Home | History | Annotate | Download | only in keystore 
      1 /*
      2  * Copyright (C) 2012 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #ifndef KEYSTORE_IKEYSTORESERVICE_H
     18 #define KEYSTORE_IKEYSTORESERVICE_H
     19 
     20 #include <hardware/keymaster_defs.h>
     21 #include <utils/RefBase.h>
     22 #include <binder/IInterface.h>
     23 #include <binder/Parcel.h>
     24 #include <vector>
     25 
     26 namespace android {
     27 
     28 class KeystoreArg : public RefBase {
     29 public:
     30     KeystoreArg(const void *data, size_t len);
     31     ~KeystoreArg();
     32 
     33     const void* data() const;
     34     size_t size() const;
     35 
     36 private:
     37     const void* mData;
     38     size_t mSize;
     39 };
     40 
     41 struct MallocDeleter {
     42     void operator()(uint8_t* p) { free(p); }
     43 };
     44 
     45 // struct for serializing/deserializing a list of keymaster_key_param_t's
     46 struct KeymasterArguments {
     47     KeymasterArguments();
     48     ~KeymasterArguments();
     49     void readFromParcel(const Parcel& in);
     50     void writeToParcel(Parcel* out) const;
     51 
     52     std::vector<keymaster_key_param_t> params;
     53 };
     54 
     55 // struct for serializing the results of begin/update/finish
     56 struct OperationResult {
     57     OperationResult();
     58     ~OperationResult();
     59     void readFromParcel(const Parcel& in);
     60     void writeToParcel(Parcel* out) const;
     61 
     62     int resultCode;
     63     sp<IBinder> token;
     64     keymaster_operation_handle_t handle;
     65     int inputConsumed;
     66     std::unique_ptr<uint8_t[], MallocDeleter> data;
     67     size_t dataLength;
     68     KeymasterArguments outParams;
     69 };
     70 
     71 // struct for serializing the results of export
     72 struct ExportResult {
     73     ExportResult();
     74     ~ExportResult();
     75     void readFromParcel(const Parcel& in);
     76     void writeToParcel(Parcel* out) const;
     77 
     78     int resultCode;
     79     std::unique_ptr<uint8_t[], MallocDeleter> exportData;
     80     size_t dataLength;
     81 };
     82 
     83 // struct for serializing keymaster_key_characteristics_t's
     84 struct KeyCharacteristics {
     85     KeyCharacteristics();
     86     ~KeyCharacteristics();
     87     void readFromParcel(const Parcel& in);
     88     void writeToParcel(Parcel* out) const;
     89 
     90     keymaster_key_characteristics_t characteristics;
     91 };
     92 
     93 bool readKeymasterArgumentFromParcel(const Parcel& in, keymaster_key_param_t* out);
     94 void writeKeymasterArgumentToParcel(const keymaster_key_param_t& param, Parcel* out);
     95 
     96 /*
     97  * This must be kept manually in sync with frameworks/base's IKeystoreService.java
     98  */
     99 class IKeystoreService: public IInterface {
    100 public:
    101     enum {
    102         GET_STATE = IBinder::FIRST_CALL_TRANSACTION + 0,
    103         GET = IBinder::FIRST_CALL_TRANSACTION + 1,
    104         INSERT = IBinder::FIRST_CALL_TRANSACTION + 2,
    105         DEL = IBinder::FIRST_CALL_TRANSACTION + 3,
    106         EXIST = IBinder::FIRST_CALL_TRANSACTION + 4,
    107         LIST = IBinder::FIRST_CALL_TRANSACTION + 5,
    108         RESET = IBinder::FIRST_CALL_TRANSACTION + 6,
    109         ON_USER_PASSWORD_CHANGED = IBinder::FIRST_CALL_TRANSACTION + 7,
    110         LOCK = IBinder::FIRST_CALL_TRANSACTION + 8,
