1 /*
2  * Copyright (C) 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "RemoteGateKeeper"
18 
19 #include "remote_gatekeeper.h"
20 
21 #include <endian.h>
22 #include <limits>
23 
24 #include <android-base/logging.h>
25 #include <gatekeeper/password_handle.h>
26 #include <hardware/hw_auth_token.h>
27 
28 namespace aidl::android::hardware::gatekeeper {
29 
30 using ::gatekeeper::ERROR_INVALID;
31 using ::gatekeeper::ERROR_MEMORY_ALLOCATION_FAILED;
32 using ::gatekeeper::ERROR_NONE;
33 using ::gatekeeper::ERROR_RETRY;
34 using ::gatekeeper::ERROR_UNKNOWN;
35 using ::gatekeeper::SizedBuffer;
36 
RemoteGateKeeperDevice(cuttlefish::SharedFdGatekeeperChannel * channel)37 RemoteGateKeeperDevice::RemoteGateKeeperDevice(
38     cuttlefish::SharedFdGatekeeperChannel* channel)
39     : gatekeeper_channel_(channel), error_(0) {}
40 
~RemoteGateKeeperDevice()41 RemoteGateKeeperDevice::~RemoteGateKeeperDevice() {}
42 
vec2sized_buffer(const std::vector<uint8_t> & vec)43 SizedBuffer vec2sized_buffer(const std::vector<uint8_t>& vec) {
44     if (vec.size() == 0 || vec.size() > std::numeric_limits<uint32_t>::max()) {
45         return {};
46     }
47     auto unused = new uint8_t[vec.size()];
48     std::copy(vec.begin(), vec.end(), unused);
49     return {unused, static_cast<uint32_t>(vec.size())};
50 }
51 
sizedBuffer2AidlHWToken(SizedBuffer & buffer,android::hardware::security::keymint::HardwareAuthToken * aidlToken)52 void sizedBuffer2AidlHWToken(SizedBuffer& buffer,
53                              android::hardware::security::keymint::HardwareAuthToken* aidlToken) {
54     const hw_auth_token_t* authToken =
55         reinterpret_cast<const hw_auth_token_t*>(buffer.Data<uint8_t>());
56     aidlToken->challenge = authToken->challenge;
57     aidlToken->userId = authToken->user_id;
58     aidlToken->authenticatorId = authToken->authenticator_id;
59     // these are in network order: translate to host
60     aidlToken->authenticatorType =
61         static_cast<android::hardware::security::keymint::HardwareAuthenticatorType>(
62             be32toh(authToken->authenticator_type));
63     aidlToken->timestamp.milliSeconds = be64toh(authToken->timestamp);
64     aidlToken->mac.insert(aidlToken->mac.begin(), std::begin(authToken->hmac),
65                           std::end(authToken->hmac));
66 }
67 
68 ::ndk::ScopedAStatus
enroll(int32_t uid,const std::vector<uint8_t> & currentPasswordHandle,const std::vector<uint8_t> & currentPassword,const std::vector<uint8_t> & desiredPassword,GatekeeperEnrollResponse * rsp)69 RemoteGateKeeperDevice::enroll(int32_t uid, const std::vector<uint8_t>& currentPasswordHandle,
70                                const std::vector<uint8_t>& currentPassword,
71                                const std::vector<uint8_t>& desiredPassword,
72                                GatekeeperEnrollResponse* rsp) {
73     if (error_ != 0) {
74         LOG(ERROR) << "Gatekeeper in invalid state";
75         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
76     }
77 
78     if (desiredPassword.size() == 0) {
79         LOG(ERROR) << "Desired password size is 0";
80         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
81     }
82 
83     if (currentPasswordHandle.size() > 0) {
84         if (currentPasswordHandle.size() != sizeof(::gatekeeper::password_handle_t)) {
85             LOG(ERROR) << "Password handle has wrong length";
86             return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
87         }
88     }
89 
90     EnrollRequest request(uid, vec2sized_buffer(currentPasswordHandle),
91                           vec2sized_buffer(desiredPassword), vec2sized_buffer(currentPassword));
92     EnrollResponse response;
93     auto error = Send(request, &response);
94     if (error != ERROR_NONE) {
95         LOG(ERROR) << "Enroll request gave error: " << error;
96         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
97     } else if (response.error == ERROR_RETRY) {
98         LOG(ERROR) << "Enroll response has a retry error";
99         *rsp = {ERROR_RETRY_TIMEOUT, static_cast<int32_t>(response.retry_timeout), 0, {}};
100         return ndk::ScopedAStatus::ok();
101     } else if (response.error != ERROR_NONE) {
102         LOG(ERROR) << "Enroll response has an error: " << response.error;
103         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
104     } else {
105         const ::gatekeeper::password_handle_t* password_handle =
