Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2016 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include "Keymaster.h" |
| 18 | |
| 19 | #include <android-base/logging.h> |
Shawn Willden | f452774 | 2017-11-09 15:59:39 -0700 | [diff] [blame] | 20 | |
| 21 | #include "authorization_set.h" |
| 22 | #include "keymaster_tags.h" |
| 23 | #include "keystore_hidl_support.h" |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 24 | |
| 25 | using namespace ::keystore; |
Shawn Willden | 12e72ad | 2017-03-01 06:44:15 -0700 | [diff] [blame] | 26 | using android::hardware::hidl_string; |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 27 | |
| 28 | namespace android { |
| 29 | namespace vold { |
| 30 | |
Paul Crowley | 0323afd | 2016-03-15 17:04:39 -0700 | [diff] [blame] | 31 | KeymasterOperation::~KeymasterOperation() { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 32 | if (mDevice.get()) mDevice->abort(mOpHandle); |
Paul Crowley | 0323afd | 2016-03-15 17:04:39 -0700 | [diff] [blame] | 33 | } |
| 34 | |
Pavel Grafov | e2e2d30 | 2017-08-01 17:15:53 +0100 | [diff] [blame] | 35 | bool KeymasterOperation::updateCompletely(const char* input, size_t inputLen, |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 36 | const std::function<void(const char*, size_t)> consumer) { |
Pavel Grafov | e2e2d30 | 2017-08-01 17:15:53 +0100 | [diff] [blame] | 37 | uint32_t inputConsumed = 0; |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 38 | |
| 39 | ErrorCode km_error; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 40 | auto hidlCB = [&](ErrorCode ret, uint32_t inputConsumedDelta, |
| 41 | const hidl_vec<KeyParameter>& /*ignored*/, const hidl_vec<uint8_t>& _output) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 42 | km_error = ret; |
| 43 | if (km_error != ErrorCode::OK) return; |
Pavel Grafov | e2e2d30 | 2017-08-01 17:15:53 +0100 | [diff] [blame] | 44 | inputConsumed += inputConsumedDelta; |
| 45 | consumer(reinterpret_cast<const char*>(&_output[0]), _output.size()); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 46 | }; |
| 47 | |
Pavel Grafov | e2e2d30 | 2017-08-01 17:15:53 +0100 | [diff] [blame] | 48 | while (inputConsumed != inputLen) { |
| 49 | size_t toRead = static_cast<size_t>(inputLen - inputConsumed); |
| 50 | auto inputBlob = |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 51 | blob2hidlVec(reinterpret_cast<const uint8_t*>(&input[inputConsumed]), toRead); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 52 | auto error = mDevice->update(mOpHandle, hidl_vec<KeyParameter>(), inputBlob, hidlCB); |
| 53 | if (!error.isOk()) { |
| 54 | LOG(ERROR) << "update failed: " << error.description(); |
Paul Crowley | 13ffd8e | 2016-01-27 14:30:22 +0000 | [diff] [blame] | 55 | mDevice = nullptr; |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 56 | return false; |
| 57 | } |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 58 | if (km_error != ErrorCode::OK) { |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 59 | LOG(ERROR) << "update failed, code " << int32_t(km_error); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 60 | mDevice = nullptr; |
| 61 | return false; |
| 62 | } |
Pavel Grafov | e2e2d30 | 2017-08-01 17:15:53 +0100 | [diff] [blame] | 63 | if (inputConsumed > inputLen) { |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 64 | LOG(ERROR) << "update reported too much input consumed"; |
Paul Crowley | 13ffd8e | 2016-01-27 14:30:22 +0000 | [diff] [blame] | 65 | mDevice = nullptr; |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 66 | return false; |
| 67 | } |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 68 | } |
| 69 | return true; |
| 70 | } |
| 71 | |
