Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2015 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #ifndef KEYSTORE_BLOB_H_ |
| 18 | #define KEYSTORE_BLOB_H_ |
| 19 | |
| 20 | #include <stdint.h> |
| 21 | |
| 22 | #include <openssl/aes.h> |
| 23 | #include <openssl/md5.h> |
| 24 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 25 | #include <condition_variable> |
| 26 | #include <functional> |
Janis Danisevskis | c146014 | 2017-12-18 16:48:46 -0800 | [diff] [blame] | 27 | #include <keystore/keymaster_types.h> |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 28 | #include <keystore/keystore.h> |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 29 | #include <list> |
| 30 | #include <mutex> |
| 31 | #include <set> |
| 32 | #include <sstream> |
Branden Archer | f5953d7 | 2019-01-10 09:08:18 -0800 | [diff] [blame] | 33 | #include <vector> |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 34 | |
Shawn Willden | e983058 | 2017-04-18 10:47:57 -0600 | [diff] [blame] | 35 | constexpr size_t kValueSize = 32768; |
| 36 | constexpr size_t kAesKeySize = 128 / 8; |
| 37 | constexpr size_t kGcmTagLength = 128 / 8; |
| 38 | constexpr size_t kGcmIvLength = 96 / 8; |
Branden Archer | d031573 | 2019-01-10 14:56:05 -0800 | [diff] [blame] | 39 | constexpr size_t kAes128KeySizeBytes = 128 / 8; |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 40 | |
| 41 | /* Here is the file format. There are two parts in blob.value, the secret and |
| 42 | * the description. The secret is stored in ciphertext, and its original size |
| 43 | * can be found in blob.length. The description is stored after the secret in |
| 44 | * plaintext, and its size is specified in blob.info. The total size of the two |
Shawn Willden | e983058 | 2017-04-18 10:47:57 -0600 | [diff] [blame] | 45 | * parts must be no more than kValueSize bytes. The first field is the version, |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 46 | * the second is the blob's type, and the third byte is flags. Fields other |
| 47 | * than blob.info, blob.length, and blob.value are modified by encryptBlob() |
| 48 | * and decryptBlob(). Thus they should not be accessed from outside. */ |
| 49 | |
Shawn Willden | e983058 | 2017-04-18 10:47:57 -0600 | [diff] [blame] | 50 | struct __attribute__((packed)) blobv3 { |
| 51 | uint8_t version; |
| 52 | uint8_t type; |
| 53 | uint8_t flags; |
| 54 | uint8_t info; |
| 55 | uint8_t initialization_vector[AES_BLOCK_SIZE]; // Only 96 bits is used, rest is zeroed. |
| 56 | uint8_t aead_tag[kGcmTagLength]; |
| 57 | int32_t length; // in network byte order, only for backward compatibility |
| 58 | uint8_t value[kValueSize + AES_BLOCK_SIZE]; |
| 59 | }; |
| 60 | |
| 61 | struct __attribute__((packed)) blobv2 { |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 62 | uint8_t version; |
| 63 | uint8_t type; |
| 64 | uint8_t flags; |
| 65 | uint8_t info; |
| 66 | uint8_t vector[AES_BLOCK_SIZE]; |
| 67 | uint8_t encrypted[0]; // Marks offset to encrypted data. |
| 68 | uint8_t digest[MD5_DIGEST_LENGTH]; |
| 69 | uint8_t digested[0]; // Marks offset to digested data. |
Shawn Willden | e983058 | 2017-04-18 10:47:57 -0600 | [diff] [blame] | 70 | int32_t length; // in network byte order |
| 71 | uint8_t value[kValueSize + AES_BLOCK_SIZE]; |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 72 | }; |
| 73 | |
Shawn Willden | e983058 | 2017-04-18 10:47:57 -0600 | [diff] [blame] | 74 | static_assert(sizeof(blobv3) == sizeof(blobv2) && |
| 75 | offsetof(blobv3, initialization_vector) == offsetof(blobv2, vector) && |
| 76 | offsetof(blobv3, aead_tag) == offsetof(blobv2, digest) && |
| 77 | offsetof(blobv3, aead_tag) == offsetof(blobv2, encrypted) && |
| 78 | offsetof(blobv3, length) == offsetof(blobv2, length) && |
| 79 | offsetof(blobv3, value) == offsetof(blobv2, value), |
| 80 | "Oops. Blob layout changed."); |
| 81 | |
| 82 | static const uint8_t CURRENT_BLOB_VERSION = 3; |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 83 | |
| 84 | typedef enum { |
| 85 | TYPE_ANY = 0, // meta type that matches anything |
