1 /*
2  * Copyright (C) 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <memory>
18 #include <vector>
19 
20 #include <hardware/hw_auth_token.h>
21 #include <keystore/authorization_set.h>
22 
23 #ifndef KEYSTORE_AUTH_TOKEN_TABLE_H_
24 #define KEYSTORE_AUTH_TOKEN_TABLE_H_
25 
26 namespace keystore {
27 
28 using android::hardware::keymaster::V3_0::HardwareAuthToken;
29 
30 namespace test {
31 class AuthTokenTableTest;
32 }  // namespace test
33 
34 time_t clock_gettime_raw();
35 
36 /**
37  * AuthTokenTable manages a set of received authorization tokens and can provide the appropriate
38  * token for authorizing a key operation.
39  *
40  * To keep the table from growing without bound, superseded entries are removed when possible, and
41  * least recently used entries are automatically pruned when when the table exceeds a size limit,
42  * which is expected to be relatively small, since the implementation uses a linear search.
43  */
44 class AuthTokenTable {
45   public:
46     explicit AuthTokenTable(size_t max_entries = 32, time_t (*clock_function)() = clock_gettime_raw)
max_entries_(max_entries)47         : max_entries_(max_entries), last_off_body_(clock_function()),
48           clock_function_(clock_function) {}
49 
50     enum Error {
51         OK,
52         AUTH_NOT_REQUIRED = -1,
53         AUTH_TOKEN_EXPIRED = -2,    // Found a matching token, but it's too old.
54         AUTH_TOKEN_WRONG_SID = -3,  // Found a token with the right challenge, but wrong SID.  This
55                                     // most likely indicates that the authenticator was updated
56                                     // (e.g. new fingerprint enrolled).
57         OP_HANDLE_REQUIRED = -4,    // The key requires auth per use but op_handle was zero.
58         AUTH_TOKEN_NOT_FOUND = -5,
59     };
60 
61     /**
62      * Add an authorization token to the table.  The table takes ownership of the argument.
63      */
64     void AddAuthenticationToken(const HardwareAuthToken* token);
65 
66     /**
67      * Find an authorization token that authorizes the operation specified by \p operation_handle on
68      * a key with the characteristics specified in \p key_info.
69      *
70      * This method is O(n * m), where n is the number of KM_TAG_USER_SECURE_ID entries in key_info
71      * and m is the number of entries in the table.  It could be made better, but n and m should
72      * always be small.
73      *
74      * The table retains ownership of the returned object.
75      */
76     Error FindAuthorization(const AuthorizationSet& key_info, KeyPurpose purpose,
77                             uint64_t op_handle, const HardwareAuthToken** found);
78 
79     /**
80      * Mark operation completed.  This allows tokens associated with the specified operation to be
81      * superseded by new tokens.
82      */
83     void MarkCompleted(const uint64_t op_handle);
84 
85     /**
86      * Update the last_off_body_ timestamp so that tokens which remain authorized only so long as
87      * the device stays on body can be revoked.
88      */
89     void onDeviceOffBody();
90 
91     void Clear();
92 
size()93     size_t size() { return entries_.size(); }
94 
95   private:
96     friend class AuthTokenTableTest;
97 
98     class Entry {
99       public:
100         Entry(const HardwareAuthToken* token, time_t current_time);
Entry(Entry && entry)101         Entry(Entry&& entry) { *this = std::move(entry); }
102 
103         void operator=(Entry&& rhs) {
104             token_ = std::move(rhs.token_);
105             time_received_ = rhs.time_received_;
106             last_use_ = rhs.last_use_;
107             operation_completed_ = rhs.operation_completed_;
108         }
109 
110         bool operator<(const Entry& rhs) const { return last_use_ < rhs.last_use_; }
111 
112         void UpdateLastUse(time_t time);
113 
114         bool Supersedes(const Entry& entry) const;
115         bool SatisfiesAuth(const std::vector<uint64_t>& sids, HardwareAuthenticatorType auth_type);
116 
is_newer_than(const Entry * entry)117         bool is_newer_than(const Entry* entry) {
118             if (!entry) return true;
119             return timestamp_host_order() > entry->timestamp_host_order();
120         }
121 
mark_completed()122         void mark_completed() { operation_completed_ = true; }
123 
token()124         const HardwareAuthToken* token() { return token_.get(); }
time_received()125         time_t time_received() const { return time_received_; }
completed()126         bool completed() const { return operation_completed_; }
127         uint32_t timestamp_host_order() const;
128         HardwareAuthenticatorType authenticator_type() const;
129 
130       private:
131         std::unique_ptr<const HardwareAuthToken> token_;
132         time_t time_received_;
133         time_t last_use_;
134         bool operation_completed_;
135     };
136 
137     Error FindAuthPerOpAuthorization(const std::vector<uint64_t>& sids,
138                                      HardwareAuthenticatorType auth_type, uint64_t op_handle,
139                                      const HardwareAuthToken** found);
140     Error FindTimedAuthorization(const std::vector<uint64_t>& sids,
141                                  HardwareAuthenticatorType auth_type,
142                                  const AuthorizationSet& key_info, const HardwareAuthToken** found);
143     void ExtractSids(const AuthorizationSet& key_info, std::vector<uint64_t>* sids);
144     void RemoveEntriesSupersededBy(const Entry& entry);
145     bool IsSupersededBySomeEntry(const Entry& entry);
146 
147     std::vector<Entry> entries_;
148     size_t max_entries_;
149     time_t last_off_body_;
150     time_t (*clock_function_)();
151 };
152 
153 }  // namespace keymaster
154 
155 #endif  // KEYSTORE_AUTH_TOKEN_TABLE_H_
156