• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #pragma once
18 
19 #include <keymaster/UniquePtr.h>
20 
21 #include <hardware/keymaster_defs.h>
22 #include <keymaster/android_keymaster_utils.h>
23 #include <keymaster/keymaster_tags.h>
24 #include <keymaster/serializable.h>
25 
26 namespace keymaster {
27 
28 class AuthorizationSetBuilder;
29 
30 /**
31  * An extension of the keymaster_key_param_set_t struct, which provides serialization memory
32  * management and methods for easy manipulation and construction.
33  */
34 class AuthorizationSet : public Serializable, public keymaster_key_param_set_t {
35   public:
36     /**
37      * Construct an empty, dynamically-allocated, growable AuthorizationSet.  Does not actually
38      * allocate any storage until elements are added, so there is no cost to creating an
39      * AuthorizationSet with this constructor and then reinitializing it to point at pre-allocated
40      * buffers, with \p Reinitialize.
41      */
AuthorizationSet()42     AuthorizationSet()
43         : elems_capacity_(0), indirect_data_(nullptr), indirect_data_size_(0),
44           indirect_data_capacity_(0), error_(OK) {
45         elems_ = nullptr;
46         elems_size_ = 0;
47     }
48 
49     /**
50      * Construct an AuthorizationSet from the provided array.  The AuthorizationSet copies the data
51      * from the provided array (and the data referenced by its embedded pointers, if any) into
52      * dynamically-allocated storage.  If allocation of the needed storage fails, \p is_valid() will
53      * return ALLOCATION_FAILURE. It is the responsibility of the caller to check before using the
54      * set, if allocations might fail.
55      */
AuthorizationSet(const keymaster_key_param_t * elems,size_t count)56     AuthorizationSet(const keymaster_key_param_t* elems, size_t count)
57         : elems_capacity_(0), indirect_data_(nullptr), indirect_data_size_(0),
58           indirect_data_capacity_(0), error_(OK) {
59         elems_ = nullptr;
60         Reinitialize(elems, count);
61     }
62 
AuthorizationSet(const keymaster_key_param_set_t & set)63     explicit AuthorizationSet(const keymaster_key_param_set_t& set)
64         : elems_capacity_(0), indirect_data_(nullptr), indirect_data_size_(0),
65           indirect_data_capacity_(0), error_(OK) {
66         elems_ = nullptr;
67         Reinitialize(set.params, set.length);
68     }
69 
AuthorizationSet(const uint8_t * serialized_set,size_t serialized_size)70     explicit AuthorizationSet(const uint8_t* serialized_set, size_t serialized_size)
71         : elems_capacity_(0), indirect_data_(nullptr), indirect_data_size_(0),
72           indirect_data_capacity_(0), error_(OK) {
73         elems_ = nullptr;
74         Deserialize(&serialized_set, serialized_set + serialized_size);
75     }
76 
77     /**
78      * Construct an AuthorizationSet from the provided builder.  This extracts the data from the
79      * builder, rather than copying it, so after this call the builder is empty.
80      */
81     explicit AuthorizationSet(/* NOT const */ AuthorizationSetBuilder& builder);
82 
83     // Copy constructor.
84     // A copy constructor normal should call a base class copy constructor,
85     // but Serializable is special without copy constructor.
86     // NOLINTNEXTLINE(bugprone-copy-constructor-init)
AuthorizationSet(const AuthorizationSet & set)87     AuthorizationSet(const AuthorizationSet& set)
88         : Serializable(), elems_capacity_(0), indirect_data_(nullptr), indirect_data_size_(0),
89           indirect_data_capacity_(0), error_(OK) {
90         elems_ = nullptr;
91         error_ = set.error_;
92         if (error_ != OK) return;
93         Reinitialize(set.elems_, set.elems_size_);
94     }
95 
96     // Move constructor.
AuthorizationSet(AuthorizationSet && set)97     AuthorizationSet(AuthorizationSet&& set) : Serializable() { MoveFrom(set); }
98 
99     // Copy assignment.
100     AuthorizationSet& operator=(const AuthorizationSet& set) {
101         if (&set == this) return *this;
102         Reinitialize(set.elems_, set.elems_size_);
103         error_ = set.error_;
104         return *this;
105     }
106 
107     // Move assignment.
