| /* |
| * Copyright (C) 2016 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| #include "keystore_attestation_id.h" |
| |
| #define LOG_TAG "keystore_att_id" |
| |
| #include <log/log.h> |
| |
| #include <memory> |
| #include <string> |
| #include <vector> |
| |
| #include <binder/IServiceManager.h> |
| #include <binder/Parcel.h> |
| #include <binder/Parcelable.h> |
| #include <binder/PersistableBundle.h> |
| |
| #include <android/security/keymaster/BpKeyAttestationApplicationIdProvider.h> |
| #include <android/security/keymaster/IKeyAttestationApplicationIdProvider.h> |
| #include <keystore/KeyAttestationApplicationId.h> |
| #include <keystore/KeyAttestationPackageInfo.h> |
| #include <keystore/Signature.h> |
| |
| #include <private/android_filesystem_config.h> /* for AID_SYSTEM */ |
| |
| #include <openssl/asn1t.h> |
| #include <openssl/bn.h> |
| #include <openssl/sha.h> |
| |
| #include <utils/String8.h> |
| |
| namespace android { |
| |
| namespace { |
| |
| constexpr const char* kAttestationSystemPackageName = "AndroidSystem"; |
| constexpr const char* kUnknownPackageName = "UnknownPackage"; |
| |
| std::vector<uint8_t> signature2SHA256(const content::pm::Signature& sig) { |
| std::vector<uint8_t> digest_buffer(SHA256_DIGEST_LENGTH); |
| SHA256(sig.data().data(), sig.data().size(), digest_buffer.data()); |
| return digest_buffer; |
| } |
| |
| using ::android::security::keymaster::BpKeyAttestationApplicationIdProvider; |
| |
| class KeyAttestationApplicationIdProvider : public BpKeyAttestationApplicationIdProvider { |
| public: |
| KeyAttestationApplicationIdProvider(); |
| |
| static KeyAttestationApplicationIdProvider& get(); |
| |
| private: |
| android::sp<android::IServiceManager> service_manager_; |
| }; |
| |
| KeyAttestationApplicationIdProvider& KeyAttestationApplicationIdProvider::get() { |
| static KeyAttestationApplicationIdProvider mpm; |
| return mpm; |
| } |
| |
| KeyAttestationApplicationIdProvider::KeyAttestationApplicationIdProvider() |
| : BpKeyAttestationApplicationIdProvider( |
| android::defaultServiceManager()->getService(String16("sec_key_att_app_id_provider"))) {} |
| |
| DECLARE_STACK_OF(ASN1_OCTET_STRING); |
| |
| typedef struct km_attestation_package_info { |
| ASN1_OCTET_STRING* package_name; |
| ASN1_INTEGER* version; |
| } KM_ATTESTATION_PACKAGE_INFO; |
| |
| // Estimated size: |
| // 4 bytes for the package name + package_name length |
| // 11 bytes for the version (2 bytes header and up to 9 bytes of data). |
| constexpr size_t AAID_PKG_INFO_OVERHEAD = 15; |
| ASN1_SEQUENCE(KM_ATTESTATION_PACKAGE_INFO) = { |
| ASN1_SIMPLE(KM_ATTESTATION_PACKAGE_INFO, package_name, ASN1_OCTET_STRING), |
| ASN1_SIMPLE(KM_ATTESTATION_PACKAGE_INFO, version, ASN1_INTEGER), |
| } ASN1_SEQUENCE_END(KM_ATTESTATION_PACKAGE_INFO); |
| IMPLEMENT_ASN1_FUNCTIONS(KM_ATTESTATION_PACKAGE_INFO); |
| |
| DECLARE_STACK_OF(KM_ATTESTATION_PACKAGE_INFO); |
| |
| // Estimated size: |
| // See estimate above for the stack of package infos. |
| // 34 (32 + 2) bytes for each signature digest. |
| constexpr size_t AAID_SIGNATURE_SIZE = 34; |
| typedef struct km_attestation_application_id { |
| STACK_OF(KM_ATTESTATION_PACKAGE_INFO) * package_infos; |
| STACK_OF(ASN1_OCTET_STRING) * signature_digests; |
| } KM_ATTESTATION_APPLICATION_ID; |
| |
| // Estimated overhead: |
| // 4 for the header of the octet string containing the fully-encoded data. |
| // 4 for the sequence header. |
| // 4 for the header of the package info set. |
| // 4 for the header of the signature set. |
| constexpr size_t AAID_GENERAL_OVERHEAD = 16; |
| ASN1_SEQUENCE(KM_ATTESTATION_APPLICATION_ID) = { |
