127     return result;
128 }
129 
kmBlob2hidlVec(const keymaster_blob_t & blob)130 inline hidl_vec<uint8_t> kmBlob2hidlVec(const keymaster_blob_t& blob) {
131     hidl_vec<uint8_t> result;
132     result.setToExternal(const_cast<unsigned char*>(blob.data), blob.data_length);
133     return result;
134 }
135 
kmBuffer2hidlVec(const::keymaster::Buffer & buf)136 inline hidl_vec<uint8_t> kmBuffer2hidlVec(const ::keymaster::Buffer& buf) {
137     hidl_vec<uint8_t> result;
138     result.setToExternal(const_cast<unsigned char*>(buf.peek_read()), buf.available_read());
139     return result;
140 }
141 
kmCertChain2Hidl(const keymaster_cert_chain_t & cert_chain)142 inline static hidl_vec<hidl_vec<uint8_t>> kmCertChain2Hidl(
143         const keymaster_cert_chain_t& cert_chain) {
144     hidl_vec<hidl_vec<uint8_t>> result;
145     if (!cert_chain.entry_count || !cert_chain.entries) return result;
146 
147     result.resize(cert_chain.entry_count);
148     for (size_t i = 0; i < cert_chain.entry_count; ++i) {
149         result[i] = kmBlob2hidlVec(cert_chain.entries[i]);
150     }
151 
152     return result;
153 }
154 
kmParamSet2Hidl(const keymaster_key_param_set_t & set)155 static inline hidl_vec<KeyParameter> kmParamSet2Hidl(const keymaster_key_param_set_t& set) {
156     hidl_vec<KeyParameter> result;
157     if (set.length == 0 || set.params == nullptr) return result;
158 
159     result.resize(set.length);
160     keymaster_key_param_t* params = set.params;
161     for (size_t i = 0; i < set.length; ++i) {
162         auto tag = params[i].tag;
163         result[i].tag = legacy_enum_conversion(tag);
164         switch (typeFromTag(tag)) {
165             case KM_ENUM:
166             case KM_ENUM_REP:
167                 result[i].f.integer = params[i].enumerated;
168                 break;
169             case KM_UINT:
170             case KM_UINT_REP:
171                 result[i].f.integer = params[i].integer;
172                 break;
173             case KM_ULONG:
174             case KM_ULONG_REP:
175                 result[i].f.longInteger = params[i].long_integer;
176                 break;
177             case KM_DATE:
178                 result[i].f.dateTime = params[i].date_time;
179                 break;
180             case KM_BOOL:
181                 result[i].f.boolValue = params[i].boolean;
182                 break;
183             case KM_BIGNUM:
184             case KM_BYTES:
185                 result[i].blob.setToExternal(const_cast<unsigned char*>(params[i].blob.data),
186                                              params[i].blob.data_length);
187                 break;
188             case KM_INVALID:
189             default:
190                 params[i].tag = KM_TAG_INVALID;
191                 /* just skip */
192                 break;
193         }
194     }
195     return result;
196 }
197 
addClientAndAppData(const hidl_vec<uint8_t> & clientId,const hidl_vec<uint8_t> & appData,::keymaster::AuthorizationSet * params)198 void addClientAndAppData(const hidl_vec<uint8_t>& clientId, const hidl_vec<uint8_t>& appData,
199                          ::keymaster::AuthorizationSet* params) {
200     params->Clear();
201     if (clientId.size()) {
202         params->push_back(::keymaster::TAG_APPLICATION_ID, clientId.data(), clientId.size());
203     }
204     if (appData.size()) {
205         params->push_back(::keymaster::TAG_APPLICATION_DATA, appData.data(), appData.size());
206     }
207 }
208 
209 }  // anonymous namespace
210 
TrustyKeymaster3Device(TrustyKeymaster * impl)211 TrustyKeymaster3Device::TrustyKeymaster3Device(TrustyKeymaster* impl) : impl_(impl) {}
212 
~TrustyKeymaster3Device()213 TrustyKeymaster3Device::~TrustyKeymaster3Device() {}
214 
getHardwareFeatures(getHardwareFeatures_cb _hidl_cb)215 Return<void> TrustyKeymaster3Device::getHardwareFeatures(getHardwareFeatures_cb _hidl_cb) {
216     _hidl_cb(true /* is_secure */, true /* supports_ec */,
217              true /* supports_symmetric_cryptography */, true /* supports_attestation */,
218              true /* supportsAllDigests */, "TrustyKeymaster", "Google");
219     return Void();
220 }
221 
addRngEntropy(const hidl_vec<uint8_t> & data)222 Return<ErrorCode> TrustyKeymaster3Device::addRngEntropy(const hidl_vec<uint8_t>& data) {