    111         UNLOCK = IBinder::FIRST_CALL_TRANSACTION + 9,
    112         IS_EMPTY = IBinder::FIRST_CALL_TRANSACTION + 10,
    113         GENERATE = IBinder::FIRST_CALL_TRANSACTION + 11,
    114         IMPORT = IBinder::FIRST_CALL_TRANSACTION + 12,
    115         SIGN = IBinder::FIRST_CALL_TRANSACTION + 13,
    116         VERIFY = IBinder::FIRST_CALL_TRANSACTION + 14,
    117         GET_PUBKEY = IBinder::FIRST_CALL_TRANSACTION + 15,
    118         GRANT = IBinder::FIRST_CALL_TRANSACTION + 16,
    119         UNGRANT = IBinder::FIRST_CALL_TRANSACTION + 17,
    120         GETMTIME = IBinder::FIRST_CALL_TRANSACTION + 18,
    121         DUPLICATE = IBinder::FIRST_CALL_TRANSACTION + 19,
    122         IS_HARDWARE_BACKED = IBinder::FIRST_CALL_TRANSACTION + 20,
    123         CLEAR_UID = IBinder::FIRST_CALL_TRANSACTION + 21,
    124         ADD_RNG_ENTROPY = IBinder::FIRST_CALL_TRANSACTION + 22,
    125         GENERATE_KEY = IBinder::FIRST_CALL_TRANSACTION + 23,
    126         GET_KEY_CHARACTERISTICS = IBinder::FIRST_CALL_TRANSACTION + 24,
    127         IMPORT_KEY = IBinder::FIRST_CALL_TRANSACTION + 25,
    128         EXPORT_KEY = IBinder::FIRST_CALL_TRANSACTION + 26,
    129         BEGIN = IBinder::FIRST_CALL_TRANSACTION + 27,
    130         UPDATE = IBinder::FIRST_CALL_TRANSACTION + 28,
    131         FINISH = IBinder::FIRST_CALL_TRANSACTION + 29,
    132         ABORT = IBinder::FIRST_CALL_TRANSACTION + 30,
    133         IS_OPERATION_AUTHORIZED = IBinder::FIRST_CALL_TRANSACTION + 31,
    134         ADD_AUTH_TOKEN = IBinder::FIRST_CALL_TRANSACTION + 32,
    135         ON_USER_ADDED = IBinder::FIRST_CALL_TRANSACTION + 33,
    136         ON_USER_REMOVED = IBinder::FIRST_CALL_TRANSACTION + 34,
    137     };
    138 
    139     DECLARE_META_INTERFACE(KeystoreService);
    140 
    141     virtual int32_t getState(int32_t userId) = 0;
    142 
    143     virtual int32_t get(const String16& name, uint8_t** item, size_t* itemLength) = 0;
    144 
    145     virtual int32_t insert(const String16& name, const uint8_t* item, size_t itemLength, int uid,
    146             int32_t flags) = 0;
    147 
    148     virtual int32_t del(const String16& name, int uid) = 0;
    149 
    150     virtual int32_t exist(const String16& name, int uid) = 0;
    151 
    152     virtual int32_t list(const String16& prefix, int uid, Vector<String16>* matches) = 0;
    153 
    154     virtual int32_t reset() = 0;
    155 
    156     virtual int32_t onUserPasswordChanged(int32_t userId, const String16& newPassword) = 0;
    157 
    158     virtual int32_t lock(int32_t userId) = 0;
    159 
    160     virtual int32_t unlock(int32_t userId, const String16& password) = 0;
    161 
    162     virtual bool isEmpty(int32_t userId) = 0;
    163 
    164     virtual int32_t generate(const String16& name, int32_t uid, int32_t keyType, int32_t keySize,
    165             int32_t flags, Vector<sp<KeystoreArg> >* args) = 0;
    166 
    167     virtual int32_t import(const String16& name, const uint8_t* data, size_t length, int uid,
    168             int32_t flags) = 0;
    169 
    170     virtual int32_t sign(const String16& name, const uint8_t* data, size_t length, uint8_t** out,
    171             size_t* outLength) = 0;
    172 
    173     virtual int32_t verify(const String16& name, const uint8_t* data, size_t dataLength,
    174             const uint8_t* signature, size_t signatureLength) = 0;
    175 
    176     virtual int32_t get_pubkey(const String16& name, uint8_t** pubkey, size_t* pubkeyLength) = 0;
    177 