| 86 | TYPE_GENERIC = 1, |
| 87 | TYPE_MASTER_KEY = 2, |
| 88 | TYPE_KEY_PAIR = 3, |
| 89 | TYPE_KEYMASTER_10 = 4, |
Tucker Sylvestro | 0ab28b7 | 2016-08-05 18:02:47 -0400 | [diff] [blame] | 90 | TYPE_KEY_CHARACTERISTICS = 5, |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 91 | TYPE_KEY_CHARACTERISTICS_CACHE = 6, |
Branden Archer | d031573 | 2019-01-10 14:56:05 -0800 | [diff] [blame] | 92 | TYPE_MASTER_KEY_AES256 = 7, |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 93 | } BlobType; |
| 94 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 95 | class LockedKeyBlobEntry; |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 96 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 97 | /** |
| 98 | * The Blob represents the content of a KeyBlobEntry. |
| 99 | * |
| 100 | * BEWARE: It is only save to call any member function of a Blob b if bool(b) yields true. |
| 101 | * Exceptions are putKeyCharacteristics(), the assignment operators and operator bool. |
| 102 | */ |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 103 | class Blob { |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 104 | friend LockedKeyBlobEntry; |
| 105 | |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 106 | public: |
| 107 | Blob(const uint8_t* value, size_t valueLength, const uint8_t* info, uint8_t infoLength, |
| 108 | BlobType type); |
Shawn Willden | e983058 | 2017-04-18 10:47:57 -0600 | [diff] [blame] | 109 | explicit Blob(blobv3 b); |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 110 | Blob(); |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 111 | Blob(const Blob& rhs); |
| 112 | Blob(Blob&& rhs); |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 113 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 114 | ~Blob() { |
| 115 | if (mBlob) *mBlob = {}; |
| 116 | } |
Shawn Willden | e983058 | 2017-04-18 10:47:57 -0600 | [diff] [blame] | 117 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 118 | Blob& operator=(const Blob& rhs); |
| 119 | Blob& operator=(Blob&& rhs); |
Chih-Hung Hsieh | 4fa39ef | 2019-01-04 13:34:17 -0800 | [diff] [blame] | 120 | explicit operator bool() const { return bool(mBlob); } |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 121 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 122 | const uint8_t* getValue() const { return mBlob->value; } |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 123 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 124 | int32_t getLength() const { return mBlob->length; } |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 125 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 126 | const uint8_t* getInfo() const { return mBlob->value + mBlob->length; } |
| 127 | uint8_t getInfoLength() const { return mBlob->info; } |
| 128 | |
| 129 | uint8_t getVersion() const { return mBlob->version; } |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 130 | |
| 131 | bool isEncrypted() const; |
| 132 | void setEncrypted(bool encrypted); |
| 133 | |
Shawn Willden | d5a24e6 | 2017-02-28 13:53:24 -0700 | [diff] [blame] | 134 | bool isSuperEncrypted() const; |
| 135 | void setSuperEncrypted(bool superEncrypted); |
| 136 | |
Rubin Xu | 67899de | 2017-04-21 19:15:13 +0100 | [diff] [blame] | 137 | bool isCriticalToDeviceEncryption() const; |
| 138 | void setCriticalToDeviceEncryption(bool critical); |
| 139 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 140 | bool isFallback() const { return mBlob->flags & KEYSTORE_FLAG_FALLBACK; } |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 141 | void setFallback(bool fallback); |
| 142 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 143 | void setVersion(uint8_t version) { mBlob->version = version; } |
| 144 | BlobType getType() const { return BlobType(mBlob->type); } |
| 145 | void setType(BlobType type) { mBlob->type = uint8_t(type); } |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 146 | |
Janis Danisevskis | c146014 | 2017-12-18 16:48:46 -0800 | [diff] [blame] | 147 | keystore::SecurityLevel getSecurityLevel() const; |
