1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #pragma once
18
19 #include <aidl/android/hardware/security/keymint/Algorithm.h>
20 #include <aidl/android/hardware/security/keymint/BlockMode.h>
21 #include <aidl/android/hardware/security/keymint/Digest.h>
22 #include <aidl/android/hardware/security/keymint/EcCurve.h>
23 #include <aidl/android/hardware/security/keymint/HardwareAuthenticatorType.h>
24 #include <aidl/android/hardware/security/keymint/KeyOrigin.h>
25 #include <aidl/android/hardware/security/keymint/KeyParameter.h>
26 #include <aidl/android/hardware/security/keymint/KeyPurpose.h>
27 #include <aidl/android/hardware/security/keymint/PaddingMode.h>
28 #include <aidl/android/hardware/security/keymint/SecurityLevel.h>
29 #include <aidl/android/hardware/security/keymint/Tag.h>
30 #include <aidl/android/hardware/security/keymint/TagType.h>
31
32 namespace aidl::android::hardware::security::keymint {
33
typeFromTag(Tag tag)34 constexpr TagType typeFromTag(Tag tag) {
35 return static_cast<TagType>(static_cast<uint32_t>(tag) & static_cast<uint32_t>(0xf0000000));
36 }
37
38 /**
39 * TypedTag is a templatized version of Tag, which provides compile-time checking of KeyMint tag
40 * types. Instances are convertible to Tag, so they can be used wherever Tag is expected, and
41 * because they encode the tag type it's possible to create function overloads that only operate on
42 * tags with a particular type.
43 */
44 template <TagType tag_type, Tag tag>
45 struct TypedTag {
TypedTagTypedTag46 inline TypedTag() {
47 // Ensure that it's impossible to create a TypedTag instance whose 'tag' doesn't have type
48 // 'tag_type'. Attempting to instantiate a tag with the wrong type will result in a compile
49 // error (no match for template specialization StaticAssert<false>), with no run-time cost.
50 static_assert(typeFromTag(tag) == tag_type, "mismatch between tag and tag_type");
51 }
TagTypedTag52 operator Tag() const { return tag; }
maskedTagTypedTag53 int32_t maskedTag() { return static_cast<uint32_t>(tag) & 0x0FFFFFFF; }
54 };
55
56 template <Tag tag>
57 struct Tag2TypedTag {
58 typedef TypedTag<typeFromTag(tag), tag> type;
59 };
60
61 #ifdef DECLARE_TYPED_TAG
62 #undef DECLARE_TYPED_TAG
63 #endif
64
65 #define DECLARE_TYPED_TAG(name) \
66 typedef typename Tag2TypedTag<Tag::name>::type TAG_##name##_t; \
67 static TAG_##name##_t TAG_##name;
68
69 DECLARE_TYPED_TAG(ACTIVE_DATETIME);
70 DECLARE_TYPED_TAG(ALGORITHM);
71 DECLARE_TYPED_TAG(ALLOW_WHILE_ON_BODY);
72 DECLARE_TYPED_TAG(APPLICATION_DATA);