106             response.enrolled_password_handle.Data<::gatekeeper::password_handle_t>();
107         *rsp = {STATUS_OK,
108                 0,
109                 static_cast<int64_t>(password_handle->user_id),
110                 {response.enrolled_password_handle.Data<uint8_t>(),
111                  (response.enrolled_password_handle.Data<uint8_t>() +
112                   response.enrolled_password_handle.size())}};
113     }
114     return ndk::ScopedAStatus::ok();
115 }
116 
verify(int32_t uid,int64_t challenge,const std::vector<uint8_t> & enrolledPasswordHandle,const std::vector<uint8_t> & providedPassword,GatekeeperVerifyResponse * rsp)117 ::ndk::ScopedAStatus RemoteGateKeeperDevice::verify(
118     int32_t uid, int64_t challenge, const std::vector<uint8_t>& enrolledPasswordHandle,
119     const std::vector<uint8_t>& providedPassword, GatekeeperVerifyResponse* rsp) {
120     if (error_ != 0) {
121         LOG(ERROR) << "Gatekeeper in invalid state";
122         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
123     }
124 
125     if (enrolledPasswordHandle.size() == 0) {
126         LOG(ERROR) << "Enrolled password size is 0";
127         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
128     }
129 
130     if (enrolledPasswordHandle.size() > 0) {
131         if (enrolledPasswordHandle.size() != sizeof(::gatekeeper::password_handle_t)) {
132             LOG(ERROR) << "Password handle has wrong length";
133             return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
134         }
135     }
136 
137     VerifyRequest request(uid, challenge, vec2sized_buffer(enrolledPasswordHandle),
138                           vec2sized_buffer(providedPassword));
139     VerifyResponse response;
140 
141     auto error = Send(request, &response);
142     if (error != ERROR_NONE) {
143         LOG(ERROR) << "Verify request gave error: " << error;
144         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
145     } else if (response.error == ERROR_RETRY) {
146         LOG(ERROR) << "Verify request response gave retry error";
147         *rsp = {ERROR_RETRY_TIMEOUT, static_cast<int32_t>(response.retry_timeout), {}};
148         return ndk::ScopedAStatus::ok();
149     } else if (response.error != ERROR_NONE) {
150         LOG(ERROR) << "Verify request response gave error: " << response.error;
151         return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_GENERAL_FAILURE));
152     } else {
153         // On Success, return GatekeeperVerifyResponse with Success Status, timeout{0} and
154         // valid HardwareAuthToken.
155         *rsp = {response.request_reenroll ? STATUS_REENROLL : STATUS_OK, 0, {}};
156         // Convert the hw_auth_token_t to HardwareAuthToken in the response.
157         sizedBuffer2AidlHWToken(response.auth_token, &rsp->hardwareAuthToken);
158     }
159     return ndk::ScopedAStatus::ok();
160 }
161 
deleteUser(int32_t)162 ::ndk::ScopedAStatus RemoteGateKeeperDevice::deleteUser(int32_t /*uid*/) {
163     LOG(ERROR) << "deleteUser is unimplemented";
164     return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_NOT_IMPLEMENTED));
165 }
166 
deleteAllUsers()167 ::ndk::ScopedAStatus RemoteGateKeeperDevice::deleteAllUsers() {
168     LOG(ERROR) << "deleteAllUsers is unimplemented";
169     return ndk::ScopedAStatus(AStatus_fromServiceSpecificError(ERROR_NOT_IMPLEMENTED));
170 }
171 
Send(uint32_t command,const GateKeeperMessage & request,GateKeeperMessage * response)172 gatekeeper_error_t RemoteGateKeeperDevice::Send(uint32_t command, const GateKeeperMessage& request,
173                                                 GateKeeperMessage* response) {
174     if (!gatekeeper_channel_->SendRequest(command, request)) {
175         LOG(ERROR) << "Failed to send request";
176         return ERROR_UNKNOWN;
177     }
178     auto remote_response = gatekeeper_channel_->ReceiveMessage();
179     if (!remote_response) {
180         LOG(ERROR) << "Failed to receive response";
181         return ERROR_UNKNOWN;
182     }
183     const uint8_t* buffer = remote_response->payload;
184     const uint8_t* buffer_end = remote_response->payload + remote_response->payload_size;
185     auto rc = response->Deserialize(buffer, buffer_end);
186     if (rc != ERROR_NONE) {
187         LOG(ERROR) << "Failed to deserialize keymaster response: " << command;
188         return ERROR_UNKNOWN;
189     }
190     return rc;
191 }
192 
193 };  // namespace aidl::android::hardware::gatekeeper
194