Paul Crowley | dff8c72 | 2016-05-16 08:14:56 -0700 | [diff] [blame] | 72 | bool KeymasterOperation::finish(std::string* output) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 73 | ErrorCode km_error; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 74 | auto hidlCb = [&](ErrorCode ret, const hidl_vec<KeyParameter>& /*ignored*/, |
| 75 | const hidl_vec<uint8_t>& _output) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 76 | km_error = ret; |
| 77 | if (km_error != ErrorCode::OK) return; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 78 | if (output) output->assign(reinterpret_cast<const char*>(&_output[0]), _output.size()); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 79 | }; |
| 80 | auto error = mDevice->finish(mOpHandle, hidl_vec<KeyParameter>(), hidl_vec<uint8_t>(), |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 81 | hidl_vec<uint8_t>(), hidlCb); |
Paul Crowley | 13ffd8e | 2016-01-27 14:30:22 +0000 | [diff] [blame] | 82 | mDevice = nullptr; |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 83 | if (!error.isOk()) { |
| 84 | LOG(ERROR) << "finish failed: " << error.description(); |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 85 | return false; |
| 86 | } |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 87 | if (km_error != ErrorCode::OK) { |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 88 | LOG(ERROR) << "finish failed, code " << int32_t(km_error); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 89 | return false; |
Paul Crowley | dff8c72 | 2016-05-16 08:14:56 -0700 | [diff] [blame] | 90 | } |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 91 | return true; |
| 92 | } |
| 93 | |
| 94 | Keymaster::Keymaster() { |
Chris Phoenix | 9e8a577 | 2017-01-25 15:15:46 -0800 | [diff] [blame] | 95 | mDevice = ::android::hardware::keymaster::V3_0::IKeymasterDevice::getService(); |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 96 | } |
| 97 | |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 98 | bool Keymaster::generateKey(const AuthorizationSet& inParams, std::string* key) { |
| 99 | ErrorCode km_error; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 100 | auto hidlCb = [&](ErrorCode ret, const hidl_vec<uint8_t>& keyBlob, |
| 101 | const KeyCharacteristics& /*ignored*/) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 102 | km_error = ret; |
| 103 | if (km_error != ErrorCode::OK) return; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 104 | if (key) key->assign(reinterpret_cast<const char*>(&keyBlob[0]), keyBlob.size()); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 105 | }; |
| 106 | |
| 107 | auto error = mDevice->generateKey(inParams.hidl_data(), hidlCb); |
| 108 | if (!error.isOk()) { |
| 109 | LOG(ERROR) << "generate_key failed: " << error.description(); |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 110 | return false; |
| 111 | } |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 112 | if (km_error != ErrorCode::OK) { |
| 113 | LOG(ERROR) << "generate_key failed, code " << int32_t(km_error); |
| 114 | return false; |
| 115 | } |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 116 | return true; |
| 117 | } |
| 118 | |
Paul Crowley | df528a7 | 2016-03-09 09:31:37 -0800 | [diff] [blame] | 119 | bool Keymaster::deleteKey(const std::string& key) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 120 | auto keyBlob = blob2hidlVec(key); |
| 121 | auto error = mDevice->deleteKey(keyBlob); |
| 122 | if (!error.isOk()) { |
| 123 | LOG(ERROR) << "delete_key failed: " << error.description(); |
| 124 | return false; |
| 125 | } |
| 126 | if (ErrorCode(error) != ErrorCode::OK) { |
| 127 | LOG(ERROR) << "delete_key failed, code " << uint32_t(ErrorCode(error)); |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 128 | return false; |
| 129 | } |
| 130 | return true; |
| 131 | } |
| 132 | |
