1 // 2 // Copyright (C) 2020 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 16 #pragma once 17 18 #include "gatekeeper/gatekeeper.h" 19 #include "tss2/tss2_esys.h" 20 21 #include "host/commands/secure_env/gatekeeper_storage.h" 22 #include "host/commands/secure_env/tpm_resource_manager.h" 23 24 /** 25 * See method descriptions for this class in 26 * system/gatekeeper/include/gatekeeper/gatekeeper.h 27 */ 28 class TpmGatekeeper : public gatekeeper::GateKeeper { 29 public: 30 TpmGatekeeper( 31 TpmResourceManager& resource_manager, 32 GatekeeperStorage& secure_storage, 33 GatekeeperStorage& insecure_storage); 34 35 bool GetAuthTokenKey( 36 const uint8_t** auth_token_key, uint32_t* length) const override; 37 38 void GetPasswordKey(const uint8_t** pasword_key, uint32_t* length) override; 39 40 void ComputePasswordSignature( 41 uint8_t* signature, 42 uint32_t signature_length, 43 const uint8_t* key, 44 uint32_t key_length, 45 const uint8_t* password, 46 uint32_t password_length, 47 gatekeeper::salt_t salt) const override; 48 49 void GetRandom(void* random, uint32_t requested_size) const override; 50 51 void ComputeSignature( 52 uint8_t* signature, 53 uint32_t signature_length, 54 const uint8_t* key, 55 uint32_t key_length, 56 const uint8_t* message, 57 uint32_t length) const override; 58 59 uint64_t GetMillisecondsSinceBoot() const override; 60 61 /** 62 * Retrieves the failure record for user `uid`, assuming a user secret value 63 * of `user_id`. If the secret value `user_id` is incorrect, the original 64 * secret `user_id` value will be lost and cannot be recovered. 65 */ 66 bool GetFailureRecord( 67 uint32_t uid, 68 gatekeeper::secure_id_t user_id, 69 gatekeeper::failure_record_t *record, 70 bool secure) override; 71 72 bool ClearFailureRecord( 73 uint32_t uid, gatekeeper::secure_id_t user_id, bool secure) override; 74 75 bool WriteFailureRecord( 76 uint32_t uid, gatekeeper::failure_record_t *record, bool secure) override; 77 78 bool IsHardwareBacked() const override; 79 private: 80 TpmResourceManager& resource_manager_; 81 GatekeeperStorage& secure_storage_; 82 GatekeeperStorage& insecure_storage_; 83 }; 84