223     if (data.size() == 0) return ErrorCode::OK;
224     AddEntropyRequest request(impl_->message_version());
225     request.random_data.Reinitialize(data.data(), data.size());
226 
227     AddEntropyResponse response(impl_->message_version());
228     impl_->AddRngEntropy(request, &response);
229 
230     return legacy_enum_conversion(response.error);
231 }
232 
generateKey(const hidl_vec<KeyParameter> & keyParams,generateKey_cb _hidl_cb)233 Return<void> TrustyKeymaster3Device::generateKey(const hidl_vec<KeyParameter>& keyParams,
234                                                  generateKey_cb _hidl_cb) {
235     GenerateKeyRequest request(impl_->message_version());
236     request.key_description.Reinitialize(KmParamSet(keyParams));
237 
238     GenerateKeyResponse response(impl_->message_version());
239     impl_->GenerateKey(request, &response);
240 
241     KeyCharacteristics resultCharacteristics;
242     hidl_vec<uint8_t> resultKeyBlob;
243     if (response.error == KM_ERROR_OK) {
244         resultKeyBlob = kmBlob2hidlVec(response.key_blob);
245         resultCharacteristics.teeEnforced = kmParamSet2Hidl(response.enforced);
246         resultCharacteristics.softwareEnforced = kmParamSet2Hidl(response.unenforced);
247     }
248     _hidl_cb(legacy_enum_conversion(response.error), resultKeyBlob, resultCharacteristics);
249     return Void();
250 }
251 
getKeyCharacteristics(const hidl_vec<uint8_t> & keyBlob,const hidl_vec<uint8_t> & clientId,const hidl_vec<uint8_t> & appData,getKeyCharacteristics_cb _hidl_cb)252 Return<void> TrustyKeymaster3Device::getKeyCharacteristics(const hidl_vec<uint8_t>& keyBlob,
253                                                            const hidl_vec<uint8_t>& clientId,
254                                                            const hidl_vec<uint8_t>& appData,
255                                                            getKeyCharacteristics_cb _hidl_cb) {
256     GetKeyCharacteristicsRequest request(impl_->message_version());
257     request.SetKeyMaterial(keyBlob.data(), keyBlob.size());
258     addClientAndAppData(clientId, appData, &request.additional_params);
259 
260     GetKeyCharacteristicsResponse response(impl_->message_version());
261     impl_->GetKeyCharacteristics(request, &response);
262 
263     KeyCharacteristics resultCharacteristics;
264     if (response.error == KM_ERROR_OK) {
265         resultCharacteristics.teeEnforced = kmParamSet2Hidl(response.enforced);
266         resultCharacteristics.softwareEnforced = kmParamSet2Hidl(response.unenforced);
267     }
268     _hidl_cb(legacy_enum_conversion(response.error), resultCharacteristics);
269     return Void();
270 }
271 
importKey(const hidl_vec<KeyParameter> & params,KeyFormat keyFormat,const hidl_vec<uint8_t> & keyData,importKey_cb _hidl_cb)272 Return<void> TrustyKeymaster3Device::importKey(const hidl_vec<KeyParameter>& params,
273                                                KeyFormat keyFormat,
274                                                const hidl_vec<uint8_t>& keyData,
275                                                importKey_cb _hidl_cb) {
276     ImportKeyRequest request(impl_->message_version());
277     request.key_description.Reinitialize(KmParamSet(params));
278     request.key_format = legacy_enum_conversion(keyFormat);
279     request.key_data = KeymasterKeyBlob(keyData.data(), keyData.size());
280 
281     ImportKeyResponse response(impl_->message_version());
282     impl_->ImportKey(request, &response);
283 
284     KeyCharacteristics resultCharacteristics;
285     hidl_vec<uint8_t> resultKeyBlob;
286     if (response.error == KM_ERROR_OK) {
287         resultKeyBlob = kmBlob2hidlVec(response.key_blob);
288         resultCharacteristics.teeEnforced = kmParamSet2Hidl(response.enforced);
289         resultCharacteristics.softwareEnforced = kmParamSet2Hidl(response.unenforced);
290     }
291     _hidl_cb(legacy_enum_conversion(response.error), resultKeyBlob, resultCharacteristics);
292     return Void();
293 }
294 
exportKey(KeyFormat exportFormat,const hidl_vec<uint8_t> & keyBlob,const hidl_vec<uint8_t> & clientId,const hidl_vec<uint8_t> & appData,exportKey_cb _hidl_cb)295 Return<void> TrustyKeymaster3Device::exportKey(KeyFormat exportFormat,