Paul Crowley | dff8c72 | 2016-05-16 08:14:56 -0700 | [diff] [blame] | 133 | bool Keymaster::upgradeKey(const std::string& oldKey, const AuthorizationSet& inParams, |
| 134 | std::string* newKey) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 135 | auto oldKeyBlob = blob2hidlVec(oldKey); |
| 136 | ErrorCode km_error; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 137 | auto hidlCb = [&](ErrorCode ret, const hidl_vec<uint8_t>& upgradedKeyBlob) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 138 | km_error = ret; |
| 139 | if (km_error != ErrorCode::OK) return; |
| 140 | if (newKey) |
| 141 | newKey->assign(reinterpret_cast<const char*>(&upgradedKeyBlob[0]), |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 142 | upgradedKeyBlob.size()); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 143 | }; |
| 144 | auto error = mDevice->upgradeKey(oldKeyBlob, inParams.hidl_data(), hidlCb); |
| 145 | if (!error.isOk()) { |
| 146 | LOG(ERROR) << "upgrade_key failed: " << error.description(); |
Paul Crowley | dff8c72 | 2016-05-16 08:14:56 -0700 | [diff] [blame] | 147 | return false; |
| 148 | } |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 149 | if (km_error != ErrorCode::OK) { |
| 150 | LOG(ERROR) << "upgrade_key failed, code " << int32_t(km_error); |
| 151 | return false; |
| 152 | } |
Paul Crowley | dff8c72 | 2016-05-16 08:14:56 -0700 | [diff] [blame] | 153 | return true; |
| 154 | } |
| 155 | |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 156 | KeymasterOperation Keymaster::begin(KeyPurpose purpose, const std::string& key, |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 157 | const AuthorizationSet& inParams, AuthorizationSet* outParams) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 158 | auto keyBlob = blob2hidlVec(key); |
| 159 | uint64_t mOpHandle; |
| 160 | ErrorCode km_error; |
| 161 | |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 162 | auto hidlCb = [&](ErrorCode ret, const hidl_vec<KeyParameter>& _outParams, |
| 163 | uint64_t operationHandle) { |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 164 | km_error = ret; |
| 165 | if (km_error != ErrorCode::OK) return; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 166 | if (outParams) *outParams = _outParams; |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 167 | mOpHandle = operationHandle; |
| 168 | }; |
| 169 | |
| 170 | auto error = mDevice->begin(purpose, keyBlob, inParams.hidl_data(), hidlCb); |
| 171 | if (!error.isOk()) { |
| 172 | LOG(ERROR) << "begin failed: " << error.description(); |
| 173 | return KeymasterOperation(ErrorCode::UNKNOWN_ERROR); |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 174 | } |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 175 | if (km_error != ErrorCode::OK) { |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 176 | LOG(ERROR) << "begin failed, code " << int32_t(km_error); |
Janis Danisevskis | 8e537b8 | 2016-10-26 14:27:10 +0100 | [diff] [blame] | 177 | return KeymasterOperation(km_error); |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 178 | } |
Paul Crowley | 13ffd8e | 2016-01-27 14:30:22 +0000 | [diff] [blame] | 179 | return KeymasterOperation(mDevice, mOpHandle); |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 180 | } |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 181 | bool Keymaster::isSecure() { |
| 182 | bool _isSecure = false; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 183 | auto rc = |
| 184 | mDevice->getHardwareFeatures([&](bool isSecure, bool, bool, bool, bool, const hidl_string&, |
| 185 | const hidl_string&) { _isSecure = isSecure; }); |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 186 | return rc.isOk() && _isSecure; |
| 187 | } |
Paul Crowley | 1ef2558 | 2016-01-21 20:26:12 +0000 | [diff] [blame] | 188 | |
| 189 | } // namespace vold |
| 190 | } // namespace android |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 191 | |
