Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2016 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #ifndef KEYSTORE_USER_STATE_H_ |
| 18 | #define KEYSTORE_USER_STATE_H_ |
| 19 | |
| 20 | #include <sys/types.h> |
| 21 | |
| 22 | #include <openssl/aes.h> |
| 23 | |
| 24 | #include <utils/String8.h> |
| 25 | |
| 26 | #include <keystore/keystore.h> |
| 27 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 28 | #include "blob.h" |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 29 | #include "keystore_utils.h" |
| 30 | |
| 31 | #include <android-base/logging.h> |
| 32 | #include <condition_variable> |
| 33 | #include <keystore/keystore_concurrency.h> |
| 34 | #include <mutex> |
| 35 | #include <set> |
Branden Archer | f5953d7 | 2019-01-10 09:08:18 -0800 | [diff] [blame] | 36 | #include <vector> |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 37 | |
| 38 | namespace keystore { |
| 39 | |
| 40 | class UserState; |
| 41 | |
| 42 | template <typename UserState> using LockedUserState = ProxyLock<UnlockProxyLockHelper<UserState>>; |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 43 | |
| 44 | class UserState { |
| 45 | public: |
Chih-Hung Hsieh | d7791be | 2016-07-12 11:58:02 -0700 | [diff] [blame] | 46 | explicit UserState(uid_t userId); |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 47 | |
| 48 | bool initialize(); |
| 49 | |
| 50 | uid_t getUserId() const { return mUserId; } |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 51 | const std::string& getUserDirName() const { return mMasterKeyEntry.user_dir(); } |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 52 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 53 | std::string getMasterKeyFileName() const { return mMasterKeyEntry.getKeyBlobPath(); } |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 54 | |
| 55 | void setState(State state); |
| 56 | State getState() const { return mState; } |
| 57 | |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 58 | void zeroizeMasterKeysInMemory(); |
| 59 | bool deleteMasterKey(); |
| 60 | |
Branden Archer | 44d1afa | 2018-12-28 09:10:49 -0800 | [diff] [blame] | 61 | ResponseCode initialize(const android::String8& pw); |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 62 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 63 | ResponseCode copyMasterKey(LockedUserState<UserState>* src); |
| 64 | ResponseCode copyMasterKeyFile(LockedUserState<UserState>* src); |
Branden Archer | 44d1afa | 2018-12-28 09:10:49 -0800 | [diff] [blame] | 65 | ResponseCode writeMasterKey(const android::String8& pw); |
| 66 | ResponseCode readMasterKey(const android::String8& pw); |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 67 | |
Branden Archer | f5953d7 | 2019-01-10 09:08:18 -0800 | [diff] [blame] | 68 | const std::vector<uint8_t>& getEncryptionKey() const { return mMasterKey; } |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 69 | |
| 70 | bool reset(); |
| 71 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 72 | bool operator<(const UserState& rhs) const; |
| 73 | bool operator<(uid_t userId) const; |
| 74 | |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 75 | private: |
Shawn Willden | 17b8709 | 2019-10-01 17:43:43 -0600 | [diff] [blame] | 76 | static constexpr int SHA1_DIGEST_SIZE_BYTES = 16; |
| 77 | static constexpr int SHA256_DIGEST_SIZE_BYTES = 32; |
Branden Archer | cefbcbc | 2018-12-28 12:24:53 -0800 | [diff] [blame] | 78 | |
Shawn Willden | 17b8709 | 2019-10-01 17:43:43 -0600 | [diff] [blame] | 79 | static constexpr int MASTER_KEY_SIZE_BYTES = kAes256KeySizeBytes; |
| 80 | static constexpr int MASTER_KEY_SIZE_BITS = MASTER_KEY_SIZE_BYTES * 8; |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 81 | |
Shawn Willden | 17b8709 | 2019-10-01 17:43:43 -0600 | [diff] [blame] | 82 | static constexpr size_t SALT_SIZE = 16; |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 83 | |
Branden Archer | f5953d7 | 2019-01-10 09:08:18 -0800 | [diff] [blame] | 84 | void generateKeyFromPassword(std::vector<uint8_t>& key, const android::String8& pw, |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 85 | uint8_t* salt); |
Branden Archer | 44d1afa | 2018-12-28 09:10:49 -0800 | [diff] [blame] | 86 | bool generateSalt(); |
| 87 | bool generateMasterKey(); |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 88 | void setupMasterKeys(); |
| 89 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 90 | KeyBlobEntry mMasterKeyEntry; |
| 91 | |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 92 | uid_t mUserId; |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 93 | State mState; |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 94 | |
Branden Archer | f5953d7 | 2019-01-10 09:08:18 -0800 | [diff] [blame] | 95 | std::vector<uint8_t> mMasterKey; |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 96 | uint8_t mSalt[SALT_SIZE]; |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 97 | }; |
| 98 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 99 | bool operator<(uid_t userId, const UserState& rhs); |
| 100 | |
| 101 | class UserStateDB { |
| 102 | public: |
| 103 | LockedUserState<UserState> getUserState(uid_t userId); |
| 104 | LockedUserState<UserState> getUserStateByUid(uid_t uid); |
| 105 | LockedUserState<const UserState> getUserState(uid_t userId) const; |
| 106 | LockedUserState<const UserState> getUserStateByUid(uid_t uid) const; |
| 107 | |
| 108 | private: |
| 109 | mutable std::set<const UserState*> locked_state_; |
| 110 | mutable std::mutex locked_state_mutex_; |
| 111 | mutable std::condition_variable locked_state_mutex_cond_var_; |
| 112 | |
| 113 | template <typename UserState> |
| 114 | LockedUserState<UserState> get(std::unique_lock<std::mutex> lock, UserState* entry) const { |
| 115 | locked_state_mutex_cond_var_.wait( |
| 116 | lock, [&] { return locked_state_.find(entry) == locked_state_.end(); }); |
| 117 | locked_state_.insert(entry); |
| 118 | return {entry, [&](UserState* entry) { |
| 119 | std::unique_lock<std::mutex> lock(locked_state_mutex_); |
| 120 | locked_state_.erase(entry); |
| 121 | lock.unlock(); |
| 122 | locked_state_mutex_cond_var_.notify_all(); |
| 123 | }}; |
| 124 | } |
| 125 | |
| 126 | std::map<uid_t, UserState> mMasterKeys; |
| 127 | }; |
| 128 | |
| 129 | } // namespace keystore |
| 130 | |
Shawn Willden | 6507c27 | 2016-01-05 22:51:48 -0700 | [diff] [blame] | 131 | #endif // KEYSTORE_USER_STATE_H_ |