296                                                const hidl_vec<uint8_t>& keyBlob,
297                                                const hidl_vec<uint8_t>& clientId,
298                                                const hidl_vec<uint8_t>& appData,
299                                                exportKey_cb _hidl_cb) {
300     ExportKeyRequest request(impl_->message_version());
301     request.key_format = legacy_enum_conversion(exportFormat);
302     request.SetKeyMaterial(keyBlob.data(), keyBlob.size());
303     addClientAndAppData(clientId, appData, &request.additional_params);
304 
305     ExportKeyResponse response(impl_->message_version());
306     impl_->ExportKey(request, &response);
307 
308     hidl_vec<uint8_t> resultKeyBlob;
309     if (response.error == KM_ERROR_OK) {
310         resultKeyBlob.setToExternal(response.key_data, response.key_data_length);
311     }
312     _hidl_cb(legacy_enum_conversion(response.error), resultKeyBlob);
313     return Void();
314 }
315 
attestKey(const hidl_vec<uint8_t> & keyToAttest,const hidl_vec<KeyParameter> & attestParams,attestKey_cb _hidl_cb)316 Return<void> TrustyKeymaster3Device::attestKey(const hidl_vec<uint8_t>& keyToAttest,
317                                                const hidl_vec<KeyParameter>& attestParams,
318                                                attestKey_cb _hidl_cb) {
319     AttestKeyRequest request(impl_->message_version());
320     request.SetKeyMaterial(keyToAttest.data(), keyToAttest.size());
321     request.attest_params.Reinitialize(KmParamSet(attestParams));
322 
323     AttestKeyResponse response(impl_->message_version());
324     impl_->AttestKey(request, &response);
325 
326     hidl_vec<hidl_vec<uint8_t>> resultCertChain;
327     if (response.error == KM_ERROR_OK) {
328         resultCertChain = kmCertChain2Hidl(response.certificate_chain);
329     }
330     _hidl_cb(legacy_enum_conversion(response.error), resultCertChain);
331     return Void();
332 }
333 
upgradeKey(const hidl_vec<uint8_t> & keyBlobToUpgrade,const hidl_vec<KeyParameter> & upgradeParams,upgradeKey_cb _hidl_cb)334 Return<void> TrustyKeymaster3Device::upgradeKey(const hidl_vec<uint8_t>& keyBlobToUpgrade,
335                                                 const hidl_vec<KeyParameter>& upgradeParams,
336                                                 upgradeKey_cb _hidl_cb) {
337     UpgradeKeyRequest request(impl_->message_version());
338     request.SetKeyMaterial(keyBlobToUpgrade.data(), keyBlobToUpgrade.size());
339     request.upgrade_params.Reinitialize(KmParamSet(upgradeParams));
340 
341     UpgradeKeyResponse response(impl_->message_version());
342     impl_->UpgradeKey(request, &response);
343 
344     if (response.error == KM_ERROR_OK) {
345         _hidl_cb(ErrorCode::OK, kmBlob2hidlVec(response.upgraded_key));
346     } else {
347         _hidl_cb(legacy_enum_conversion(response.error), hidl_vec<uint8_t>());
348     }
349     return Void();
350 }
351 
deleteKey(const hidl_vec<uint8_t> & keyBlob)352 Return<ErrorCode> TrustyKeymaster3Device::deleteKey(const hidl_vec<uint8_t>& keyBlob) {
353     DeleteKeyRequest request(impl_->message_version());
354     request.SetKeyMaterial(keyBlob.data(), keyBlob.size());
355 
356     DeleteKeyResponse response(impl_->message_version());
357     impl_->DeleteKey(request, &response);
358 
359     return legacy_enum_conversion(response.error);
360 }
361 
deleteAllKeys()362 Return<ErrorCode> TrustyKeymaster3Device::deleteAllKeys() {
363     DeleteAllKeysRequest request(impl_->message_version());
364     DeleteAllKeysResponse response(impl_->message_version());
365     impl_->DeleteAllKeys(request, &response);
366 
367     return legacy_enum_conversion(response.error);
368 }
369 
destroyAttestationIds()370 Return<ErrorCode> TrustyKeymaster3Device::destroyAttestationIds() {
371     return ErrorCode::UNIMPLEMENTED;
372 }
373 
begin(KeyPurpose purpose,const hidl_vec<uint8_t> & key,const hidl_vec<KeyParameter> & inParams,begin_cb _hidl_cb)374 Return<void> TrustyKeymaster3Device::begin(KeyPurpose purpose, const hidl_vec<uint8_t>& key,
375                                            const hidl_vec<KeyParameter>& inParams,
