1 // 2 // Copyright (C) 2020 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 16 #pragma once 17 18 #include <memory> 19 #include <string> 20 #include <vector> 21 22 #include <tss2/tss2_esys.h> 23 #include <tss2/tss2_tpm2_types.h> 24 #include <json/json.h> 25 26 #include "host/commands/secure_env/gatekeeper_storage.h" 27 #include "host/commands/secure_env/tpm_resource_manager.h" 28 29 /** 30 * Manager for data stored inside the TPM with an index outside of the TPM. The 31 * contents of the data cannot be corrupted or decrypted by accessing the index, 32 * but the index can be corrupted by an attacker. 33 * 34 * As the actual data is stored inside the TPM, a replay attack can be used to 35 * restore deleted index entries or hide revert to before an index entry was 36 * added, but not change the contents that an index points to if it still 37 * exists. 38 * 39 * This class is not thread-safe, and should be synchronized externally if it 40 * is going to be used from multiple threads. 41 */ 42 class FragileTpmStorage : public GatekeeperStorage { 43 public: 44 FragileTpmStorage(TpmResourceManager&, const std::string& index_file); 45 ~FragileTpmStorage() = default; 46 47 bool Allocate(const Json::Value& key, uint16_t size) override; 48 bool HasKey(const Json::Value& key) const override; 49 50 std::unique_ptr<TPM2B_MAX_NV_BUFFER> Read(const Json::Value& key) const 51 override; 52 bool Write(const Json::Value& key, const TPM2B_MAX_NV_BUFFER& data) override; 53 private: 54 TPM2_HANDLE GetHandle(const Json::Value& key) const; 55 TPM2_HANDLE GenerateRandomHandle(); 56 57 TpmResourceManager& resource_manager_; 58 std::string index_file_; 59 Json::Value index_; 60 }; 61