123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285 |
- #ifndef KEYSTORE_BLOB_H_
- #define KEYSTORE_BLOB_H_
- #include <stdint.h>
- #include <openssl/aes.h>
- #include <openssl/md5.h>
- #include <condition_variable>
- #include <functional>
- #include <keystore/keymaster_types.h>
- #include <keystore/keystore.h>
- #include <list>
- #include <mutex>
- #include <set>
- #include <sstream>
- #include <vector>
- constexpr size_t kValueSize = 32768;
- constexpr size_t kAesKeySize = 128 / 8;
- constexpr size_t kGcmTagLength = 128 / 8;
- constexpr size_t kGcmIvLength = 96 / 8;
- constexpr size_t kAes128KeySizeBytes = 128 / 8;
- constexpr size_t kAes256KeySizeBytes = 256 / 8;
- struct __attribute__((packed)) blobv3 {
- uint8_t version;
- uint8_t type;
- uint8_t flags;
- uint8_t info;
- uint8_t initialization_vector[AES_BLOCK_SIZE];
- uint8_t aead_tag[kGcmTagLength];
- int32_t length;
- uint8_t value[kValueSize + AES_BLOCK_SIZE];
- };
- struct __attribute__((packed)) blobv2 {
- uint8_t version;
- uint8_t type;
- uint8_t flags;
- uint8_t info;
- uint8_t vector[AES_BLOCK_SIZE];
- uint8_t encrypted[0];
- uint8_t digest[MD5_DIGEST_LENGTH];
- uint8_t digested[0];
- int32_t length;
- uint8_t value[kValueSize + AES_BLOCK_SIZE];
- };
- static_assert(sizeof(blobv3) == sizeof(blobv2) &&
- offsetof(blobv3, initialization_vector) == offsetof(blobv2, vector) &&
- offsetof(blobv3, aead_tag) == offsetof(blobv2, digest) &&
- offsetof(blobv3, aead_tag) == offsetof(blobv2, encrypted) &&
- offsetof(blobv3, length) == offsetof(blobv2, length) &&
- offsetof(blobv3, value) == offsetof(blobv2, value),
- "Oops. Blob layout changed.");
- static const uint8_t CURRENT_BLOB_VERSION = 3;
- typedef enum {
- TYPE_ANY = 0,
- TYPE_GENERIC = 1,
- TYPE_MASTER_KEY = 2,
- TYPE_KEY_PAIR = 3,
- TYPE_KEYMASTER_10 = 4,
- TYPE_KEY_CHARACTERISTICS = 5,
- TYPE_KEY_CHARACTERISTICS_CACHE = 6,
- TYPE_MASTER_KEY_AES256 = 7,
- } BlobType;
- class LockedKeyBlobEntry;
- class Blob {
- friend LockedKeyBlobEntry;
- public:
- Blob(const uint8_t* value, size_t valueLength, const uint8_t* info, uint8_t infoLength,
- BlobType type);
- explicit Blob(blobv3 b);
- Blob();
- Blob(const Blob& rhs);
- Blob(Blob&& rhs);
- ~Blob() {
- if (mBlob) *mBlob = {};
- }
- Blob& operator=(const Blob& rhs);
- Blob& operator=(Blob&& rhs);
- explicit operator bool() const { return bool(mBlob); }
- const uint8_t* getValue() const { return mBlob->value; }
- int32_t getLength() const { return mBlob->length; }
- const uint8_t* getInfo() const { return mBlob->value + mBlob->length; }
- uint8_t getInfoLength() const { return mBlob->info; }
- uint8_t getVersion() const { return mBlob->version; }
- bool isEncrypted() const;
- void setEncrypted(bool encrypted);
- bool isSuperEncrypted() const;
- void setSuperEncrypted(bool superEncrypted);
- bool isCriticalToDeviceEncryption() const;
- void setCriticalToDeviceEncryption(bool critical);
- bool isFallback() const { return mBlob->flags & KEYSTORE_FLAG_FALLBACK; }
- void setFallback(bool fallback);
- void setVersion(uint8_t version) { mBlob->version = version; }
- BlobType getType() const { return BlobType(mBlob->type); }
- void setType(BlobType type) { mBlob->type = uint8_t(type); }
- keystore::SecurityLevel getSecurityLevel() const;