108     AuthorizationSet& operator=(AuthorizationSet&& set) {
109         FreeData();
110         MoveFrom(set);
111         return *this;
112     }
113 
114     /**
115      * Clear existing authorization set data
116      */
117     void Clear();
118 
119     /**
120      * Reinitialize an AuthorizationSet as a dynamically-allocated, growable copy of the data in the
121      * provided array (and the data referenced by its embedded pointers, if any).  If the allocation
122      * of the needed storage fails this method will return false and \p is_valid() will return
123      * ALLOCATION_FAILURE.
124      */
125     bool Reinitialize(const keymaster_key_param_t* elems, size_t count);
126 
Reinitialize(const AuthorizationSet & set)127     bool Reinitialize(const AuthorizationSet& set) {
128         return Reinitialize(set.elems_, set.elems_size_);
129     }
130 
Reinitialize(const keymaster_key_param_set_t & set)131     bool Reinitialize(const keymaster_key_param_set_t& set) {
132         return Reinitialize(set.params, set.length);
133     }
134 
135     ~AuthorizationSet();
136 
137     enum Error {
138         OK,
139         ALLOCATION_FAILURE,
140         MALFORMED_DATA,
141     };
142 
is_valid()143     Error is_valid() const { return error_; }
144 
145     /**
146      * Returns the size of the set.
147      */
size()148     size_t size() const { return elems_size_; }
149 
150     /**
151      * Returns true if the set is empty.
152      */
empty()153     bool empty() const { return size() == 0; }
154 
155     /**
156      * Returns the total size of all indirect data referenced by set elements.
157      */
indirect_size()158     size_t indirect_size() const { return indirect_data_size_; }
159 
160     /**
161      * Returns the data in the set, directly. Be careful with this.
162      */
data()163     const keymaster_key_param_t* data() const { return elems_; }
164 
165     /**
166      * Sorts the set
167      */
168     void Sort();
169 
170     /**
171      * Sorts the set and removes duplicates (inadvertently duplicating tags is easy to do with the
172      * AuthorizationSetBuilder).
173      */
174     void Deduplicate();
175 
176     /**
177      * Removes all elements in \p set from this AuthorizationSet.
178      */
179     void Difference(const keymaster_key_param_set_t& set);
180 
181     /**
182      * Returns the data in a keymaster_key_param_set_t, suitable for returning to C code.  For C
183      * compatibility, the contents are malloced, not new'ed, and so must be freed with free(), or
184      * better yet with keymaster_free_param_set, not delete.  The caller takes ownership.
185      */
186     void CopyToParamSet(keymaster_key_param_set_t* set) const;
187 
188     /**
189      * Returns the offset of the next entry that matches \p tag, starting from the element after \p
190      * begin.  If not found, returns -1.
191      */
192     int find(keymaster_tag_t tag, int begin = -1) const;
193 
194     /**
195      * Removes the entry at the specified index. Returns true if successful, false if the index was
196      * out of bounds.
197      */
198     bool erase(int index);
199 
200     /**
201      * Returns iterator (pointer) to beginning of elems array, to enable STL-style iteration
202      */
begin()203     const keymaster_key_param_t* begin() const { return elems_; }
204 
205     /**
206      * Returns iterator (pointer) one past end of elems array, to enable STL-style iteration
207      */
end()208     const keymaster_key_param_t* end() const { return elems_ + elems_size_; }
209 
210     /**
211      * Returns the nth element of the set.
212      */
213     keymaster_key_param_t& operator[](int n);
214 
215     /**
216      * Returns the nth element of the set.
217      */
218     const keymaster_key_param_t& operator[](int n) const;
219 
220     /**
221      * Returns true if the set contains at least one instance of \p tag
222      */
Contains(keymaster_tag_t tag)223     bool Contains(keymaster_tag_t tag) const { return find(tag) != -1; }
224 
225     /**
226      * Returns the number of \p tag entries.
227      */
228     size_t GetTagCount(keymaster_tag_t tag) const;
229 
230     /**
231      * Returns true if the set contains the specified tag and value.
232      */
233     template <keymaster_tag_t Tag, typename T>
Contains(TypedEnumTag<KM_ENUM_REP,Tag,T> tag,T val)234     bool Contains(TypedEnumTag<KM_ENUM_REP, Tag, T> tag, T val) const {
235         return ContainsEnumValue(tag, val);
236     }
237 
238     /**
239      * Returns true if the set contains the specified tag and value.