73 DECLARE_TYPED_TAG(APPLICATION_ID);
74 DECLARE_TYPED_TAG(ASSOCIATED_DATA);
75 DECLARE_TYPED_TAG(ATTESTATION_APPLICATION_ID);
76 DECLARE_TYPED_TAG(ATTESTATION_CHALLENGE);
77 DECLARE_TYPED_TAG(ATTESTATION_ID_BRAND);
78 DECLARE_TYPED_TAG(ATTESTATION_ID_DEVICE);
79 DECLARE_TYPED_TAG(ATTESTATION_ID_IMEI);
80 DECLARE_TYPED_TAG(ATTESTATION_ID_SECOND_IMEI);
81 DECLARE_TYPED_TAG(ATTESTATION_ID_MANUFACTURER);
82 DECLARE_TYPED_TAG(ATTESTATION_ID_MEID);
83 DECLARE_TYPED_TAG(ATTESTATION_ID_PRODUCT);
84 DECLARE_TYPED_TAG(ATTESTATION_ID_MODEL);
85 DECLARE_TYPED_TAG(ATTESTATION_ID_SERIAL);
86 DECLARE_TYPED_TAG(AUTH_TIMEOUT);
87 DECLARE_TYPED_TAG(BLOCK_MODE);
88 DECLARE_TYPED_TAG(BOOTLOADER_ONLY);
89 DECLARE_TYPED_TAG(BOOT_PATCHLEVEL);
90 DECLARE_TYPED_TAG(CALLER_NONCE);
91 DECLARE_TYPED_TAG(CONFIRMATION_TOKEN);
92 DECLARE_TYPED_TAG(CREATION_DATETIME);
93 DECLARE_TYPED_TAG(DEVICE_UNIQUE_ATTESTATION);
94 DECLARE_TYPED_TAG(DIGEST);
95 DECLARE_TYPED_TAG(EARLY_BOOT_ONLY);
96 DECLARE_TYPED_TAG(EC_CURVE);
97 DECLARE_TYPED_TAG(HARDWARE_TYPE);
98 DECLARE_TYPED_TAG(IDENTITY_CREDENTIAL_KEY);
99 DECLARE_TYPED_TAG(INCLUDE_UNIQUE_ID);
100 DECLARE_TYPED_TAG(INVALID);
101 DECLARE_TYPED_TAG(KEY_SIZE);
102 DECLARE_TYPED_TAG(MAC_LENGTH);
103 DECLARE_TYPED_TAG(MAX_USES_PER_BOOT);
104 DECLARE_TYPED_TAG(MIN_MAC_LENGTH);
105 DECLARE_TYPED_TAG(MIN_SECONDS_BETWEEN_OPS);
106 DECLARE_TYPED_TAG(NONCE);
107 DECLARE_TYPED_TAG(NO_AUTH_REQUIRED);
108 DECLARE_TYPED_TAG(ORIGIN);
109 DECLARE_TYPED_TAG(ORIGINATION_EXPIRE_DATETIME);
110 DECLARE_TYPED_TAG(OS_PATCHLEVEL);
111 DECLARE_TYPED_TAG(OS_VERSION);
112 DECLARE_TYPED_TAG(PADDING);
113 DECLARE_TYPED_TAG(PURPOSE);
114 DECLARE_TYPED_TAG(RESET_SINCE_ID_ROTATION);
115 DECLARE_TYPED_TAG(ROLLBACK_RESISTANCE);
116 DECLARE_TYPED_TAG(ROOT_OF_TRUST);
117 DECLARE_TYPED_TAG(RSA_PUBLIC_EXPONENT);
118 DECLARE_TYPED_TAG(STORAGE_KEY);
119 DECLARE_TYPED_TAG(TRUSTED_CONFIRMATION_REQUIRED);
120 DECLARE_TYPED_TAG(TRUSTED_USER_PRESENCE_REQUIRED);
121 DECLARE_TYPED_TAG(UNIQUE_ID);
122 DECLARE_TYPED_TAG(UNLOCKED_DEVICE_REQUIRED);
123 DECLARE_TYPED_TAG(USAGE_COUNT_LIMIT);
124 DECLARE_TYPED_TAG(USAGE_EXPIRE_DATETIME);
125 DECLARE_TYPED_TAG(USER_AUTH_TYPE);
126 DECLARE_TYPED_TAG(USER_ID);
127 DECLARE_TYPED_TAG(USER_SECURE_ID);
128 DECLARE_TYPED_TAG(VENDOR_PATCHLEVEL);
129 DECLARE_TYPED_TAG(RSA_OAEP_MGF_DIGEST);
130 DECLARE_TYPED_TAG(CERTIFICATE_SERIAL);
131 DECLARE_TYPED_TAG(CERTIFICATE_SUBJECT);
132 DECLARE_TYPED_TAG(CERTIFICATE_NOT_BEFORE);
133 DECLARE_TYPED_TAG(CERTIFICATE_NOT_AFTER);
134 DECLARE_TYPED_TAG(MAX_BOOT_LEVEL);
135
136 #undef DECLARE_TYPED_TAG
