1 /*
2  * Copyright 2020, The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *     http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "android.hardware.security.keymint-impl"
18 #include <android-base/logging.h>
19 
20 #include "KeyMintUtils.h"
21 
22 namespace aidl::android::hardware::security::keymint::km_utils {
23 
24 namespace {
25 
26 using keymaster::hton;
27 
kmEnumParam2Aidl(const keymaster_key_param_t & param)28 KeyParameter kmEnumParam2Aidl(const keymaster_key_param_t& param) {
29     switch (param.tag) {
30     case KM_TAG_PURPOSE:
31         return KeyParameter{Tag::PURPOSE, KeyParameterValue::make<KeyParameterValue::keyPurpose>(
32                                               static_cast<KeyPurpose>(param.enumerated))};
33     case KM_TAG_ALGORITHM:
34         return KeyParameter{Tag::ALGORITHM, KeyParameterValue::make<KeyParameterValue::algorithm>(
35                                                 static_cast<Algorithm>(param.enumerated))};
36     case KM_TAG_BLOCK_MODE:
37         return KeyParameter{Tag::BLOCK_MODE, KeyParameterValue::make<KeyParameterValue::blockMode>(
38                                                  static_cast<BlockMode>(param.enumerated))};
39     case KM_TAG_DIGEST:
40         return KeyParameter{Tag::DIGEST, KeyParameterValue::make<KeyParameterValue::digest>(
41                                              static_cast<Digest>(param.enumerated))};
42     case KM_TAG_PADDING:
43         return KeyParameter{Tag::PADDING, KeyParameterValue::make<KeyParameterValue::paddingMode>(
44                                               static_cast<PaddingMode>(param.enumerated))};
45     case KM_TAG_EC_CURVE:
46         return KeyParameter{Tag::EC_CURVE, KeyParameterValue::make<KeyParameterValue::ecCurve>(
47                                                static_cast<EcCurve>(param.enumerated))};
48     case KM_TAG_USER_AUTH_TYPE:
49         return KeyParameter{Tag::USER_AUTH_TYPE,
50                             KeyParameterValue::make<KeyParameterValue::hardwareAuthenticatorType>(
51                                 static_cast<HardwareAuthenticatorType>(param.enumerated))};
52     case KM_TAG_ORIGIN:
53         return KeyParameter{Tag::ORIGIN, KeyParameterValue::make<KeyParameterValue::origin>(
54                                              static_cast<KeyOrigin>(param.enumerated))};
55     case KM_TAG_BLOB_USAGE_REQUIREMENTS:
56     case KM_TAG_KDF:
57     default:
58         return KeyParameter{Tag::INVALID, false};
59     }
60 }
61 
62 keymaster_key_param_t kInvalidTag{.tag = KM_TAG_INVALID, .integer = 0};
63 
64 template <KeyParameterValue::Tag aidl_tag>
aidlEnumVal2Km(keymaster_tag_t km_tag,const KeyParameterValue & value)65 keymaster_key_param_t aidlEnumVal2Km(keymaster_tag_t km_tag, const KeyParameterValue& value) {
66     return value.getTag() == aidl_tag
67                ? keymaster_param_enum(km_tag, static_cast<uint32_t>(value.get<aidl_tag>()))
68                : kInvalidTag;
69 }
70 
aidlEnumParam2Km(const KeyParameter & param)71 keymaster_key_param_t aidlEnumParam2Km(const KeyParameter& param) {
72     auto tag = km_utils::legacy_enum_conversion(param.tag);
73     switch (tag) {
74     case KM_TAG_PURPOSE:
75         return aidlEnumVal2Km<KeyParameterValue::keyPurpose>(tag, param.value);
76     case KM_TAG_ALGORITHM:
77         return aidlEnumVal2Km<KeyParameterValue::algorithm>(tag, param.value);
78     case KM_TAG_BLOCK_MODE:
79         return aidlEnumVal2Km<KeyParameterValue::blockMode>(tag, param.value);
80     case KM_TAG_DIGEST:
81     case KM_TAG_RSA_OAEP_MGF_DIGEST:
82         return aidlEnumVal2Km<KeyParameterValue::digest>(tag, param.value);
83     case KM_TAG_PADDING:
84         return aidlEnumVal2Km<KeyParameterValue::paddingMode>(tag, param.value);
85     case KM_TAG_EC_CURVE:
86         return aidlEnumVal2Km<KeyParameterValue::ecCurve>(tag, param.value);
87     case KM_TAG_USER_AUTH_TYPE:
88         return aidlEnumVal2Km<KeyParameterValue::hardwareAuthenticatorType>(tag, param.value);
89     case KM_TAG_ORIGIN:
90         return aidlEnumVal2Km<KeyParameterValue::origin>(tag, param.value);
91     case KM_TAG_BLOB_USAGE_REQUIREMENTS:
92     case KM_TAG_KDF:
93     default:
94         CHECK(false) << "Unknown or unused enum tag: Something is broken";
95         return keymaster_param_enum(tag, false);
96     }
97 }
98 
99 }  // namespace
100 
authToken2AidlVec(const std::optional<HardwareAuthToken> & token)101 vector<uint8_t> authToken2AidlVec(const std::optional<HardwareAuthToken>& token) {
102     static_assert(1 /* version size */ + sizeof(token->challenge) + sizeof(token->userId) +
103                           sizeof(token->authenticatorId) + sizeof(token->authenticatorType) +
104                           sizeof(token->timestamp) + 32 /* HMAC size */
105                       == sizeof(hw_auth_token_t),
106                   "HardwareAuthToken content size does not match hw_auth_token_t size");
107 
108     vector<uint8_t> result;
109 
110     if (!token.has_value()) return result;
111     if (token->mac.size() < 32) return result;
112 
113     result.resize(sizeof(hw_auth_token_t));