240      */
241     template <keymaster_tag_t Tag, typename T>
Contains(TypedEnumTag<KM_ENUM,Tag,T> tag,T val)242     bool Contains(TypedEnumTag<KM_ENUM, Tag, T> tag, T val) const {
243         return ContainsEnumValue(tag, val);
244     }
245 
246     /**
247      * Returns true if the set contains the specified tag and value.
248      */
Contains(TypedTag<KM_UINT,Tag> tag,uint32_t val)249     template <keymaster_tag_t Tag> bool Contains(TypedTag<KM_UINT, Tag> tag, uint32_t val) const {
250         return ContainsIntValue(tag, val);
251     }
252 
253     /**
254      * If the specified integer-typed \p tag exists, places its value in \p val and returns true.
255      * If \p tag is not present, leaves \p val unmodified and returns false.
256      */
257     template <keymaster_tag_t T>
GetTagValue(TypedTag<KM_UINT,T> tag,uint32_t * val)258     inline bool GetTagValue(TypedTag<KM_UINT, T> tag, uint32_t* val) const {
259         return GetTagValueInt(tag, val);
260     }
261 
262     /**
263      * If the specified instance of the specified integer-typed \p tag exists, places its value
264      * in \p val and returns true.  If \p tag is not present, leaves \p val unmodified and returns
265      * false.
266      */
267     template <keymaster_tag_t Tag>
GetTagValue(TypedTag<KM_UINT_REP,Tag> tag,size_t instance,uint32_t * val)268     bool GetTagValue(TypedTag<KM_UINT_REP, Tag> tag, size_t instance, uint32_t* val) const {
269         return GetTagValueIntRep(tag, instance, val);
270     }
271 
272     /**
273      * If the specified long-typed \p tag exists, places its value in \p val and returns true.
274      * If \p tag is not present, leaves \p val unmodified and returns false.
275      */
276     template <keymaster_tag_t T>
GetTagValue(TypedTag<KM_ULONG,T> tag,uint64_t * val)277     inline bool GetTagValue(TypedTag<KM_ULONG, T> tag, uint64_t* val) const {
278         return GetTagValueLong(tag, val);
279     }
280 
281     /**
282      * If the specified instance of the specified integer-typed \p tag exists, places its value
283      * in \p val and returns true.  If \p tag is not present, leaves \p val unmodified and returns
284      * false.
285      */
286     template <keymaster_tag_t Tag>
GetTagValue(TypedTag<KM_ULONG_REP,Tag> tag,size_t instance,uint64_t * val)287     bool GetTagValue(TypedTag<KM_ULONG_REP, Tag> tag, size_t instance, uint64_t* val) const {
288         return GetTagValueLongRep(tag, instance, val);
289     }
290 
291     /**
292      * If the specified enumeration-typed \p tag exists, places its value in \p val and returns
293      * true.  If \p tag is not present, leaves \p val unmodified and returns false.
294      */
295     template <keymaster_tag_t Tag, typename T>
GetTagValue(TypedEnumTag<KM_ENUM,Tag,T> tag,T * val)296     bool GetTagValue(TypedEnumTag<KM_ENUM, Tag, T> tag, T* val) const {
297         return GetTagValueEnum(tag, reinterpret_cast<uint32_t*>(val));
298     }
299 
300     /**
301      * If the specified instance of the specified enumeration-typed \p tag exists, places its value
302      * in \p val and returns true.  If \p tag is not present, leaves \p val unmodified and returns
303      * false.
304      */
305     template <keymaster_tag_t Tag, typename T>
GetTagValue(TypedEnumTag<KM_ENUM_REP,Tag,T> tag,size_t instance,T * val)306     bool GetTagValue(TypedEnumTag<KM_ENUM_REP, Tag, T> tag, size_t instance, T* val) const {
307         return GetTagValueEnumRep(tag, instance, reinterpret_cast<uint32_t*>(val));
308     }
309 
310     /**
311      * If exactly one instance of the specified enumeration-typed \p tag exists, places its value in
312      * \p val and returns true.  If \p tag is not present or if multiple copies are present, leaves
313      * \p val unmodified and returns false.