376                                            begin_cb _hidl_cb) {
377     BeginOperationRequest request(impl_->message_version());
378     request.purpose = legacy_enum_conversion(purpose);
379     request.SetKeyMaterial(key.data(), key.size());
380     request.additional_params.Reinitialize(KmParamSet(inParams));
381 
382     BeginOperationResponse response(impl_->message_version());
383     impl_->BeginOperation(request, &response);
384 
385     hidl_vec<KeyParameter> resultParams(impl_->message_version());
386     if (response.error == KM_ERROR_OK) {
387         resultParams = kmParamSet2Hidl(response.output_params);
388     }
389 
390     _hidl_cb(legacy_enum_conversion(response.error), resultParams, response.op_handle);
391     return Void();
392 }
393 
update(uint64_t operationHandle,const hidl_vec<KeyParameter> & inParams,const hidl_vec<uint8_t> & input,update_cb _hidl_cb)394 Return<void> TrustyKeymaster3Device::update(uint64_t operationHandle,
395                                             const hidl_vec<KeyParameter>& inParams,
396                                             const hidl_vec<uint8_t>& input, update_cb _hidl_cb) {
397     UpdateOperationRequest request(impl_->message_version());
398     UpdateOperationResponse response(impl_->message_version());
399     hidl_vec<KeyParameter> resultParams;
400     hidl_vec<uint8_t> resultBlob;
401     uint32_t resultConsumed = 0;
402 
403     request.op_handle = operationHandle;
404     request.additional_params.Reinitialize(KmParamSet(inParams));
405 
406     size_t inp_size = input.size();
407     size_t ser_size = request.SerializedSize();
408 
409     if (ser_size > TRUSTY_KEYMASTER_SEND_BUF_SIZE) {
410         response.error = KM_ERROR_INVALID_INPUT_LENGTH;
411     } else {
412         if (ser_size + inp_size > TRUSTY_KEYMASTER_SEND_BUF_SIZE) {
413             inp_size = TRUSTY_KEYMASTER_SEND_BUF_SIZE - ser_size;
414         }
415         request.input.Reinitialize(input.data(), inp_size);
416 
417         impl_->UpdateOperation(request, &response);
418 
419         if (response.error == KM_ERROR_OK) {
420             resultConsumed = response.input_consumed;
421             resultParams = kmParamSet2Hidl(response.output_params);
422             resultBlob = kmBuffer2hidlVec(response.output);
423         }
424     }
425     _hidl_cb(legacy_enum_conversion(response.error), resultConsumed, resultParams, resultBlob);
426     return Void();
427 }
428 
finish(uint64_t operationHandle,const hidl_vec<KeyParameter> & inParams,const hidl_vec<uint8_t> & input,const hidl_vec<uint8_t> & signature,finish_cb _hidl_cb)429 Return<void> TrustyKeymaster3Device::finish(uint64_t operationHandle,
430                                             const hidl_vec<KeyParameter>& inParams,
431                                             const hidl_vec<uint8_t>& input,
432                                             const hidl_vec<uint8_t>& signature,
433                                             finish_cb _hidl_cb) {
434     FinishOperationRequest request(impl_->message_version());
435     request.op_handle = operationHandle;
436     request.input.Reinitialize(input.data(), input.size());
437     request.signature.Reinitialize(signature.data(), signature.size());
438     request.additional_params.Reinitialize(KmParamSet(inParams));
439 
440     FinishOperationResponse response(impl_->message_version());
441     impl_->FinishOperation(request, &response);
442 
443     hidl_vec<KeyParameter> resultParams;
444     hidl_vec<uint8_t> resultBlob;
445     if (response.error == KM_ERROR_OK) {
446         resultParams = kmParamSet2Hidl(response.output_params);
447         resultBlob = kmBuffer2hidlVec(response.output);
448     }
449     _hidl_cb(legacy_enum_conversion(response.error), resultParams, resultBlob);
450     return Void();
451 }
452 
abort(uint64_t operationHandle)453 Return<ErrorCode> TrustyKeymaster3Device::abort(uint64_t operationHandle) {
454     AbortOperationRequest request(impl_->message_version());
455     request.op_handle = operationHandle;
456 
457     AbortOperationResponse response(impl_->message_version());
458     impl_->AbortOperation(request, &response);
459 
460     return legacy_enum_conversion(response.error);
461 }
462 }  // namespace keymaster
463