1 /*
2  * Copyright 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef SYSTEM_KEYMASTER_PURE_SOFT_KEYMASTER_CONTEXT_H_
18 #define SYSTEM_KEYMASTER_PURE_SOFT_KEYMASTER_CONTEXT_H_
19 
20 
21 #include <memory>
22 #include <string>
23 
24 #include <keymaster/keymaster_context.h>
25 #include <keymaster/attestation_record.h>
26 #include <keymaster/km_openssl/software_random_source.h>
27 #include <keymaster/km_openssl/soft_keymaster_enforcement.h>
28 #include <keymaster/soft_key_factory.h>
29 #include <keymaster/random_source.h>
30 
31 namespace keymaster {
32 
33 class SoftKeymasterKeyRegistrations;
34 class Keymaster0Engine;
35 class Keymaster1Engine;
36 class Key;
37 
38 /**
39  * SoftKeymasterContext provides the context for a non-secure implementation of AndroidKeymaster.
40  */
41 class PureSoftKeymasterContext : public KeymasterContext,
42                                  protected SoftwareKeyBlobMaker,
43                                  public AttestationRecordContext,
44                                  SoftwareRandomSource {
45   public:
46     // Security level must only be used for testing.
47     explicit PureSoftKeymasterContext(
48         keymaster_security_level_t security_level = KM_SECURITY_LEVEL_SOFTWARE);
49     ~PureSoftKeymasterContext() override;
50 
51     /*********************************************************************************************
52      * Implement KeymasterContext
53      */
54     keymaster_error_t SetSystemVersion(uint32_t os_version, uint32_t os_patchlevel) override;
55     void GetSystemVersion(uint32_t* os_version, uint32_t* os_patchlevel) const override;
56 
57     KeyFactory* GetKeyFactory(keymaster_algorithm_t algorithm) const override;
58     OperationFactory* GetOperationFactory(keymaster_algorithm_t algorithm,
59                                           keymaster_purpose_t purpose) const override;
60     keymaster_algorithm_t* GetSupportedAlgorithms(size_t* algorithms_count) const override;
61     keymaster_error_t UpgradeKeyBlob(const KeymasterKeyBlob& key_to_upgrade,
62                                      const AuthorizationSet& upgrade_params,
63                                      KeymasterKeyBlob* upgraded_key) const override;
64     keymaster_error_t ParseKeyBlob(const KeymasterKeyBlob& blob,
65                                    const AuthorizationSet& additional_params,
66                                    UniquePtr<Key>* key) const override;
67     keymaster_error_t DeleteKey(const KeymasterKeyBlob& blob) const override;
68     keymaster_error_t DeleteAllKeys() const override;
69     keymaster_error_t AddRngEntropy(const uint8_t* buf, size_t length) const override;
70 
71     keymaster_error_t GenerateAttestation(const Key& key,
72                                           const AuthorizationSet& attest_params,
73                                           CertChainPtr* cert_chain) const override;
74 
75 
enforcement_policy()76     KeymasterEnforcement* enforcement_policy() override {
77         // SoftKeymaster does no enforcement; it's all done by Keystore.
78         return &soft_keymaster_enforcement_;
79     }
80 
81     /*********************************************************************************************
82      * Implement SoftwareKeyBlobMaker
83      */
84     keymaster_error_t CreateKeyBlob(const AuthorizationSet& auths, keymaster_key_origin_t origin,
85                                     const KeymasterKeyBlob& key_material, KeymasterKeyBlob* blob,
86                                     AuthorizationSet* hw_enforced,
87                                     AuthorizationSet* sw_enforced) const override;
88 
89     keymaster_error_t
90     UnwrapKey(const KeymasterKeyBlob& wrapped_key_blob, const KeymasterKeyBlob& wrapping_key_blob,
91               const AuthorizationSet& wrapping_key_params, const KeymasterKeyBlob& masking_key,
92               AuthorizationSet* wrapped_key_params, keymaster_key_format_t* wrapped_key_format,
93               KeymasterKeyBlob* wrapped_key_material) const override;
94 
95     /*********************************************************************************************
96      * Implement AttestationRecordContext
97      */
98 
99     keymaster_error_t GetVerifiedBootParams(keymaster_blob_t* verified_boot_key,
100                                             keymaster_blob_t* verified_boot_hash,
101                                             keymaster_verified_boot_t* verified_boot_state,
102                                             bool* device_locked) const override;
103 
GetSecurityLevel()104     keymaster_security_level_t GetSecurityLevel() const override { return security_level_; }
105 
106   protected:
107     std::unique_ptr<KeyFactory> rsa_factory_;
108     std::unique_ptr<KeyFactory> ec_factory_;
109     std::unique_ptr<KeyFactory> aes_factory_;
110     std::unique_ptr<KeyFactory> tdes_factory_;
111     std::unique_ptr<KeyFactory> hmac_factory_;
112     uint32_t os_version_;
113     uint32_t os_patchlevel_;
114     SoftKeymasterEnforcement soft_keymaster_enforcement_;
115     keymaster_security_level_t security_level_;
116 };
117 
118 }  // namespace keymaster
119 
120 #endif  // SYSTEM_KEYMASTER_PURE_SOFT_KEYMASTER_CONTEXT_H_
121