314      */
315     template <keymaster_tag_t Tag, typename T>
GetTagValue(TypedEnumTag<KM_ENUM_REP,Tag,T> tag,T * val)316     bool GetTagValue(TypedEnumTag<KM_ENUM_REP, Tag, T> tag, T* val) const {
317         if (GetTagCount(tag) != 1) return false;
318         return GetTagValueEnumRep(tag, 0, reinterpret_cast<uint32_t*>(val));
319     }
320 
321     /**
322      * If the specified date-typed \p tag exists, places its value in \p val and returns
323      * true.  If \p tag is not present, leaves \p val unmodified and returns false.
324      */
325     template <keymaster_tag_t Tag>
GetTagValue(TypedTag<KM_UINT_REP,Tag> tag,size_t instance,typename TypedTag<KM_UINT_REP,Tag>::value_type * val)326     bool GetTagValue(TypedTag<KM_UINT_REP, Tag> tag, size_t instance,
327                      typename TypedTag<KM_UINT_REP, Tag>::value_type* val) const {
328         return GetTagValueIntRep(tag, instance, val);
329     }
330 
331     /**
332      * If the specified bytes-typed \p tag exists, places its value in \p val and returns
333      * true.  If \p tag is not present, leaves \p val unmodified and returns false.
334      */
335     template <keymaster_tag_t Tag>
GetTagValue(TypedTag<KM_BYTES,Tag> tag,keymaster_blob_t * val)336     bool GetTagValue(TypedTag<KM_BYTES, Tag> tag, keymaster_blob_t* val) const {
337         return GetTagValueBlob(tag, val);
338     }
339 
340     /**
341      * If the specified bignum-typed \p tag exists, places its value in \p val and returns
342      * true.  If \p tag is not present, leaves \p val unmodified and returns false.
343      */
344     template <keymaster_tag_t Tag>
GetTagValue(TypedTag<KM_BIGNUM,Tag> tag,keymaster_blob_t * val)345     bool GetTagValue(TypedTag<KM_BIGNUM, Tag> tag, keymaster_blob_t* val) const {
346         return GetTagValueBlob(tag, val);
347     }
348 
349     /**
350      * Returns true if the specified tag is present, and therefore has the value 'true'.
351      */
GetTagValue(TypedTag<KM_BOOL,Tag> tag)352     template <keymaster_tag_t Tag> bool GetTagValue(TypedTag<KM_BOOL, Tag> tag) const {
353         return GetTagValueBool(tag);
354     }
355 
356     /**
357      * If the specified \p tag exists, places its value in \p val and returns true.  If \p tag is
358      * not present, leaves \p val unmodified and returns false.
359      */
360     template <keymaster_tag_t Tag, keymaster_tag_type_t Type>
GetTagValue(TypedTag<Type,Tag> tag,typename TagValueType<Type>::value_type * val)361     bool GetTagValue(TypedTag<Type, Tag> tag, typename TagValueType<Type>::value_type* val) const {
362         return GetTagValueLong(tag, val);
363     }
364 
365     bool push_back(keymaster_key_param_t elem);
366 
367     /**
368      * Grow the elements array to ensure it can contain \p count entries.  Preserves any existing
369      * entries.
370      */
371     bool reserve_elems(size_t count);
372 
373     /**
374      * Grow the indirect data array to ensure it can contain \p length bytes.  Preserves any
375      * existing indirect data.
376      */
377     bool reserve_indirect(size_t length);
378 
379     bool push_back(const keymaster_key_param_set_t& set);
380 
381     /**
382      * Append the tag and enumerated value to the set.
383      */
384     template <keymaster_tag_t Tag, keymaster_tag_type_t Type, typename KeymasterEnum>
push_back(TypedEnumTag<Type,Tag,KeymasterEnum> tag,KeymasterEnum val)385     bool push_back(TypedEnumTag<Type, Tag, KeymasterEnum> tag, KeymasterEnum val) {
386         return push_back(Authorization(tag, val));
387     }
388 
389     /**
390      * Append the boolean tag (value "true") to the set.
391      */
push_back(TypedTag<KM_BOOL,Tag> tag)392     template <keymaster_tag_t Tag> bool push_back(TypedTag<KM_BOOL, Tag> tag) {
393         return push_back(Authorization(tag));
394     }
395 
396     /**
397      * Append the tag and byte array to the set.  Copies the array into internal storage; does not
398      * take ownership of the passed-in array.
