1 // 2 // Copyright (C) 2020 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 16 #pragma once 17 18 #include <memory> 19 #include <string> 20 #include <vector> 21 22 #include <tss2/tss2_esys.h> 23 #include <tss2/tss2_tpm2_types.h> 24 #include <json/json.h> 25 26 #include "host/commands/secure_env/gatekeeper_storage.h" 27 #include "host/commands/secure_env/tpm_resource_manager.h" 28 29 namespace cuttlefish { 30 31 /** 32 * Manager for data stored inside the TPM with an index outside of the TPM. The 33 * contents of the data cannot be corrupted or decrypted by accessing the index, 34 * but the index can be corrupted by an attacker. 35 * 36 * As the actual data is stored inside the TPM, a replay attack can be used to 37 * restore deleted index entries or hide revert to before an index entry was 38 * added, but not change the contents that an index points to if it still 39 * exists. 40 * 41 * This class is not thread-safe, and should be synchronized externally if it 42 * is going to be used from multiple threads. 43 */ 44 class FragileTpmStorage : public GatekeeperStorage { 45 public: 46 FragileTpmStorage(TpmResourceManager&, const std::string& index_file); 47 ~FragileTpmStorage() = default; 48 49 bool Allocate(const Json::Value& key, uint16_t size) override; 50 bool HasKey(const Json::Value& key) const override; 51 52 std::unique_ptr<TPM2B_MAX_NV_BUFFER> Read(const Json::Value& key) const 53 override; 54 bool Write(const Json::Value& key, const TPM2B_MAX_NV_BUFFER& data) override; 55 private: 56 TPM2_HANDLE GetHandle(const Json::Value& key) const; 57 TPM2_HANDLE GenerateRandomHandle(); 58 59 TpmResourceManager& resource_manager_; 60 std::string index_file_; 61 Json::Value index_; 62 }; 63 64 } // namespace cuttlefish 65