| 148 | void setSecurityLevel(keystore::SecurityLevel); |
| 149 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 150 | std::tuple<bool, keystore::AuthorizationSet, keystore::AuthorizationSet> |
| 151 | getKeyCharacteristics() const; |
| 152 | |
| 153 | bool putKeyCharacteristics(const keystore::AuthorizationSet& hwEnforced, |
| 154 | const keystore::AuthorizationSet& swEnforced); |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 155 | |
| 156 | private: |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 157 | std::unique_ptr<blobv3> mBlob; |
| 158 | |
Branden Archer | f5953d7 | 2019-01-10 09:08:18 -0800 | [diff] [blame] | 159 | ResponseCode readBlob(const std::string& filename, const std::vector<uint8_t>& aes_key, |
| 160 | State state); |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 161 | }; |
| 162 | |
| 163 | /** |
| 164 | * A KeyBlobEntry represents a full qualified key blob as known by Keystore. The key blob |
| 165 | * is given by the uid of the owning app and the alias used by the app to refer to this key. |
| 166 | * The user_dir_ is technically implied by the uid, but computation of the user directory is |
| 167 | * done in the user state database. Which is why we also cache it here. |
| 168 | * |
| 169 | * The KeyBlobEntry knows the location of the key blob files (which may include a characteristics |
| 170 | * cache file) but does not allow read or write access to the content. It also does not imply |
| 171 | * the existence of the files. |
| 172 | * |
| 173 | * KeyBlobEntry abstracts, to some extent, from the the file system based storage of key blobs. |
| 174 | * An evolution of KeyBlobEntry may be used for key blob storage based on a back end other than |
| 175 | * file system, e.g., SQL database or other. |
| 176 | * |
| 177 | * For access to the key blob content the programmer has to acquire a LockedKeyBlobEntry (see |
| 178 | * below). |
| 179 | */ |
| 180 | class KeyBlobEntry { |
| 181 | private: |
| 182 | std::string alias_; |
| 183 | std::string user_dir_; |
| 184 | uid_t uid_; |
| 185 | bool masterkey_; |
| 186 | |
| 187 | public: |
| 188 | KeyBlobEntry(std::string alias, std::string user_dir, uid_t uid, bool masterkey = false) |
| 189 | : alias_(std::move(alias)), user_dir_(std::move(user_dir)), uid_(uid), |
| 190 | masterkey_(masterkey) {} |
| 191 | |
| 192 | std::string getKeyBlobBaseName() const; |
| 193 | std::string getKeyBlobPath() const; |
| 194 | |
| 195 | std::string getCharacteristicsBlobBaseName() const; |
| 196 | std::string getCharacteristicsBlobPath() const; |
| 197 | |
| 198 | bool hasKeyBlob() const; |
| 199 | bool hasCharacteristicsBlob() const; |
| 200 | |
| 201 | bool operator<(const KeyBlobEntry& rhs) const { |
Janis Danisevskis | 265435f | 2018-11-16 14:10:46 -0800 | [diff] [blame] | 202 | return std::tie(uid_, alias_, user_dir_) < std::tie(rhs.uid_, rhs.alias_, rhs.user_dir_); |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 203 | } |
| 204 | bool operator==(const KeyBlobEntry& rhs) const { |
Janis Danisevskis | 265435f | 2018-11-16 14:10:46 -0800 | [diff] [blame] | 205 | return std::tie(uid_, alias_, user_dir_) == std::tie(rhs.uid_, rhs.alias_, rhs.user_dir_); |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 206 | } |
| 207 | bool operator!=(const KeyBlobEntry& rhs) const { return !(*this == rhs); } |
| 208 | |
| 209 | inline const std::string& alias() const { return alias_; } |
| 210 | inline const std::string& user_dir() const { return user_dir_; } |
| 211 | inline uid_t uid() const { return uid_; } |
| 212 | }; |
| 213 | |
| 214 | /** |
| 215 | * The LockedKeyBlobEntry is a proxy object to KeyBlobEntry that expresses exclusive ownership |
| 216 | * of a KeyBlobEntry. LockedKeyBlobEntries can be acquired by calling |
| 217 | * LockedKeyBlobEntry::get() or LockedKeyBlobEntry::list(). |
| 218 | * |
| 219 | * LockedKeyBlobEntries are movable but not copyable. By convention they can only |
| 220 | * be taken by the dispatcher thread of keystore, but not by any keymaster worker thread. |