399      */
400     template <keymaster_tag_t Tag>
push_back(TypedTag<KM_BYTES,Tag> tag,const void * bytes,size_t bytes_len)401     bool push_back(TypedTag<KM_BYTES, Tag> tag, const void* bytes, size_t bytes_len) {
402         return push_back(keymaster_param_blob(tag, static_cast<const uint8_t*>(bytes), bytes_len));
403     }
404 
405     /**
406      * Append the tag and blob to the set.  Copies the blob contents into internal storage; does not
407      * take ownership of the blob's data.
408      */
409     template <keymaster_tag_t Tag>
push_back(TypedTag<KM_BYTES,Tag> tag,const keymaster_blob_t & blob)410     bool push_back(TypedTag<KM_BYTES, Tag> tag, const keymaster_blob_t& blob) {
411         return push_back(tag, blob.data, blob.data_length);
412     }
413 
414     /**
415      * Append the tag and bignum array to the set.  Copies the array into internal storage; does not
416      * take ownership of the passed-in array.
417      */
418     template <keymaster_tag_t Tag>
push_back(TypedTag<KM_BIGNUM,Tag> tag,const void * bytes,size_t bytes_len)419     bool push_back(TypedTag<KM_BIGNUM, Tag> tag, const void* bytes, size_t bytes_len) {
420         return push_back(keymaster_param_blob(tag, static_cast<const uint8_t*>(bytes), bytes_len));
421     }
422 
423     template <keymaster_tag_t Tag, keymaster_tag_type_t Type>
push_back(TypedTag<Type,Tag> tag,typename TypedTag<Type,Tag>::value_type val)424     bool push_back(TypedTag<Type, Tag> tag, typename TypedTag<Type, Tag>::value_type val) {
425         return push_back(Authorization(tag, val));
426     }
427 
428     template <keymaster_tag_t Tag, keymaster_tag_type_t Type>
push_back(TypedTag<Type,Tag> tag,const void * bytes,size_t bytes_len)429     bool push_back(TypedTag<Type, Tag> tag, const void* bytes, size_t bytes_len) {
430         return push_back(Authorization(tag, bytes, bytes_len));
431     }
432 
433     /* Virtual methods from Serializable */
434     size_t SerializedSize() const;
435     uint8_t* Serialize(uint8_t* serialized_set, const uint8_t* end) const;
436     bool Deserialize(const uint8_t** buf_ptr, const uint8_t* end);
437 
438     size_t SerializedSizeOfElements() const;
439 
440   private:
441     void FreeData();
442     void MoveFrom(AuthorizationSet& set);
443 
444     void set_invalid(Error err);
445 
446     static size_t ComputeIndirectDataSize(const keymaster_key_param_t* elems, size_t count);
447     void CopyIndirectData();
448     bool CheckIndirectData();
449 
450     bool DeserializeIndirectData(const uint8_t** buf_ptr, const uint8_t* end);
451     bool DeserializeElementsData(const uint8_t** buf_ptr, const uint8_t* end);
452 
453     bool GetTagValueEnum(keymaster_tag_t tag, uint32_t* val) const;
454     bool GetTagValueEnumRep(keymaster_tag_t tag, size_t instance, uint32_t* val) const;
455     bool GetTagValueInt(keymaster_tag_t tag, uint32_t* val) const;
456     bool GetTagValueIntRep(keymaster_tag_t tag, size_t instance, uint32_t* val) const;
457     bool GetTagValueLong(keymaster_tag_t tag, uint64_t* val) const;
458     bool GetTagValueLongRep(keymaster_tag_t tag, size_t instance, uint64_t* val) const;
459     bool GetTagValueDate(keymaster_tag_t tag, uint64_t* val) const;
460     bool GetTagValueBlob(keymaster_tag_t tag, keymaster_blob_t* val) const;
461     bool GetTagValueBool(keymaster_tag_t tag) const;
462 
463     bool ContainsEnumValue(keymaster_tag_t tag, uint32_t val) const;
464     bool ContainsIntValue(keymaster_tag_t tag, uint32_t val) const;
465 
466     // Define elems_ and elems_size_ as aliases to params and length, respectively.  This is to
467     // avoid using the variables without the trailing underscore in the implementation.