| ASN1_SET_OF(KM_ATTESTATION_APPLICATION_ID, package_infos, KM_ATTESTATION_PACKAGE_INFO), |
| ASN1_SET_OF(KM_ATTESTATION_APPLICATION_ID, signature_digests, ASN1_OCTET_STRING), |
| } ASN1_SEQUENCE_END(KM_ATTESTATION_APPLICATION_ID); |
| IMPLEMENT_ASN1_FUNCTIONS(KM_ATTESTATION_APPLICATION_ID); |
| |
| } // namespace |
| |
| } // namespace android |
| |
| namespace std { |
| template <> struct default_delete<android::KM_ATTESTATION_PACKAGE_INFO> { |
| void operator()(android::KM_ATTESTATION_PACKAGE_INFO* p) { |
| android::KM_ATTESTATION_PACKAGE_INFO_free(p); |
| } |
| }; |
| template <> struct default_delete<ASN1_OCTET_STRING> { |
| void operator()(ASN1_OCTET_STRING* p) { ASN1_OCTET_STRING_free(p); } |
| }; |
| template <> struct default_delete<android::KM_ATTESTATION_APPLICATION_ID> { |
| void operator()(android::KM_ATTESTATION_APPLICATION_ID* p) { |
| android::KM_ATTESTATION_APPLICATION_ID_free(p); |
| } |
| }; |
| } // namespace std |
| |
| namespace android { |
| namespace security { |
| namespace { |
| |
| using ::android::security::keymaster::KeyAttestationApplicationId; |
| using ::android::security::keymaster::KeyAttestationPackageInfo; |
| |
| status_t build_attestation_package_info(const KeyAttestationPackageInfo& pinfo, |
| std::unique_ptr<KM_ATTESTATION_PACKAGE_INFO>* attestation_package_info_ptr) { |
| |
| if (!attestation_package_info_ptr) return BAD_VALUE; |
| auto& attestation_package_info = *attestation_package_info_ptr; |
| |
| attestation_package_info.reset(KM_ATTESTATION_PACKAGE_INFO_new()); |
| if (!attestation_package_info.get()) return NO_MEMORY; |
| |
| if (!pinfo.package_name()) { |
| ALOGE("Key attestation package info lacks package name"); |
| return BAD_VALUE; |
| } |
| |
| std::string pkg_name(String8(*pinfo.package_name()).string()); |
| if (!ASN1_OCTET_STRING_set(attestation_package_info->package_name, |
| reinterpret_cast<const unsigned char*>(pkg_name.data()), |
| pkg_name.size())) { |
| return UNKNOWN_ERROR; |
| } |
| |
| BIGNUM* bn_version = BN_new(); |
| if (bn_version == nullptr) { |
| return NO_MEMORY; |
| } |
| if (BN_set_u64(bn_version, static_cast<uint64_t>(pinfo.version_code())) != 1) { |
| BN_free(bn_version); |
| return UNKNOWN_ERROR; |
| } |
| status_t retval = NO_ERROR; |
| if (BN_to_ASN1_INTEGER(bn_version, attestation_package_info->version) == nullptr) { |
| retval = UNKNOWN_ERROR; |
| } |
| BN_free(bn_version); |
| return retval; |
| } |
| |
| /* The following function are not used. They are mentioned here to silence |
| * warnings about them not being used. |
| */ |
| void unused_functions_silencer() __attribute__((unused)); |
| void unused_functions_silencer() { |
| i2d_KM_ATTESTATION_PACKAGE_INFO(nullptr, nullptr); |
| d2i_KM_ATTESTATION_APPLICATION_ID(nullptr, nullptr, 0); |
| d2i_KM_ATTESTATION_PACKAGE_INFO(nullptr, nullptr, 0); |
| } |
| |
| } // namespace |
| |
| StatusOr<std::vector<uint8_t>> |
| build_attestation_application_id(const KeyAttestationApplicationId& key_attestation_id) { |
| auto attestation_id = |
| std::unique_ptr<KM_ATTESTATION_APPLICATION_ID>(KM_ATTESTATION_APPLICATION_ID_new()); |
| size_t estimated_encoded_size = AAID_GENERAL_OVERHEAD; |
| |
| auto attestation_pinfo_stack = reinterpret_cast<_STACK*>(attestation_id->package_infos); |
| |
| if (key_attestation_id.pinfos_begin() == key_attestation_id.pinfos_end()) return BAD_VALUE; |
| |
| for (auto pinfo = key_attestation_id.pinfos_begin(); pinfo != key_attestation_id.pinfos_end(); |
| ++pinfo) { |
| if (!pinfo->package_name()) { |
| ALOGE("Key attestation package info lacks package name"); |
| return BAD_VALUE; |
| } |
| std::string package_name(String8(*pinfo->package_name()).string()); |
