1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef KEYSTORE_USER_STATE_H_ 18 #define KEYSTORE_USER_STATE_H_ 19 20 #include <sys/types.h> 21 22 #include <openssl/aes.h> 23 24 #include <utils/String8.h> 25 26 #include <keystore/keystore.h> 27 28 #include "blob.h" 29 #include "keystore_utils.h" 30 31 #include <android-base/logging.h> 32 #include <condition_variable> 33 #include <keystore/keystore_concurrency.h> 34 #include <mutex> 35 #include <set> 36 #include <vector> 37 38 namespace keystore { 39 40 class UserState; 41 42 template <typename UserState> using LockedUserState = ProxyLock<UnlockProxyLockHelper<UserState>>; 43 44 class UserState { 45 public: 46 explicit UserState(uid_t userId); 47 48 bool initialize(); 49 getUserId()50 uid_t getUserId() const { return mUserId; } getUserDirName()51 const std::string& getUserDirName() const { return mMasterKeyEntry.user_dir(); } 52 getMasterKeyFileName()53 std::string getMasterKeyFileName() const { return mMasterKeyEntry.getKeyBlobPath(); } 54 55 void setState(State state); getState()56 State getState() const { return mState; } 57 58 void zeroizeMasterKeysInMemory(); 59 bool deleteMasterKey(); 60 61 ResponseCode initialize(const android::String8& pw); 62 63 ResponseCode copyMasterKey(LockedUserState<UserState>* src); 64 ResponseCode copyMasterKeyFile(LockedUserState<UserState>* src); 65 ResponseCode writeMasterKey(const android::String8& pw); 66 ResponseCode readMasterKey(const android::String8& pw); 67 getEncryptionKey()68 const std::vector<uint8_t>& getEncryptionKey() const { return mMasterKey; } 69 70 bool reset(); 71 72 bool operator<(const UserState& rhs) const; 73 bool operator<(uid_t userId) const; 74 75 private: 76 static constexpr int SHA1_DIGEST_SIZE_BYTES = 16; 77 static constexpr int SHA256_DIGEST_SIZE_BYTES = 32; 78 79 static constexpr int MASTER_KEY_SIZE_BYTES = kAes256KeySizeBytes; 80 static constexpr int MASTER_KEY_SIZE_BITS = MASTER_KEY_SIZE_BYTES * 8; 81 82 static constexpr size_t SALT_SIZE = 16; 83 84 void generateKeyFromPassword(std::vector<uint8_t>& key, const android::String8& pw, 85 uint8_t* salt); 86 bool generateSalt(); 87 bool generateMasterKey(); 88 void setupMasterKeys(); 89 90 KeyBlobEntry mMasterKeyEntry; 91 92 uid_t mUserId; 93 State mState; 94 95 std::vector<uint8_t> mMasterKey; 96 uint8_t mSalt[SALT_SIZE]; 97 }; 98 99 bool operator<(uid_t userId, const UserState& rhs); 100 101 class UserStateDB { 102 public: 103 LockedUserState<UserState> getUserState(uid_t userId); 104 LockedUserState<UserState> getUserStateByUid(uid_t uid); 105 LockedUserState<const UserState> getUserState(uid_t userId) const; 106 LockedUserState<const UserState> getUserStateByUid(uid_t uid) const; 107 108 private: 109 mutable std::set<const UserState*> locked_state_; 110 mutable std::mutex locked_state_mutex_; 111 mutable std::condition_variable locked_state_mutex_cond_var_; 112 113 template <typename UserState> get(std::unique_lock<std::mutex> lock,UserState * entry)114 LockedUserState<UserState> get(std::unique_lock<std::mutex> lock, UserState* entry) const { 115 locked_state_mutex_cond_var_.wait( 116 lock, [&] { return locked_state_.find(entry) == locked_state_.end(); }); 117 locked_state_.insert(entry); 118 return {entry, [&](UserState* entry) { 119 std::unique_lock<std::mutex> lock(locked_state_mutex_); 120 locked_state_.erase(entry); 121 lock.unlock(); 122 locked_state_mutex_cond_var_.notify_all(); 123 }}; 124 } 125 126 std::map<uid_t, UserState> mMasterKeys; 127 }; 128 129 } // namespace keystore 130 131 #endif // KEYSTORE_USER_STATE_H_ 132