468     keymaster_key_param_t*& elems_ = keymaster_key_param_set_t::params;
469     size_t& elems_size_ = keymaster_key_param_set_t::length;
470 
471     size_t elems_capacity_;
472     uint8_t* indirect_data_;
473     size_t indirect_data_size_;
474     size_t indirect_data_capacity_;
475     Error error_;
476 };
477 
478 class AuthorizationSetBuilder {
479   public:
480     template <typename TagType, typename ValueType>
Authorization(TagType tag,ValueType value)481     AuthorizationSetBuilder& Authorization(TagType tag, ValueType value) {
482         set.push_back(tag, value);
483         return *this;
484     }
485 
486     template <keymaster_tag_t Tag>
Authorization(TypedTag<KM_BOOL,Tag> tag)487     AuthorizationSetBuilder& Authorization(TypedTag<KM_BOOL, Tag> tag) {
488         set.push_back(tag);
489         return *this;
490     }
491 
492     template <keymaster_tag_t Tag>
Authorization(TypedTag<KM_INVALID,Tag> tag)493     AuthorizationSetBuilder& Authorization(TypedTag<KM_INVALID, Tag> tag) {
494         keymaster_key_param_t param;
495         param.tag = tag;
496         set.push_back(param);
497         return *this;
498     }
499 
500     template <keymaster_tag_t Tag>
Authorization(TypedTag<KM_BYTES,Tag> tag,const uint8_t * data,size_t data_length)501     AuthorizationSetBuilder& Authorization(TypedTag<KM_BYTES, Tag> tag, const uint8_t* data,
502                                            size_t data_length) {
503         set.push_back(tag, data, data_length);
504         return *this;
505     }
506 
507     template <keymaster_tag_t Tag>
Authorization(TypedTag<KM_BYTES,Tag> tag,const char * data,size_t data_length)508     AuthorizationSetBuilder& Authorization(TypedTag<KM_BYTES, Tag> tag, const char* data,
509                                            size_t data_length) {
510         return Authorization(tag, reinterpret_cast<const uint8_t*>(data), data_length);
511     }
512 
513     AuthorizationSetBuilder& RsaKey(uint32_t key_size, uint64_t public_exponent);
514     AuthorizationSetBuilder& EcdsaKey(uint32_t key_size);
515     AuthorizationSetBuilder& AesKey(uint32_t key_size);
516     AuthorizationSetBuilder& TripleDesKey(uint32_t key_size);
517     AuthorizationSetBuilder& HmacKey(uint32_t key_size);
518 
519     AuthorizationSetBuilder& RsaSigningKey(uint32_t key_size, uint64_t public_exponent);
520     AuthorizationSetBuilder& RsaEncryptionKey(uint32_t key_size, uint64_t public_exponent);
521     AuthorizationSetBuilder& EcdsaSigningKey(uint32_t key_size);
522     AuthorizationSetBuilder& AesEncryptionKey(uint32_t key_size);
523     AuthorizationSetBuilder& TripleDesEncryptionKey(uint32_t key_size);
524 
525     AuthorizationSetBuilder& SigningKey();
526     AuthorizationSetBuilder& EncryptionKey();
527     AuthorizationSetBuilder& NoDigestOrPadding();
528     AuthorizationSetBuilder& EcbMode();
529 
Digest(keymaster_digest_t digest)530     AuthorizationSetBuilder& Digest(keymaster_digest_t digest) {
531         return Authorization(TAG_DIGEST, digest);
532     }
533 
OaepMgfDigest(keymaster_digest_t digest)534     AuthorizationSetBuilder& OaepMgfDigest(keymaster_digest_t digest) {
535         return Authorization(TAG_RSA_OAEP_MGF_DIGEST, digest);
536     }
537 
BlockMode(keymaster_block_mode_t mode)538     AuthorizationSetBuilder& BlockMode(keymaster_block_mode_t mode) {
539         return Authorization(TAG_BLOCK_MODE, mode);
540     }
541 
Padding(keymaster_padding_t padding)542     AuthorizationSetBuilder& Padding(keymaster_padding_t padding) {
543         return Authorization(TAG_PADDING, padding);
544     }
545 
Deduplicate()546     AuthorizationSetBuilder& Deduplicate() {
547         set.Deduplicate();
548         return *this;
549     }
550 
build()551     AuthorizationSet build() const { return set; }
552 