137
138 template <typename... Elems>
139 struct MetaList {};
140
141 using all_tags_t = MetaList<
142 TAG_INVALID_t, TAG_KEY_SIZE_t, TAG_MAC_LENGTH_t, TAG_CALLER_NONCE_t, TAG_MIN_MAC_LENGTH_t,
143 TAG_RSA_PUBLIC_EXPONENT_t, TAG_INCLUDE_UNIQUE_ID_t, TAG_ACTIVE_DATETIME_t,
144 TAG_ORIGINATION_EXPIRE_DATETIME_t, TAG_USAGE_EXPIRE_DATETIME_t,
145 TAG_MIN_SECONDS_BETWEEN_OPS_t, TAG_MAX_USES_PER_BOOT_t, TAG_USAGE_COUNT_LIMIT_t,
146 TAG_USER_ID_t, TAG_USER_SECURE_ID_t, TAG_NO_AUTH_REQUIRED_t, TAG_AUTH_TIMEOUT_t,
147 TAG_ALLOW_WHILE_ON_BODY_t, TAG_UNLOCKED_DEVICE_REQUIRED_t, TAG_APPLICATION_ID_t,
148 TAG_APPLICATION_DATA_t, TAG_CREATION_DATETIME_t, TAG_ROLLBACK_RESISTANCE_t,
149 TAG_HARDWARE_TYPE_t, TAG_ROOT_OF_TRUST_t, TAG_ASSOCIATED_DATA_t, TAG_NONCE_t,
150 TAG_BOOTLOADER_ONLY_t, TAG_OS_VERSION_t, TAG_OS_PATCHLEVEL_t, TAG_UNIQUE_ID_t,
151 TAG_ATTESTATION_CHALLENGE_t, TAG_ATTESTATION_APPLICATION_ID_t, TAG_ATTESTATION_ID_BRAND_t,
152 TAG_ATTESTATION_ID_DEVICE_t, TAG_ATTESTATION_ID_PRODUCT_t,
153 TAG_ATTESTATION_ID_MANUFACTURER_t, TAG_ATTESTATION_ID_MODEL_t,
154 TAG_RESET_SINCE_ID_ROTATION_t, TAG_PURPOSE_t, TAG_ALGORITHM_t, TAG_BLOCK_MODE_t,
155 TAG_DIGEST_t, TAG_PADDING_t, TAG_ORIGIN_t, TAG_USER_AUTH_TYPE_t, TAG_EC_CURVE_t,
156 TAG_BOOT_PATCHLEVEL_t, TAG_VENDOR_PATCHLEVEL_t, TAG_TRUSTED_CONFIRMATION_REQUIRED_t,
157 TAG_TRUSTED_USER_PRESENCE_REQUIRED_t, TAG_CERTIFICATE_SERIAL_t, TAG_CERTIFICATE_SUBJECT_t>;
158
159 template <typename TypedTagType>
160 struct TypedTag2ValueType;
161
162 #ifdef MAKE_TAG_VALUE_ACCESSOR
163 #undef MAKE_TAG_VALUE_ACCESSOR
164 #endif
165
166 #define MAKE_TAG_VALUE_ACCESSOR(tag_type, field_name) \
167 template <Tag tag> \
168 struct TypedTag2ValueType<TypedTag<tag_type, tag>> { \
169 using type = std::remove_reference< \
170 decltype(static_cast<KeyParameterValue*>(nullptr) \
171 ->get<KeyParameterValue::field_name>())>::type; \
172 static constexpr KeyParameterValue::Tag unionTag = KeyParameterValue::field_name; \
173 }; \
174 template <Tag tag> \
175 inline std::optional<std::reference_wrapper< \
176 const typename TypedTag2ValueType<TypedTag<tag_type, tag>>::type>> \
177 accessTagValue(TypedTag<tag_type, tag>, const KeyParameter& param) { \
178 if (param.value.getTag() == KeyParameterValue::field_name) { \
179 return std::optional( \
180 std::reference_wrapper(param.value.get<KeyParameterValue::field_name>())); \
181 } else { \
182 return std::nullopt; \
183 } \
184 } \
185 template <Tag tag> \
186 inline std::optional< \
187 std::reference_wrapper<typename TypedTag2ValueType<TypedTag<tag_type, tag>>::type>> \
