1 // 2 // Copyright (C) 2020 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 16 #pragma once 17 18 #include <map> 19 #include <vector> 20 21 #include <keymaster/keymaster_context.h> 22 #include <keymaster/km_openssl/attestation_record.h> 23 24 #include "tpm_attestation_record.h" 25 26 class TpmAttestationRecordContext; 27 class TpmResourceManager; 28 class TpmKeyBlobMaker; 29 class TpmRandomSource; 30 31 /** 32 * Implementation of KeymasterContext that wraps its keys with a TPM. 33 * 34 * See the parent class for details: 35 * https://cs.android.com/android/platform/superproject/+/master:system/keymaster/include/keymaster/keymaster_context.h;drc=821acb74d7febb886a9b7cefee4ee3df4cc8c556 36 */ 37 class TpmKeymasterContext : public keymaster::KeymasterContext { 38 private: 39 TpmResourceManager& resource_manager_; 40 keymaster::KeymasterEnforcement& enforcement_; 41 std::unique_ptr<TpmKeyBlobMaker> key_blob_maker_; 42 std::unique_ptr<TpmRandomSource> random_source_; 43 std::unique_ptr<TpmAttestationRecordContext> attestation_context_; 44 std::map<keymaster_algorithm_t, std::unique_ptr<keymaster::KeyFactory>> key_factories_; 45 std::vector<keymaster_algorithm_t> supported_algorithms_; 46 uint32_t os_version_; 47 uint32_t os_patchlevel_; 48 public: 49 TpmKeymasterContext(TpmResourceManager&, keymaster::KeymasterEnforcement&); 50 ~TpmKeymasterContext() = default; 51 GetKmVersion()52 keymaster::KmVersion GetKmVersion() const override { 53 return attestation_context_->GetKmVersion(); 54 } 55 56 keymaster_error_t SetSystemVersion( 57 uint32_t os_version, uint32_t os_patchlevel) override; 58 void GetSystemVersion( 59 uint32_t* os_version, uint32_t* os_patchlevel) const override; 60 61 const keymaster::KeyFactory* GetKeyFactory( 62 keymaster_algorithm_t algorithm) const override; 63 const keymaster::OperationFactory* GetOperationFactory( 64 keymaster_algorithm_t algorithm, 65 keymaster_purpose_t purpose) const override; 66 const keymaster_algorithm_t* GetSupportedAlgorithms( 67 size_t* algorithms_count) const override; 68 69 keymaster_error_t UpgradeKeyBlob( 70 const keymaster::KeymasterKeyBlob& key_to_upgrade, 71 const keymaster::AuthorizationSet& upgrade_params, 72 keymaster::KeymasterKeyBlob* upgraded_key) const override; 73 74 keymaster_error_t ParseKeyBlob( 75 const keymaster::KeymasterKeyBlob& blob, 76 const keymaster::AuthorizationSet& additional_params, 77 keymaster::UniquePtr<keymaster::Key>* key) const override; 78 79 keymaster_error_t AddRngEntropy( 80 const uint8_t* buf, size_t length) const override; 81 82 keymaster::KeymasterEnforcement* enforcement_policy() override; 83 84 keymaster::CertificateChain GenerateAttestation( 85 const keymaster::Key& key, 86 const keymaster::AuthorizationSet& attest_params, 87 keymaster::UniquePtr<keymaster::Key> attest_key, 88 const keymaster::KeymasterBlob& issuer_subject, 89 keymaster_error_t* error) const override; 90 91 keymaster::CertificateChain GenerateSelfSignedCertificate( 92 const keymaster::Key& key, 93 const keymaster::AuthorizationSet& cert_params, 94 bool fake_signature, 95 keymaster_error_t* error) const override; 96 97 keymaster_error_t UnwrapKey( 98 const keymaster::KeymasterKeyBlob& wrapped_key_blob, 99 const keymaster::KeymasterKeyBlob& wrapping_key_blob, 100 const keymaster::AuthorizationSet& wrapping_key_params, 101 const keymaster::KeymasterKeyBlob& masking_key, 102 keymaster::AuthorizationSet* wrapped_key_params, 103 keymaster_key_format_t* wrapped_key_format, 104 keymaster::KeymasterKeyBlob* wrapped_key_material) const override; 105 }; 106