553   private:
554     friend AuthorizationSet;
555     AuthorizationSet set;
556 };
557 
RsaKey(uint32_t key_size,uint64_t public_exponent)558 inline AuthorizationSetBuilder& AuthorizationSetBuilder::RsaKey(uint32_t key_size,
559                                                                 uint64_t public_exponent) {
560     Authorization(TAG_ALGORITHM, KM_ALGORITHM_RSA);
561     Authorization(TAG_KEY_SIZE, key_size);
562     Authorization(TAG_RSA_PUBLIC_EXPONENT, public_exponent);
563     return *this;
564 }
565 
EcdsaKey(uint32_t key_size)566 inline AuthorizationSetBuilder& AuthorizationSetBuilder::EcdsaKey(uint32_t key_size) {
567     Authorization(TAG_ALGORITHM, KM_ALGORITHM_EC);
568     Authorization(TAG_KEY_SIZE, key_size);
569     return *this;
570 }
571 
AesKey(uint32_t key_size)572 inline AuthorizationSetBuilder& AuthorizationSetBuilder::AesKey(uint32_t key_size) {
573     Authorization(TAG_ALGORITHM, KM_ALGORITHM_AES);
574     return Authorization(TAG_KEY_SIZE, key_size);
575 }
576 
TripleDesKey(uint32_t key_size)577 inline AuthorizationSetBuilder& AuthorizationSetBuilder::TripleDesKey(uint32_t key_size) {
578     Authorization(TAG_ALGORITHM, KM_ALGORITHM_TRIPLE_DES);
579     return Authorization(TAG_KEY_SIZE, key_size);
580 }
581 
HmacKey(uint32_t key_size)582 inline AuthorizationSetBuilder& AuthorizationSetBuilder::HmacKey(uint32_t key_size) {
583     Authorization(TAG_ALGORITHM, KM_ALGORITHM_HMAC);
584     Authorization(TAG_KEY_SIZE, key_size);
585     return SigningKey();
586 }
587 
RsaSigningKey(uint32_t key_size,uint64_t public_exponent)588 inline AuthorizationSetBuilder& AuthorizationSetBuilder::RsaSigningKey(uint32_t key_size,
589                                                                        uint64_t public_exponent) {
590     RsaKey(key_size, public_exponent);
591     return SigningKey();
592 }
593 
594 inline AuthorizationSetBuilder&
RsaEncryptionKey(uint32_t key_size,uint64_t public_exponent)595 AuthorizationSetBuilder::RsaEncryptionKey(uint32_t key_size, uint64_t public_exponent) {
596     RsaKey(key_size, public_exponent);
597     return EncryptionKey();
598 }
599 
EcdsaSigningKey(uint32_t key_size)600 inline AuthorizationSetBuilder& AuthorizationSetBuilder::EcdsaSigningKey(uint32_t key_size) {
601     EcdsaKey(key_size);
602     return SigningKey();
603 }
604 
AesEncryptionKey(uint32_t key_size)605 inline AuthorizationSetBuilder& AuthorizationSetBuilder::AesEncryptionKey(uint32_t key_size) {
606     AesKey(key_size);
607     return EncryptionKey();
608 }
609 
TripleDesEncryptionKey(uint32_t key_size)610 inline AuthorizationSetBuilder& AuthorizationSetBuilder::TripleDesEncryptionKey(uint32_t key_size) {
611     TripleDesKey(key_size);
612     return EncryptionKey();
613 }
614 
SigningKey()615 inline AuthorizationSetBuilder& AuthorizationSetBuilder::SigningKey() {
616     Authorization(TAG_PURPOSE, KM_PURPOSE_SIGN);
617     return Authorization(TAG_PURPOSE, KM_PURPOSE_VERIFY);
618 }
619 
EncryptionKey()620 inline AuthorizationSetBuilder& AuthorizationSetBuilder::EncryptionKey() {
621     Authorization(TAG_PURPOSE, KM_PURPOSE_ENCRYPT);
622     return Authorization(TAG_PURPOSE, KM_PURPOSE_DECRYPT);
623 }
624 
NoDigestOrPadding()625 inline AuthorizationSetBuilder& AuthorizationSetBuilder::NoDigestOrPadding() {
626     Authorization(TAG_DIGEST, KM_DIGEST_NONE);
627     return Authorization(TAG_PADDING, KM_PAD_NONE);
628 }
629 
EcbMode()630 inline AuthorizationSetBuilder& AuthorizationSetBuilder::EcbMode() {
631     return Authorization(TAG_BLOCK_MODE, KM_MODE_ECB);
632 }
633 
634 class AuthProxyIterator {
635     constexpr static size_t invalid = ~size_t(0);
636 
637   public:
AuthProxyIterator()638     AuthProxyIterator() : pos_(invalid), auth_set1_(nullptr), auth_set2_(nullptr) {}