| 192 | using namespace ::android::vold; |
| 193 | |
| 194 | int keymaster_compatibility_cryptfs_scrypt() { |
Janis Danisevskis | e7152c3 | 2017-03-08 11:02:30 -0800 | [diff] [blame] | 195 | Keymaster dev; |
| 196 | if (!dev) { |
| 197 | LOG(ERROR) << "Failed to initiate keymaster session"; |
| 198 | return -1; |
| 199 | } |
| 200 | return dev.isSecure(); |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 201 | } |
| 202 | |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 203 | static bool write_string_to_buf(const std::string& towrite, uint8_t* buffer, uint32_t buffer_size, |
| 204 | uint32_t* out_size) { |
| 205 | if (!buffer || !out_size) { |
| 206 | LOG(ERROR) << "Missing target pointers"; |
| 207 | return false; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 208 | } |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 209 | *out_size = towrite.size(); |
| 210 | if (buffer_size < towrite.size()) { |
| 211 | LOG(ERROR) << "Buffer too small " << buffer_size << " < " << towrite.size(); |
| 212 | return false; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 213 | } |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 214 | memset(buffer, '\0', buffer_size); |
| 215 | std::copy(towrite.begin(), towrite.end(), buffer); |
| 216 | return true; |
| 217 | } |
| 218 | |
| 219 | static AuthorizationSet keyParams(uint32_t rsa_key_size, uint64_t rsa_exponent, uint32_t ratelimit) { |
| 220 | return AuthorizationSetBuilder() |
| 221 | .Authorization(TAG_ALGORITHM, Algorithm::RSA) |
| 222 | .Authorization(TAG_KEY_SIZE, rsa_key_size) |
| 223 | .Authorization(TAG_RSA_PUBLIC_EXPONENT, rsa_exponent) |
| 224 | .Authorization(TAG_PURPOSE, KeyPurpose::SIGN) |
| 225 | .Authorization(TAG_PADDING, PaddingMode::NONE) |
| 226 | .Authorization(TAG_DIGEST, Digest::NONE) |
| 227 | .Authorization(TAG_BLOB_USAGE_REQUIREMENTS, KeyBlobUsageRequirements::STANDALONE) |
| 228 | .Authorization(TAG_NO_AUTH_REQUIRED) |
| 229 | .Authorization(TAG_MIN_SECONDS_BETWEEN_OPS, ratelimit); |
| 230 | } |
| 231 | |
| 232 | int keymaster_create_key_for_cryptfs_scrypt(uint32_t rsa_key_size, uint64_t rsa_exponent, |
| 233 | uint32_t ratelimit, uint8_t* key_buffer, |
| 234 | uint32_t key_buffer_size, uint32_t* key_out_size) { |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 235 | if (key_out_size) { |
| 236 | *key_out_size = 0; |
| 237 | } |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 238 | Keymaster dev; |
| 239 | if (!dev) { |
| 240 | LOG(ERROR) << "Failed to initiate keymaster session"; |
| 241 | return -1; |
| 242 | } |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 243 | std::string key; |
| 244 | if (!dev.generateKey(keyParams(rsa_key_size, rsa_exponent, ratelimit), &key)) return -1; |
| 245 | if (!write_string_to_buf(key, key_buffer, key_buffer_size, key_out_size)) return -1; |
| 246 | return 0; |
| 247 | } |
| 248 | |
| 249 | int keymaster_upgrade_key_for_cryptfs_scrypt(uint32_t rsa_key_size, uint64_t rsa_exponent, |
| 250 | uint32_t ratelimit, const uint8_t* key_blob, |
| 251 | size_t key_blob_size, uint8_t* key_buffer, |
| 252 | uint32_t key_buffer_size, uint32_t* key_out_size) { |
| 253 | if (key_out_size) { |
| 254 | *key_out_size = 0; |
| 255 | } |
| 256 | Keymaster dev; |
| 257 | if (!dev) { |
| 258 | LOG(ERROR) << "Failed to initiate keymaster session"; |
| 259 | return -1; |
| 260 | } |
| 261 | std::string old_key(reinterpret_cast<const char*>(key_blob), key_blob_size); |
| 262 | std::string new_key; |
| 263 | if (!dev.upgradeKey(old_key, keyParams(rsa_key_size, rsa_exponent, ratelimit), &new_key)) |
| 264 | return -1; |
| 265 | if (!write_string_to_buf(new_key, key_buffer, key_buffer_size, key_out_size)) return -1; |
| 266 | return 0; |
| 267 | } |
| 268 | |
| 269 | KeymasterSignResult keymaster_sign_object_for_cryptfs_scrypt( |
