1 /* 2 * Copyright (C) 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <memory> 18 #include <vector> 19 20 #include <hardware/hw_auth_token.h> 21 #include <keystore/authorization_set.h> 22 23 #ifndef KEYSTORE_AUTH_TOKEN_TABLE_H_ 24 #define KEYSTORE_AUTH_TOKEN_TABLE_H_ 25 26 namespace keystore { 27 28 using android::hardware::keymaster::V3_0::HardwareAuthToken; 29 30 namespace test { 31 class AuthTokenTableTest; 32 } // namespace test 33 34 time_t clock_gettime_raw(); 35 36 /** 37 * AuthTokenTable manages a set of received authorization tokens and can provide the appropriate 38 * token for authorizing a key operation. 39 * 40 * To keep the table from growing without bound, superseded entries are removed when possible, and 41 * least recently used entries are automatically pruned when when the table exceeds a size limit, 42 * which is expected to be relatively small, since the implementation uses a linear search. 43 */ 44 class AuthTokenTable { 45 public: 46 explicit AuthTokenTable(size_t max_entries = 32, time_t (*clock_function)() = clock_gettime_raw) 47 : max_entries_(max_entries), last_off_body_(clock_function()), 48 clock_function_(clock_function) {} 49 50 enum Error { 51 OK, 52 AUTH_NOT_REQUIRED = -1, 53 AUTH_TOKEN_EXPIRED = -2, // Found a matching token, but it's too old. 54 AUTH_TOKEN_WRONG_SID = -3, // Found a token with the right challenge, but wrong SID. This 55 // most likely indicates that the authenticator was updated 56 // (e.g. new fingerprint enrolled). 57 OP_HANDLE_REQUIRED = -4, // The key requires auth per use but op_handle was zero. 58 AUTH_TOKEN_NOT_FOUND = -5, 59 }; 60 61 /** 62 * Add an authorization token to the table. The table takes ownership of the argument. 63 */ 64 void AddAuthenticationToken(const HardwareAuthToken* token); 65 66 /** 67 * Find an authorization token that authorizes the operation specified by \p operation_handle on 68 * a key with the characteristics specified in \p key_info. 69 * 70 * This method is O(n * m), where n is the number of KM_TAG_USER_SECURE_ID entries in key_info 71 * and m is the number of entries in the table. It could be made better, but n and m should 72 * always be small. 73 * 74 * The table retains ownership of the returned object. 75 */ 76 Error FindAuthorization(const AuthorizationSet& key_info, KeyPurpose purpose, 77 uint64_t op_handle, const HardwareAuthToken** found); 78 79 /** 80 * Mark operation completed. This allows tokens associated with the specified operation to be 81 * superseded by new tokens. 82 */ 83 void MarkCompleted(const uint64_t op_handle); 84 85 /** 86 * Update the last_off_body_ timestamp so that tokens which remain authorized only so long as 87 * the device stays on body can be revoked. 88 */ 89 void onDeviceOffBody(); 90 91 void Clear(); 92 93 size_t size() { return entries_.size(); } 94 95 private: 96 friend class AuthTokenTableTest; 97 98 class Entry { 99 public: 100 Entry(const HardwareAuthToken* token, time_t current_time); 101 Entry(Entry&& entry) { *this = std::move(entry); } 102 103 void operator=(Entry&& rhs) { 104 token_ = std::move(rhs.token_); 105 time_received_ = rhs.time_received_; 106 last_use_ = rhs.last_use_; 107 operation_completed_ = rhs.operation_completed_; 108 } 109 110 bool operator<(const Entry& rhs) const { return last_use_ < rhs.last_use_; } 111 112 void UpdateLastUse(time_t time); 113 114 bool Supersedes(const Entry& entry) const; 115 bool SatisfiesAuth(const std::vector<uint64_t>& sids, HardwareAuthenticatorType auth_type); 116 117 bool is_newer_than(const Entry* entry) { 118 if (!entry) return true; 119 return timestamp_host_order() > entry->timestamp_host_order(); 120 } 121 122 void mark_completed() { operation_completed_ = true; } 123 124 const HardwareAuthToken* token() { return token_.get(); } 125 time_t time_received() const { return time_received_; } 126 bool completed() const { return operation_completed_; } 127 uint32_t timestamp_host_order() const; 128 HardwareAuthenticatorType authenticator_type() const; 129 130 private: 131 std::unique_ptr<const HardwareAuthToken> token_; 132 time_t time_received_; 133 time_t last_use_; 134 bool operation_completed_; 135 }; 136 137 Error FindAuthPerOpAuthorization(const std::vector<uint64_t>& sids, 138 HardwareAuthenticatorType auth_type, uint64_t op_handle, 139 const HardwareAuthToken** found); 140 Error FindTimedAuthorization(const std::vector<uint64_t>& sids, 141 HardwareAuthenticatorType auth_type, 142 const AuthorizationSet& key_info, const HardwareAuthToken** found); 143 void ExtractSids(const AuthorizationSet& key_info, std::vector<uint64_t>* sids); 144 void RemoveEntriesSupersededBy(const Entry& entry); 145 bool IsSupersededBySomeEntry(const Entry& entry); 146 147 std::vector<Entry> entries_; 148 size_t max_entries_; 149 time_t last_off_body_; 150 time_t (*clock_function_)(); 151 }; 152 153 } // namespace keymaster 154 155 #endif // KEYSTORE_AUTH_TOKEN_TABLE_H_ 156