AuthProxyIterator(const AuthorizationSet & auth_set1,const AuthorizationSet & auth_set2)639     AuthProxyIterator(const AuthorizationSet& auth_set1, const AuthorizationSet& auth_set2)
640         : pos_(0), auth_set1_(&auth_set1), auth_set2_(&auth_set2) {}
AuthProxyIterator(const AuthProxyIterator & rhs)641     AuthProxyIterator(const AuthProxyIterator& rhs)
642         : pos_(rhs.pos_), auth_set1_(rhs.auth_set1_), auth_set2_(rhs.auth_set2_) {}
~AuthProxyIterator()643     ~AuthProxyIterator(){};
644     AuthProxyIterator& operator=(const AuthProxyIterator& rhs) {
645         if (this != &rhs) {
646             pos_ = rhs.pos_;
647             auth_set1_ = rhs.auth_set1_;
648             auth_set2_ = rhs.auth_set2_;
649         }
650         return *this;
651     }
652     AuthProxyIterator& operator++() {
653         if (pos_ == invalid) return *this;
654         ++pos_;
655         if (pos_ == (auth_set1_->size() + auth_set2_->size())) {
656             pos_ = invalid;
657         }
658         return *this;
659     }
660     const keymaster_key_param_t& operator*() const {
661         if (pos_ < auth_set1_->size()) {
662             return (*auth_set1_)[pos_];
663         } else {
664             return (*auth_set2_)[pos_ - auth_set1_->size()];
665         }
666     }
667     const AuthProxyIterator operator++(int) {
668         AuthProxyIterator dummy(*this);
669         ++(*this);
670         return dummy;
671     }
672     const keymaster_key_param_t* operator->() const { return &(*(*this)); }
673 
674     bool operator==(const AuthProxyIterator& rhs) {
675         if (pos_ == rhs.pos_) {
676             return pos_ == invalid ||
677                    (auth_set1_ == rhs.auth_set1_ && auth_set2_ == rhs.auth_set2_);
678         } else
679             return false;
680     }
681     bool operator!=(const AuthProxyIterator& rhs) { return !operator==(rhs); }
682 
683   private:
684     size_t pos_;
685     const AuthorizationSet* auth_set1_;
686     const AuthorizationSet* auth_set2_;
687 };
688 
689 class AuthProxy {
690   public:
AuthProxy(const AuthorizationSet & hw_enforced,const AuthorizationSet & sw_enforced)691     AuthProxy(const AuthorizationSet& hw_enforced, const AuthorizationSet& sw_enforced)
692         : hw_enforced_(hw_enforced), sw_enforced_(sw_enforced) {}
693 
Contains(ARGS &&...args)694     template <typename... ARGS> bool Contains(ARGS&&... args) const {
695         return hw_enforced_.Contains(forward<ARGS>(args)...) ||
696                sw_enforced_.Contains(forward<ARGS>(args)...);
697     }
698 
GetTagValue(ARGS &&...args)699     template <typename... ARGS> bool GetTagValue(ARGS&&... args) const {
700         return hw_enforced_.GetTagValue(forward<ARGS>(args)...) ||
701                sw_enforced_.GetTagValue(forward<ARGS>(args)...);
702     }
703 
GetTagCount(ARGS &&...args)704     template <typename... ARGS> bool GetTagCount(ARGS&&... args) const {
705         return hw_enforced_.GetTagCount(forward<ARGS>(args)...) ||
706                sw_enforced_.GetTagCount(forward<ARGS>(args)...);
707     }
708 
begin()709     AuthProxyIterator begin() const { return AuthProxyIterator(hw_enforced_, sw_enforced_); }
710 
end()711     AuthProxyIterator end() const { return AuthProxyIterator(); }
712 
size()713     size_t size() const { return hw_enforced_.size() + sw_enforced_.size(); }
714 
715     keymaster_key_param_t operator[](size_t pos) const {
716         if (pos < hw_enforced_.size()) return hw_enforced_[pos];
717         if ((pos - hw_enforced_.size()) < sw_enforced_.size()) {
718             return sw_enforced_[pos - hw_enforced_.size()];
719         }
720         return {};
721     }
722 
723   private:
724     const AuthorizationSet& hw_enforced_;
725     const AuthorizationSet& sw_enforced_;
726 };
727 
728 }  // namespace keymaster
729