1 /*
2 ** Copyright 2018, The Android Open Source Project
3 **
4 ** Licensed under the Apache License, Version 2.0 (the "License");
5 ** you may not use this file except in compliance with the License.
6 ** You may obtain a copy of the License at
7 **
8 ** http://www.apache.org/licenses/LICENSE-2.0
9 **
10 ** Unless required by applicable law or agreed to in writing, software
11 ** distributed under the License is distributed on an "AS IS" BASIS,
12 ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 ** See the License for the specific language governing permissions and
14 ** limitations under the License.
15 */
17 #include <keymasterV4_0/Keymaster.h>
19 #include <iomanip>
21 #include <android-base/logging.h>
22 #include <android/hidl/manager/1.0/IServiceManager.h>
23 #include <keymasterV4_0/Keymaster3.h>
24 #include <keymasterV4_0/Keymaster4.h>
25 #include <keymasterV4_0/key_param_output.h>
26 #include <keymasterV4_0/keymaster_utils.h>
28 namespace android {
29 namespace hardware {
31 template <class T>
32 std::ostream& operator<<(std::ostream& os, const hidl_vec<T>& vec) {
33 os << "{ ";
34 if (vec.size()) {
35 for (size_t i = 0; i < vec.size() - 1; ++i) os << vec[i] << ", ";
36 os << vec[vec.size() - 1];
37 }
38 os << " }";
39 return os;
40 }
42 std::ostream& operator<<(std::ostream& os, const hidl_vec<uint8_t>& vec) {
43 std::ios_base::fmtflags flags(os.flags());
44 os << std::setw(2) << std::setfill('0') << std::hex;
45 for (uint8_t c : vec) os << static_cast<int>(c);
46 os.flags(flags);
47 return os;
48 }
50 template <size_t N>
51 std::ostream& operator<<(std::ostream& os, const hidl_array<uint8_t, N>& vec) {
52 std::ios_base::fmtflags flags(os.flags());
53 os << std::setw(2) << std::setfill('0') << std::hex;
54 for (size_t i = 0; i < N; ++i) os << static_cast<int>(vec[i]);
55 os.flags(flags);
56 return os;
57 }
59 namespace keymaster {
60 namespace V4_0 {
62 std::ostream& operator<<(std::ostream& os, const HmacSharingParameters& params) {
63 // Note that by design, although seed and nonce are used to compute a secret, they are
64 // not secrets and it's just fine to log them.
65 os << "(seed: " << params.seed << ", nonce: " << params.nonce << ')';
66 return os;
67 }
69 namespace support {
71 using ::android::sp;
72 using ::android::hidl::manager::V1_0::IServiceManager;
74 std::ostream& operator<<(std::ostream& os, const Keymaster& keymaster) {
75 auto& version = keymaster.halVersion();
76 os << version.keymasterName << " from " << version.authorName
77 << " SecurityLevel: " << toString(version.securityLevel)
78 << " HAL: " << keymaster.descriptor() << "/" << keymaster.instanceName();
79 return os;
80 }
82 template <typename Wrapper>
83 std::vector<std::unique_ptr<Keymaster>> enumerateDevices(
84 const sp<IServiceManager>& serviceManager) {
85 Keymaster::KeymasterSet result;
87 bool foundDefault = false;
88 auto& descriptor = Wrapper::WrappedIKeymasterDevice::descriptor;
89 serviceManager->listByInterface(descriptor, [&](const hidl_vec<hidl_string>& names) {
90 for (auto& name : names) {
91 if (name == "default") foundDefault = true;
92 auto device = Wrapper::WrappedIKeymasterDevice::getService(name);
93 CHECK(device) << "Failed to get service for " << descriptor << " with interface name "
94 << name;
95 result.push_back(std::unique_ptr<Keymaster>(new Wrapper(device, name)));
96 }
97 });
99 if (!foundDefault) {
100 // "default" wasn't provided by listByInterface. Maybe there's a passthrough
101 // implementation.
102 auto device = Wrapper::WrappedIKeymasterDevice::getService("default");
103 if (device) result.push_back(std::unique_ptr<Keymaster>(new Wrapper(device, "default")));
104 }
106 return result;
107 }
109 Keymaster::KeymasterSet Keymaster::enumerateAvailableDevices() {
110 auto serviceManager = IServiceManager::getService();
111 CHECK(serviceManager) << "Could not retrieve ServiceManager";
113 auto km4s = enumerateDevices<Keymaster4>(serviceManager);
114 auto km3s = enumerateDevices<Keymaster3>(serviceManager);
116 auto result = std::move(km4s);
117 result.insert(result.end(), std::make_move_iterator(km3s.begin()),
118 std::make_move_iterator(km3s.end()));
120 std::sort(result.begin(), result.end(),
121 [](auto& a, auto& b) { return a->halVersion() > b->halVersion(); });
123 size_t i = 1;
124 LOG(INFO) << "List of Keymaster HALs found:";
125 for (auto& hal : result) LOG(INFO) << "Keymaster HAL #" << i++ << ": " << *hal;
127 return result;
128 }
130 static hidl_vec<HmacSharingParameters> getHmacParameters(
131 const Keymaster::KeymasterSet& keymasters) {
132 std::vector<HmacSharingParameters> params_vec;
133 params_vec.reserve(keymasters.size());
134 for (auto& keymaster : keymasters) {
135 if (keymaster->halVersion().majorVersion < 4) continue;
136 auto rc = keymaster->getHmacSharingParameters([&](auto error, auto& params) {
137 CHECK(error == ErrorCode::OK)
138 << "Failed to get HMAC parameters from " << *keymaster << " error " << error;
139 params_vec.push_back(params);
140 });
141 CHECK(rc.isOk()) << "Failed to communicate with " << *keymaster
142 << " error: " << rc.description();
143 }
144 std::sort(params_vec.begin(), params_vec.end());
146 return params_vec;
147 }
149 static void computeHmac(const Keymaster::KeymasterSet& keymasters,
150 const hidl_vec<HmacSharingParameters>& params) {
151 if (!params.size()) return;
153 hidl_vec<uint8_t> sharingCheck;
154 bool firstKeymaster = true;
155 LOG(DEBUG) << "Computing HMAC with params " << params;
156 for (auto& keymaster : keymasters) {
157 if (keymaster->halVersion().majorVersion < 4) continue;
158 LOG(DEBUG) << "Computing HMAC for " << *keymaster;
159 auto rc = keymaster->computeSharedHmac(
160 params, [&](ErrorCode error, const hidl_vec<uint8_t>& curSharingCheck) {
161 CHECK(error == ErrorCode::OK)
162 << "Failed to get HMAC parameters from " << *keymaster << " error " << error;
163 if (firstKeymaster) {
164 sharingCheck = curSharingCheck;
165 firstKeymaster = false;
166 }
167 if (curSharingCheck != sharingCheck)
168 LOG(WARNING) << "HMAC computation failed for " << *keymaster //
169 << " Expected: " << sharingCheck //
170 << " got: " << curSharingCheck;
171 });
172 CHECK(rc.isOk()) << "Failed to communicate with " << *keymaster
173 << " error: " << rc.description();
174 }
175 }
177 void Keymaster::performHmacKeyAgreement(const KeymasterSet& keymasters) {
178 computeHmac(keymasters, getHmacParameters(keymasters));
179 }
181 } // namespace support
182 } // namespace V4_0
183 } // namespace keymaster
184 } // namespace hardware
185 } // namespace android