    178     virtual int32_t grant(const String16& name, int32_t granteeUid) = 0;
    179 
    180     virtual int32_t ungrant(const String16& name, int32_t granteeUid) = 0;
    181 
    182     virtual int64_t getmtime(const String16& name) = 0;
    183 
    184     virtual int32_t duplicate(const String16& srcKey, int32_t srcUid, const String16& destKey,
    185             int32_t destUid) = 0;
    186 
    187     virtual int32_t is_hardware_backed(const String16& keyType) = 0;
    188 
    189     virtual int32_t clear_uid(int64_t uid) = 0;
    190 
    191     virtual int32_t addRngEntropy(const uint8_t* data, size_t dataLength) = 0;
    192 
    193     virtual int32_t generateKey(const String16& name, const KeymasterArguments& params,
    194                                 const uint8_t* entropy, size_t entropyLength, int uid, int flags,
    195                                 KeyCharacteristics* outCharacteristics) = 0;
    196 
    197     virtual int32_t getKeyCharacteristics(const String16& name,
    198                                           const keymaster_blob_t* clientId,
    199                                           const keymaster_blob_t* appData,
    200                                           KeyCharacteristics* outCharacteristics) = 0;
    201 
    202     virtual int32_t importKey(const String16& name, const KeymasterArguments&  params,
    203                               keymaster_key_format_t format, const uint8_t *keyData,
    204                               size_t keyLength, int uid, int flags,
    205                               KeyCharacteristics* outCharacteristics) = 0;
    206 
    207     virtual void exportKey(const String16& name, keymaster_key_format_t format,
    208                            const keymaster_blob_t* clientId,
    209                            const keymaster_blob_t* appData, ExportResult* result) = 0;
    210 
    211     virtual void begin(const sp<IBinder>& apptoken, const String16& name,
    212                        keymaster_purpose_t purpose, bool pruneable,
    213                        const KeymasterArguments& params, const uint8_t* entropy,
    214                        size_t entropyLength, OperationResult* result) = 0;
    215 
    216     virtual void update(const sp<IBinder>& token, const KeymasterArguments& params,
    217                         const uint8_t* data, size_t dataLength, OperationResult* result) = 0;
    218 
    219     virtual void finish(const sp<IBinder>& token, const KeymasterArguments& params,
    220                         const uint8_t* signature, size_t signatureLength,
    221                         const uint8_t* entropy, size_t entropyLength,
    222                         OperationResult* result) = 0;
    223 
    224     virtual int32_t abort(const sp<IBinder>& handle) = 0;
    225 
    226     virtual bool isOperationAuthorized(const sp<IBinder>& handle) = 0;
    227 
    228     virtual int32_t addAuthToken(const uint8_t* token, size_t length) = 0;
    229 
    230     virtual int32_t onUserAdded(int32_t userId, int32_t parentId) = 0;
    231 
    232     virtual int32_t onUserRemoved(int32_t userId) = 0;
    233 
    234 };
    235 
    236 // ----------------------------------------------------------------------------
    237 
    238 class BnKeystoreService: public BnInterface<IKeystoreService> {
    239 public:
    240     virtual status_t onTransact(uint32_t code, const Parcel& data, Parcel* reply,
    241             uint32_t flags = 0);
    242 };
    243 
    244 } // namespace android
    245 
    246 #endif
    247