1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef KEYSTORE_USER_STATE_H_
18 #define KEYSTORE_USER_STATE_H_
19 
20 #include <sys/types.h>
21 
22 #include <openssl/aes.h>
23 
24 #include <utils/String8.h>
25 
26 #include <keystore/keystore.h>
27 
28 #include "blob.h"
29 #include "keystore_utils.h"
30 
31 #include <android-base/logging.h>
32 #include <condition_variable>
33 #include <keystore/keystore_concurrency.h>
34 #include <mutex>
35 #include <set>
36 #include <vector>
37 
38 namespace keystore {
39 
40 class UserState;
41 
42 template <typename UserState> using LockedUserState = ProxyLock<UnlockProxyLockHelper<UserState>>;
43 
44 class UserState {
45   public:
46     explicit UserState(uid_t userId);
47 
48     bool initialize();
49 
getUserId()50     uid_t getUserId() const { return mUserId; }
getUserDirName()51     const std::string& getUserDirName() const { return mMasterKeyEntry.user_dir(); }
52 
getMasterKeyFileName()53     std::string getMasterKeyFileName() const { return mMasterKeyEntry.getKeyBlobPath(); }
54 
55     void setState(State state);
getState()56     State getState() const { return mState; }
57 
58     void zeroizeMasterKeysInMemory();
59     bool deleteMasterKey();
60 
61     ResponseCode initialize(const android::String8& pw);
62 
63     ResponseCode copyMasterKey(LockedUserState<UserState>* src);
64     ResponseCode copyMasterKeyFile(LockedUserState<UserState>* src);
65     ResponseCode writeMasterKey(const android::String8& pw);
66     ResponseCode readMasterKey(const android::String8& pw);
67 
getEncryptionKey()68     const std::vector<uint8_t>& getEncryptionKey() const { return mMasterKey; }
69 
70     bool reset();
71 
72     bool operator<(const UserState& rhs) const;
73     bool operator<(uid_t userId) const;
74 
75   private:
76     static constexpr int SHA1_DIGEST_SIZE_BYTES = 16;
77     static constexpr int SHA256_DIGEST_SIZE_BYTES = 32;
78 
79     static constexpr int MASTER_KEY_SIZE_BYTES = kAes256KeySizeBytes;
80     static constexpr int MASTER_KEY_SIZE_BITS = MASTER_KEY_SIZE_BYTES * 8;
81 
82     static constexpr size_t SALT_SIZE = 16;
83 
84     void generateKeyFromPassword(std::vector<uint8_t>& key, const android::String8& pw,
85                                  uint8_t* salt);
86     bool generateSalt();
87     bool generateMasterKey();
88     void setupMasterKeys();
89 
90     KeyBlobEntry mMasterKeyEntry;
91 
92     uid_t mUserId;
93     State mState;
94 
95     std::vector<uint8_t> mMasterKey;
96     uint8_t mSalt[SALT_SIZE];
97 };
98 
99 bool operator<(uid_t userId, const UserState& rhs);
100 
101 class UserStateDB {
102   public:
103     LockedUserState<UserState> getUserState(uid_t userId);
104     LockedUserState<UserState> getUserStateByUid(uid_t uid);
105     LockedUserState<const UserState> getUserState(uid_t userId) const;
106     LockedUserState<const UserState> getUserStateByUid(uid_t uid) const;
107 
108   private:
109     mutable std::set<const UserState*> locked_state_;
110     mutable std::mutex locked_state_mutex_;
111     mutable std::condition_variable locked_state_mutex_cond_var_;
112 
113     template <typename UserState>
get(std::unique_lock<std::mutex> lock,UserState * entry)114     LockedUserState<UserState> get(std::unique_lock<std::mutex> lock, UserState* entry) const {
115         locked_state_mutex_cond_var_.wait(
116             lock, [&] { return locked_state_.find(entry) == locked_state_.end(); });
117         locked_state_.insert(entry);
118         return {entry, [&](UserState* entry) {
119                     std::unique_lock<std::mutex> lock(locked_state_mutex_);
120                     locked_state_.erase(entry);
121                     lock.unlock();
122                     locked_state_mutex_cond_var_.notify_all();
123                 }};
124     }
125 
126     std::map<uid_t, UserState> mMasterKeys;
127 };
128 
129 }  //  namespace keystore
130 
131 #endif  // KEYSTORE_USER_STATE_H_
132