| std::unique_ptr<KM_ATTESTATION_PACKAGE_INFO> attestation_package_info; |
| auto rc = build_attestation_package_info(*pinfo, &attestation_package_info); |
| if (rc != NO_ERROR) { |
| ALOGE("Building DER attestation package info failed %d", rc); |
| return rc; |
| } |
| estimated_encoded_size += AAID_PKG_INFO_OVERHEAD + package_name.size(); |
| if (estimated_encoded_size > KEY_ATTESTATION_APPLICATION_ID_MAX_SIZE) { |
| break; |
| } |
| if (!sk_push(attestation_pinfo_stack, attestation_package_info.get())) { |
| return NO_MEMORY; |
| } |
| // if push succeeded, the stack takes ownership |
| attestation_package_info.release(); |
| } |
| |
| /** Apps can only share a uid iff they were signed with the same certificate(s). Because the |
| * signature field actually holds the signing certificate, rather than a signature, we can |
| * simply use the set of signature digests of the first package info. |
| */ |
| const auto& pinfo = *key_attestation_id.pinfos_begin(); |
| std::vector<std::vector<uint8_t>> signature_digests; |
| |
| for (auto sig = pinfo.sigs_begin(); sig != pinfo.sigs_end(); ++sig) { |
| signature_digests.push_back(signature2SHA256(*sig)); |
| } |
| |
| auto signature_digest_stack = reinterpret_cast<_STACK*>(attestation_id->signature_digests); |
| for (auto si : signature_digests) { |
| estimated_encoded_size += AAID_SIGNATURE_SIZE; |
| if (estimated_encoded_size > KEY_ATTESTATION_APPLICATION_ID_MAX_SIZE) { |
| break; |
| } |
| auto asn1_item = std::unique_ptr<ASN1_OCTET_STRING>(ASN1_OCTET_STRING_new()); |
| if (!asn1_item) return NO_MEMORY; |
| if (!ASN1_OCTET_STRING_set(asn1_item.get(), si.data(), si.size())) { |
| return UNKNOWN_ERROR; |
| } |
| if (!sk_push(signature_digest_stack, asn1_item.get())) { |
| return NO_MEMORY; |
| } |
| asn1_item.release(); // if push succeeded, the stack takes ownership |
| } |
| |
| int len = i2d_KM_ATTESTATION_APPLICATION_ID(attestation_id.get(), nullptr); |
| if (len < 0) return UNKNOWN_ERROR; |
| |
| std::vector<uint8_t> result(len); |
| uint8_t* p = result.data(); |
| len = i2d_KM_ATTESTATION_APPLICATION_ID(attestation_id.get(), &p); |
| if (len < 0) return UNKNOWN_ERROR; |
| |
| return result; |
| } |
| |
| StatusOr<std::vector<uint8_t>> gather_attestation_application_id(uid_t uid) { |
| KeyAttestationApplicationId key_attestation_id; |
| |
| if (uid == AID_SYSTEM) { |
| /* Use a fixed ID for system callers */ |
| auto pinfo = std::make_unique<KeyAttestationPackageInfo>( |
| String16(kAttestationSystemPackageName), 1 /* version code */, |
| std::make_shared<KeyAttestationPackageInfo::SignaturesVector>()); |
| key_attestation_id = KeyAttestationApplicationId(std::move(pinfo)); |
| } else { |
| /* Get the attestation application ID from package manager */ |
| auto& pm = KeyAttestationApplicationIdProvider::get(); |
| auto status = pm.getKeyAttestationApplicationId(uid, &key_attestation_id); |
| // Package Manager call has failed, perform attestation but indicate that the |
| // caller is unknown. |
| if (!status.isOk()) { |
| ALOGW("package manager request for key attestation ID failed with: %s %d", |
| status.exceptionMessage().string(), status.exceptionCode()); |
| auto pinfo = std::make_unique<KeyAttestationPackageInfo>( |
| String16(kUnknownPackageName), 1 /* version code */, |
| std::make_shared<KeyAttestationPackageInfo::SignaturesVector>()); |
| key_attestation_id = KeyAttestationApplicationId(std::move(pinfo)); |
| } |
| } |
| |
| /* DER encode the attestation application ID */ |
| return build_attestation_application_id(key_attestation_id); |
| } |
| |
| } // namespace security |
| } // namespace android |