| 270 | const uint8_t* key_blob, size_t key_blob_size, uint32_t ratelimit, const uint8_t* object, |
| 271 | const size_t object_size, uint8_t** signature_buffer, size_t* signature_buffer_size) { |
| 272 | Keymaster dev; |
| 273 | if (!dev) { |
| 274 | LOG(ERROR) << "Failed to initiate keymaster session"; |
| 275 | return KeymasterSignResult::error; |
| 276 | } |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 277 | if (!key_blob || !object || !signature_buffer || !signature_buffer_size) { |
| 278 | LOG(ERROR) << __FILE__ << ":" << __LINE__ << ":Invalid argument"; |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 279 | return KeymasterSignResult::error; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 280 | } |
| 281 | |
| 282 | AuthorizationSet outParams; |
| 283 | std::string key(reinterpret_cast<const char*>(key_blob), key_blob_size); |
| 284 | std::string input(reinterpret_cast<const char*>(object), object_size); |
| 285 | std::string output; |
| 286 | KeymasterOperation op; |
| 287 | |
| 288 | auto paramBuilder = AuthorizationSetBuilder() |
| 289 | .Authorization(TAG_PADDING, PaddingMode::NONE) |
| 290 | .Authorization(TAG_DIGEST, Digest::NONE); |
| 291 | |
| 292 | while (true) { |
| 293 | op = dev.begin(KeyPurpose::SIGN, key, paramBuilder, &outParams); |
Wei Wang | 4375f1b | 2017-02-24 17:43:01 -0800 | [diff] [blame] | 294 | if (op.errorCode() == ErrorCode::KEY_RATE_LIMIT_EXCEEDED) { |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 295 | sleep(ratelimit); |
| 296 | continue; |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 297 | } else |
| 298 | break; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 299 | } |
| 300 | |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 301 | if (op.errorCode() == ErrorCode::KEY_REQUIRES_UPGRADE) { |
| 302 | LOG(ERROR) << "Keymaster key requires upgrade"; |
| 303 | return KeymasterSignResult::upgrade; |
| 304 | } |
| 305 | |
Wei Wang | 4375f1b | 2017-02-24 17:43:01 -0800 | [diff] [blame] | 306 | if (op.errorCode() != ErrorCode::OK) { |
| 307 | LOG(ERROR) << "Error starting keymaster signature transaction: " << int32_t(op.errorCode()); |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 308 | return KeymasterSignResult::error; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 309 | } |
| 310 | |
| 311 | if (!op.updateCompletely(input, &output)) { |
| 312 | LOG(ERROR) << "Error sending data to keymaster signature transaction: " |
Wei Wang | 4375f1b | 2017-02-24 17:43:01 -0800 | [diff] [blame] | 313 | << uint32_t(op.errorCode()); |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 314 | return KeymasterSignResult::error; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 315 | } |
| 316 | |
| 317 | if (!op.finish(&output)) { |
Shawn Willden | 785365b | 2018-01-20 09:37:36 -0700 | [diff] [blame^] | 318 | LOG(ERROR) << "Error finalizing keymaster signature transaction: " |
| 319 | << int32_t(op.errorCode()); |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 320 | return KeymasterSignResult::error; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 321 | } |
| 322 | |
| 323 | *signature_buffer = reinterpret_cast<uint8_t*>(malloc(output.size())); |
| 324 | if (*signature_buffer == nullptr) { |
| 325 | LOG(ERROR) << "Error allocation buffer for keymaster signature"; |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 326 | return KeymasterSignResult::error; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 327 | } |
| 328 | *signature_buffer_size = output.size(); |
| 329 | std::copy(output.data(), output.data() + output.size(), *signature_buffer); |
Paul Crowley | 7347333 | 2017-11-21 15:43:51 -0800 | [diff] [blame] | 330 | return KeymasterSignResult::ok; |
Janis Danisevskis | 015ec30 | 2017-01-31 11:31:08 +0000 | [diff] [blame] | 331 | } |