1 //
2 // Copyright (C) 2020 The Android Open Source Project
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 // http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15
16 #include "host/commands/secure_env/tpm_attestation_record.h"
17
18 #include <keymaster/contexts/soft_attestation_cert.h>
19 #include <keymaster/km_openssl/attestation_record.h>
20
21 #include <openssl/rand.h>
22
23 #include <android-base/logging.h>
24
25 namespace cuttlefish {
26
27 namespace {
28 using VerifiedBootParams = keymaster::AttestationContext::VerifiedBootParams;
29 using keymaster::AuthorizationSet;
30
MakeVbParams()31 VerifiedBootParams MakeVbParams() {
32 VerifiedBootParams vb_params;
33
34 // TODO: If Cuttlefish ever supports a boot state other than "orange", we'll
35 // also need to plumb in the public key.
36 static uint8_t empty_vb_key[32] = {};
37 vb_params.verified_boot_key = {empty_vb_key, sizeof(empty_vb_key)};
38 vb_params.verified_boot_hash = {empty_vb_key, sizeof(empty_vb_key)};
39 vb_params.verified_boot_state = KM_VERIFIED_BOOT_UNVERIFIED;
40 vb_params.device_locked = false;
41 return vb_params;
42 }
43
44 } // namespace
45
TpmAttestationRecordContext()46 TpmAttestationRecordContext::TpmAttestationRecordContext()
47 : keymaster::AttestationContext(::keymaster::KmVersion::KEYMINT_2),
48 vb_params_(MakeVbParams()),
49 unique_id_hbk_(16) {
50 RAND_bytes(unique_id_hbk_.data(), unique_id_hbk_.size());
51 }
52
GetSecurityLevel() const53 keymaster_security_level_t TpmAttestationRecordContext::GetSecurityLevel() const {
54 return KM_SECURITY_LEVEL_TRUSTED_ENVIRONMENT;
55 }
56
VerifyAndCopyDeviceIds(const AuthorizationSet &,AuthorizationSet *) const57 keymaster_error_t TpmAttestationRecordContext::VerifyAndCopyDeviceIds(
58 const AuthorizationSet& /*attestation_params*/,
59 AuthorizationSet* /*attestation*/) const {
60 LOG(DEBUG) << "TODO(schuffelen): Implement VerifyAndCopyDeviceIds";
61 return KM_ERROR_UNIMPLEMENTED;
62 }
63
GenerateUniqueId(uint64_t creation_date_time,const keymaster_blob_t & application_id,bool reset_since_rotation,keymaster_error_t * error) const64 keymaster::Buffer TpmAttestationRecordContext::GenerateUniqueId(
65 uint64_t creation_date_time, const keymaster_blob_t& application_id,
66 bool reset_since_rotation, keymaster_error_t* error) const {
67 *error = KM_ERROR_OK;
68 return keymaster::generate_unique_id(unique_id_hbk_, creation_date_time,
69 application_id, reset_since_rotation);
70 }
71
GetVerifiedBootParams(keymaster_error_t * error) const72 const VerifiedBootParams* TpmAttestationRecordContext::GetVerifiedBootParams(
73 keymaster_error_t* error) const {
74 *error = KM_ERROR_OK;
75 return &vb_params_;
76 }
77
78 keymaster::KeymasterKeyBlob
GetAttestationKey(keymaster_algorithm_t algorithm,keymaster_error_t * error) const79 TpmAttestationRecordContext::GetAttestationKey(keymaster_algorithm_t algorithm,
80 keymaster_error_t* error) const {
81 return keymaster::KeymasterKeyBlob(*keymaster::getAttestationKey(algorithm, error));
82 }
83
84 keymaster::CertificateChain
GetAttestationChain(keymaster_algorithm_t algorithm,keymaster_error_t * error) const85 TpmAttestationRecordContext::GetAttestationChain(keymaster_algorithm_t algorithm,
86 keymaster_error_t* error) const {
87 return keymaster::getAttestationChain(algorithm, error);
88 }
89
SetVerifiedBootInfo(std::string_view verified_boot_state,std::string_view bootloader_state,const std::vector<uint8_t> & vbmeta_digest)90 void TpmAttestationRecordContext::SetVerifiedBootInfo(
91 std::string_view verified_boot_state, std::string_view bootloader_state,
92 const std::vector<uint8_t>& vbmeta_digest) {
93 vbmeta_digest_ = vbmeta_digest;
94 vb_params_.verified_boot_hash = {vbmeta_digest_.data(),
95 vbmeta_digest_.size()};
96
97 if (verified_boot_state == "green") {
98 vb_params_.verified_boot_state = KM_VERIFIED_BOOT_VERIFIED;
99 } else if (verified_boot_state == "yellow") {
100 vb_params_.verified_boot_state = KM_VERIFIED_BOOT_SELF_SIGNED;
101 } else if (verified_boot_state == "red") {
102 vb_params_.verified_boot_state = KM_VERIFIED_BOOT_FAILED;
103 } else { // Default to orange
104 vb_params_.verified_boot_state = KM_VERIFIED_BOOT_UNVERIFIED;
105 }
106
107 vb_params_.device_locked = bootloader_state == "locked";
108 }
109
110 } // namespace cuttlefish
111