- void setSecurityLevel(keystore::SecurityLevel);
- std::tuple<bool, keystore::AuthorizationSet, keystore::AuthorizationSet>
- getKeyCharacteristics() const;
- bool putKeyCharacteristics(const keystore::AuthorizationSet& hwEnforced,
- const keystore::AuthorizationSet& swEnforced);
- private:
- std::unique_ptr<blobv3> mBlob;
- ResponseCode readBlob(const std::string& filename, const std::vector<uint8_t>& aes_key,
- State state);
- };
- class KeyBlobEntry {
- private:
- std::string alias_;
- std::string user_dir_;
- uid_t uid_;
- bool masterkey_;
- public:
- KeyBlobEntry(std::string alias, std::string user_dir, uid_t uid, bool masterkey = false)
- : alias_(std::move(alias)), user_dir_(std::move(user_dir)), uid_(uid),
- masterkey_(masterkey) {}
- std::string getKeyBlobBaseName() const;
- std::string getKeyBlobPath() const;
- std::string getCharacteristicsBlobBaseName() const;
- std::string getCharacteristicsBlobPath() const;
- bool hasKeyBlob() const;
- bool hasCharacteristicsBlob() const;
- bool operator<(const KeyBlobEntry& rhs) const {
- return std::tie(uid_, alias_, user_dir_) < std::tie(rhs.uid_, rhs.alias_, rhs.user_dir_);
- }
- bool operator==(const KeyBlobEntry& rhs) const {
- return std::tie(uid_, alias_, user_dir_) == std::tie(rhs.uid_, rhs.alias_, rhs.user_dir_);
- }
- bool operator!=(const KeyBlobEntry& rhs) const { return !(*this == rhs); }
- inline const std::string& alias() const { return alias_; }
- inline const std::string& user_dir() const { return user_dir_; }
- inline uid_t uid() const { return uid_; }
- };
- class LockedKeyBlobEntry {
- private:
- static std::set<KeyBlobEntry> locked_blobs_;
- static std::mutex locked_blobs_mutex_;
- static std::condition_variable locked_blobs_mutex_cond_var_;
- const KeyBlobEntry* entry_;
-
- LockedKeyBlobEntry(const KeyBlobEntry& entry) : entry_(&entry) {}
- static void put(const KeyBlobEntry& entry);
- LockedKeyBlobEntry(const LockedKeyBlobEntry&) = delete;
- LockedKeyBlobEntry& operator=(const LockedKeyBlobEntry&) = delete;
- public:
- LockedKeyBlobEntry() : entry_(nullptr){};
- ~LockedKeyBlobEntry();
- LockedKeyBlobEntry(LockedKeyBlobEntry&& rhs) : entry_(rhs.entry_) { rhs.entry_ = nullptr; }
- LockedKeyBlobEntry& operator=(LockedKeyBlobEntry&& rhs) {
-
- LockedKeyBlobEntry dummy(std::move(*this));
- entry_ = rhs.entry_;
- rhs.entry_ = nullptr;
- return *this;
- }
- static LockedKeyBlobEntry get(KeyBlobEntry entry);
- static std::tuple<ResponseCode, std::list<LockedKeyBlobEntry>>
- list(const std::string& user_dir,
- std::function<bool(uid_t, const std::string&)> filter =
- [](uid_t, const std::string&) -> bool { return true; });
- ResponseCode writeBlobs(Blob keyBlob, Blob characteristicsBlob,
- const std::vector<uint8_t>& aes_key, State state) const;
- std::tuple<ResponseCode, Blob, Blob> readBlobs(const std::vector<uint8_t>& aes_key,
- State state) const;
- ResponseCode deleteBlobs() const;
- inline explicit operator bool() const { return entry_ != nullptr; }
- inline const KeyBlobEntry& operator*() const { return *entry_; }
- inline const KeyBlobEntry* operator->() const { return entry_; }
- };
- std::string encodeKeyName(const std::string& keyName);
- std::string decodeKeyName(const std::string& encodedName);
- #endif
|