| 221 | * The dispatcher thread may transfer ownership of a locked entry to a keymaster worker thread. |
| 222 | * |
| 223 | * Locked entries are tracked on the stack or as members of movable functor objects passed to the |
| 224 | * keymaster worker request queues. Locks are relinquished as the locked entry gets destroyed, e.g., |
| 225 | * when it goes out of scope or when the owning request functor gets destroyed. |
| 226 | * |
| 227 | * LockedKeyBlobEntry::list(), which must only be called by the dispatcher, blocks until all |
| 228 | * LockedKeyBlobEntries have been destroyed. Thereby list acts as a fence to make sure it gets a |
| 229 | * consistent view of the key blob database. Under the assumption that keymaster worker requests |
| 230 | * cannot run or block indefinitely and cannot grab new locked entries, progress is guaranteed. |
| 231 | * It then grabs locked entries in accordance with the given filter rule. |
| 232 | * |
| 233 | * LockedKeyBlobEntry allow access to the proxied KeyBlobEntry interface through the operator->. |
| 234 | * They add additional functionality to access and modify the key blob's content on disk. |
| 235 | * LockedKeyBlobEntry ensures atomic operations on the persistently stored key blobs on a per |
| 236 | * entry granularity. |
| 237 | */ |
| 238 | class LockedKeyBlobEntry { |
| 239 | private: |
| 240 | static std::set<KeyBlobEntry> locked_blobs_; |
| 241 | static std::mutex locked_blobs_mutex_; |
| 242 | static std::condition_variable locked_blobs_mutex_cond_var_; |
| 243 | |
| 244 | const KeyBlobEntry* entry_; |
Chih-Hung Hsieh | 4fa39ef | 2019-01-04 13:34:17 -0800 | [diff] [blame] | 245 | // NOLINTNEXTLINE(google-explicit-constructor) |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 246 | LockedKeyBlobEntry(const KeyBlobEntry& entry) : entry_(&entry) {} |
| 247 | |
| 248 | static void put(const KeyBlobEntry& entry); |
| 249 | LockedKeyBlobEntry(const LockedKeyBlobEntry&) = delete; |
| 250 | LockedKeyBlobEntry& operator=(const LockedKeyBlobEntry&) = delete; |
| 251 | |
| 252 | public: |
| 253 | LockedKeyBlobEntry() : entry_(nullptr){}; |
| 254 | ~LockedKeyBlobEntry(); |
| 255 | LockedKeyBlobEntry(LockedKeyBlobEntry&& rhs) : entry_(rhs.entry_) { rhs.entry_ = nullptr; } |
| 256 | LockedKeyBlobEntry& operator=(LockedKeyBlobEntry&& rhs) { |
| 257 | // as dummy goes out of scope it relinquishes the lock on this |
| 258 | LockedKeyBlobEntry dummy(std::move(*this)); |
| 259 | entry_ = rhs.entry_; |
| 260 | rhs.entry_ = nullptr; |
| 261 | return *this; |
| 262 | } |
| 263 | static LockedKeyBlobEntry get(KeyBlobEntry entry); |
| 264 | static std::tuple<ResponseCode, std::list<LockedKeyBlobEntry>> |
| 265 | list(const std::string& user_dir, |
| 266 | std::function<bool(uid_t, const std::string&)> filter = |
| 267 | [](uid_t, const std::string&) -> bool { return true; }); |
| 268 | |
Branden Archer | f5953d7 | 2019-01-10 09:08:18 -0800 | [diff] [blame] | 269 | ResponseCode writeBlobs(Blob keyBlob, Blob characteristicsBlob, |
| 270 | const std::vector<uint8_t>& aes_key, State state) const; |
| 271 | std::tuple<ResponseCode, Blob, Blob> readBlobs(const std::vector<uint8_t>& aes_key, |
| 272 | State state) const; |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 273 | ResponseCode deleteBlobs() const; |
| 274 | |
Chih-Hung Hsieh | 4fa39ef | 2019-01-04 13:34:17 -0800 | [diff] [blame] | 275 | inline explicit operator bool() const { return entry_ != nullptr; } |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 276 | inline const KeyBlobEntry& operator*() const { return *entry_; } |
| 277 | inline const KeyBlobEntry* operator->() const { return entry_; } |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 278 | }; |
| 279 | |
Eran Messeri | 2ba77c3 | 2018-12-04 12:22:16 +0000 | [diff] [blame] | 280 | // Visible for testing |
| 281 | std::string encodeKeyName(const std::string& keyName); |
| 282 | std::string decodeKeyName(const std::string& encodedName); |
| 283 | |
Shawn Willden | c1d1fee | 2016-01-26 22:44:56 -0700 | [diff] [blame] | 284 | #endif // KEYSTORE_BLOB_H_ |