114     auto pos = result.begin();
115     *pos++ = 0;  // Version byte
116     pos = copy_bytes_to_iterator(token->challenge, pos);
117     pos = copy_bytes_to_iterator(token->userId, pos);
118     pos = copy_bytes_to_iterator(token->authenticatorId, pos);
119     pos = copy_bytes_to_iterator(hton(static_cast<uint32_t>(token->authenticatorType)), pos);
120     pos = copy_bytes_to_iterator(hton(token->timestamp.milliSeconds), pos);
121     pos = std::copy(token->mac.data(), token->mac.data() + token->mac.size(), pos);
122 
123     return result;
124 }
125 
kmParam2Aidl(const keymaster_key_param_t & param)126 KeyParameter kmParam2Aidl(const keymaster_key_param_t& param) {
127     auto tag = legacy_enum_conversion(param.tag);
128     switch (typeFromTag(param.tag)) {
129     case KM_ENUM:
130     case KM_ENUM_REP:
131         return kmEnumParam2Aidl(param);
132         break;
133 
134     case KM_UINT:
135     case KM_UINT_REP:
136         return KeyParameter{tag,
137                             KeyParameterValue::make<KeyParameterValue::integer>(param.integer)};
138 
139     case KM_ULONG:
140     case KM_ULONG_REP:
141         return KeyParameter{
142             tag, KeyParameterValue::make<KeyParameterValue::longInteger>(param.long_integer)};
143         break;
144 
145     case KM_DATE:
146         return KeyParameter{tag,
147                             KeyParameterValue::make<KeyParameterValue::dateTime>(param.date_time)};
148         break;
149 
150     case KM_BOOL:
151         return KeyParameter{tag, param.boolean};
152         break;
153 
154     case KM_BIGNUM:
155     case KM_BYTES:
156         return {tag, KeyParameterValue::make<KeyParameterValue::blob>(
157                          std::vector(param.blob.data, param.blob.data + param.blob.data_length))};
158         break;
159 
160     case KM_INVALID:
161     default:
162         CHECK(false) << "Unknown or unused tag type: Something is broken";
163         return KeyParameter{Tag::INVALID, false};
164         break;
165     }
166 }
167 
kmParamSet2Aidl(const keymaster_key_param_set_t & set)168 vector<KeyParameter> kmParamSet2Aidl(const keymaster_key_param_set_t& set) {
169     vector<KeyParameter> result;
170     if (set.length == 0 || set.params == nullptr) return result;
171 
172     result.reserve(set.length);
173     for (size_t i = 0; i < set.length; ++i) {
174         result.push_back(kmParam2Aidl(set.params[i]));
175     }
176     return result;
177 }
178 
aidlKeyParams2Km(const vector<KeyParameter> & keyParams)179 keymaster_key_param_set_t aidlKeyParams2Km(const vector<KeyParameter>& keyParams) {
180     keymaster_key_param_set_t set;
181 
182     set.params = static_cast<keymaster_key_param_t*>(
183         malloc(keyParams.size() * sizeof(keymaster_key_param_t)));
184     set.length = keyParams.size();
185 
186     for (size_t i = 0; i < keyParams.size(); ++i) {
187         const auto& param = keyParams[i];
188         auto tag = legacy_enum_conversion(param.tag);
189         switch (typeFromTag(tag)) {
190 
191         case KM_ENUM:
192         case KM_ENUM_REP:
193             set.params[i] = aidlEnumParam2Km(param);
194             break;
195 
196         case KM_UINT:
197         case KM_UINT_REP:
198             set.params[i] =
199                 param.value.getTag() == KeyParameterValue::integer
200                     ? keymaster_param_int(tag, param.value.get<KeyParameterValue::integer>())
201                     : kInvalidTag;
202             break;
203 
204         case KM_ULONG:
205         case KM_ULONG_REP:
206             set.params[i] =
207                 param.value.getTag() == KeyParameterValue::longInteger
208                     ? keymaster_param_long(tag, param.value.get<KeyParameterValue::longInteger>())
209                     : kInvalidTag;
210             break;
211 
212         case KM_DATE:
213             set.params[i] =
214                 param.value.getTag() == KeyParameterValue::dateTime
215                     ? keymaster_param_date(tag, param.value.get<KeyParameterValue::dateTime>())
216                     : kInvalidTag;
217             break;
218 
219         case KM_BOOL:
220             set.params[i] = keymaster_param_bool(tag);
221             break;
222 
223         case KM_BIGNUM:
224         case KM_BYTES:
225             if (param.value.getTag() == KeyParameterValue::blob) {
226                 const auto& value = param.value.get<KeyParameterValue::blob>();
227                 uint8_t* copy = static_cast<uint8_t*>(malloc(value.size()));
228                 std::copy(value.begin(), value.end(), copy);
229                 set.params[i] = keymaster_param_blob(tag, copy, value.size());
230             } else {
231                 set.params[i] = kInvalidTag;
232             }
233             break;
234 
235         case KM_INVALID:
236         default:
237             CHECK(false) << "Invalid tag: Something is broken";
238             set.params[i].tag = KM_TAG_INVALID;
239             /* just skip */
240             break;
241         }
242     }
243 
244     return set;
245 }
246 
247 }  // namespace aidl::android::hardware::security::keymint::km_utils
248