1 /*
2  * Copyright (C) 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef TRUSTY_GATEKEEPER_H
18 #define TRUSTY_GATEKEEPER_H
19 
20 #include <memory>
21 
22 #include <aidl/android/hardware/gatekeeper/BnGatekeeper.h>
23 
24 #include <gatekeeper/gatekeeper_messages.h>
25 
26 #include "gatekeeper_ipc.h"
27 
28 namespace aidl::android::hardware::gatekeeper {
29 
30 using aidl::android::hardware::gatekeeper::GatekeeperEnrollResponse;
31 using aidl::android::hardware::gatekeeper::GatekeeperVerifyResponse;
32 using ::gatekeeper::DeleteAllUsersRequest;
33 using ::gatekeeper::DeleteAllUsersResponse;
34 using ::gatekeeper::DeleteUserRequest;
35 using ::gatekeeper::DeleteUserResponse;
36 using ::gatekeeper::EnrollRequest;
37 using ::gatekeeper::EnrollResponse;
38 using ::gatekeeper::gatekeeper_error_t;
39 using ::gatekeeper::GateKeeperMessage;
40 using ::gatekeeper::VerifyRequest;
41 using ::gatekeeper::VerifyResponse;
42 
43 class TrustyGateKeeperDevice : public BnGatekeeper {
44   public:
45     explicit TrustyGateKeeperDevice();
46     ~TrustyGateKeeperDevice();
47     /**
48      * Enrolls password_payload, which should be derived from a user selected pin or password,
49      * with the authentication factor private key used only for enrolling authentication
50      * factor data.
51      *
52      * Returns: 0 on success or an error code less than 0 on error.
53      * On error, enrolled_password_handle will not be allocated.
54      */
55     ::ndk::ScopedAStatus enroll(int32_t uid, const std::vector<uint8_t>& currentPasswordHandle,
56                                 const std::vector<uint8_t>& currentPassword,
57                                 const std::vector<uint8_t>& desiredPassword,
58                                 GatekeeperEnrollResponse* _aidl_return) override;
59 
60     /**
61      * Verifies provided_password matches enrolled_password_handle.
62      *
63      * Implementations of this module may retain the result of this call
64      * to attest to the recency of authentication.
65      *
66      * On success, writes the address of a verification token to auth_token,
67      * usable to attest password verification to other trusted services. Clients
68      * may pass NULL for this value.
69      *
70      * Returns: 0 on success or an error code less than 0 on error
71      * On error, verification token will not be allocated
72      */
73     ::ndk::ScopedAStatus verify(int32_t uid, int64_t challenge,
74                                 const std::vector<uint8_t>& enrolledPasswordHandle,
75                                 const std::vector<uint8_t>& providedPassword,
76                                 GatekeeperVerifyResponse* _aidl_return) override;
77 
78     ::ndk::ScopedAStatus deleteAllUsers() override;
79 
80     ::ndk::ScopedAStatus deleteUser(int32_t uid) override;
81 
82   private:
83     gatekeeper_error_t Send(uint32_t command, const GateKeeperMessage& request,
84                            GateKeeperMessage* response);
85 
Send(const EnrollRequest & request,EnrollResponse * response)86     gatekeeper_error_t Send(const EnrollRequest& request, EnrollResponse* response) {
87         return Send(GK_ENROLL, request, response);
88     }
89 
Send(const VerifyRequest & request,VerifyResponse * response)90     gatekeeper_error_t Send(const VerifyRequest& request, VerifyResponse* response) {
91         return Send(GK_VERIFY, request, response);
92     }
93 
Send(const DeleteUserRequest & request,DeleteUserResponse * response)94     gatekeeper_error_t Send(const DeleteUserRequest& request, DeleteUserResponse* response) {
95         return Send(GK_DELETE_USER, request, response);
96     }
97 
Send(const DeleteAllUsersRequest & request,DeleteAllUsersResponse * response)98     gatekeeper_error_t Send(const DeleteAllUsersRequest& request,
99                             DeleteAllUsersResponse* response) {
100         return Send(GK_DELETE_ALL_USERS, request, response);
101     }
102 
103     int error_;
104 };
105 
106 }  // namespace aidl::android::hardware::gatekeeper
107 
108 #endif
109