1 //
2 // Copyright (C) 2020 The Android Open Source Project
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 
16 #pragma once
17 
18 #include <keymaster/keymaster_enforcement.h>
19 
20 #include "host/commands/secure_env/tpm_gatekeeper.h"
21 #include "host/commands/secure_env/tpm_resource_manager.h"
22 
23 namespace cuttlefish {
24 
25 /**
26  * Implementation of keymaster::KeymasterEnforcement that depends on having a
27  * TPM available. See the definitions in
28  * system/keymaster/include/keymaster/keymaster_enforcement.h
29  */
30 class TpmKeymasterEnforcement : public keymaster::KeymasterEnforcement {
31  public:
32   TpmKeymasterEnforcement(TpmResourceManager& resource_manager,
33                           TpmGatekeeper& gatekeeper);
34   ~TpmKeymasterEnforcement();
35 
36   bool activation_date_valid(uint64_t activation_date) const override;
37   bool expiration_date_passed(uint64_t expiration_date) const override;
38   bool auth_token_timed_out(const hw_auth_token_t& token,
39                             uint32_t timeout) const override;
40   uint64_t get_current_time_ms() const override;
41 
42   keymaster_security_level_t SecurityLevel() const override;
43   bool ValidateTokenSignature(const hw_auth_token_t& token) const override;
44 
45   keymaster_error_t GetHmacSharingParameters(
46       keymaster::HmacSharingParameters* params) override;
47   keymaster_error_t ComputeSharedHmac(
48       const keymaster::HmacSharingParametersArray& params_array,
49       keymaster::KeymasterBlob* sharingCheck) override;
50 
51   keymaster::VerifyAuthorizationResponse VerifyAuthorization(
52       const keymaster::VerifyAuthorizationRequest& request) override;
53 
54   keymaster_error_t GenerateTimestampToken(
55       keymaster::TimestampToken* token) override;
56 
57   keymaster::KmErrorOr<std::array<uint8_t, 32>> ComputeHmac(
58       const std::vector<uint8_t>& data_to_mac) const override;
59 
60   bool CreateKeyId(const keymaster_key_blob_t& key_blob,
61                    keymaster::km_id_t* keyid) const override;
62 
63  private:
64   TpmResourceManager& resource_manager_;
65   TpmGatekeeper& gatekeeper_;
66   bool have_saved_params_ = false;
67   keymaster::HmacSharingParameters saved_params_;
68 };
69 
70 }  // namespace cuttlefish
71