188 accessTagValue(TypedTag<tag_type, tag>, KeyParameter& param) { \
189 if (param.value.getTag() == KeyParameterValue::field_name) { \
190 return std::optional( \
191 std::reference_wrapper(param.value.get<KeyParameterValue::field_name>())); \
192 } else { \
193 return std::nullopt; \
194 } \
195 }
196
MAKE_TAG_VALUE_ACCESSOR(TagType::ULONG,longInteger)197 MAKE_TAG_VALUE_ACCESSOR(TagType::ULONG, longInteger)
198 MAKE_TAG_VALUE_ACCESSOR(TagType::ULONG_REP, longInteger)
199 MAKE_TAG_VALUE_ACCESSOR(TagType::DATE, dateTime)
200 MAKE_TAG_VALUE_ACCESSOR(TagType::UINT, integer)
201 MAKE_TAG_VALUE_ACCESSOR(TagType::UINT_REP, integer)
202 MAKE_TAG_VALUE_ACCESSOR(TagType::BOOL, boolValue)
203 MAKE_TAG_VALUE_ACCESSOR(TagType::BYTES, blob)
204 MAKE_TAG_VALUE_ACCESSOR(TagType::BIGNUM, blob)
205
206 #undef MAKE_TAG_VALUE_ACCESSOR
207
208 #ifdef MAKE_TAG_ENUM_VALUE_ACCESSOR
209 #undef MAKE_TAG_ENUM_VALUE_ACCESSOR
210 #endif
211
212 #define MAKE_TAG_ENUM_VALUE_ACCESSOR(typed_tag, field_name) \
213 template <> \
214 struct TypedTag2ValueType<decltype(typed_tag)> { \
215 using type = std::remove_reference< \
216 decltype(static_cast<KeyParameterValue*>(nullptr) \
217 ->get<KeyParameterValue::field_name>())>::type; \
218 static constexpr KeyParameterValue::Tag unionTag = KeyParameterValue::field_name; \
219 }; \
220 inline std::optional< \
221 std::reference_wrapper<const typename TypedTag2ValueType<decltype(typed_tag)>::type>> \
222 accessTagValue(decltype(typed_tag), const KeyParameter& param) { \
223 if (param.value.getTag() == KeyParameterValue::field_name) { \
224 return std::optional( \
225 std::reference_wrapper(param.value.get<KeyParameterValue::field_name>())); \
226 } else { \
227 return std::nullopt; \
228 } \
229 } \
230 inline std::optional< \
231 std::reference_wrapper<typename TypedTag2ValueType<decltype(typed_tag)>::type>> \
232 accessTagValue(decltype(typed_tag), KeyParameter& param) { \
233 if (param.value.getTag() == KeyParameterValue::field_name) { \
234 return std::optional( \
235 std::reference_wrapper(param.value.get<KeyParameterValue::field_name>())); \
236 } else { \
237 return std::nullopt; \
238 } \
239 }
240
241 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_ALGORITHM, algorithm)
242 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_BLOCK_MODE, blockMode)
243 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_DIGEST, digest)
244 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_EC_CURVE, ecCurve)
245 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_ORIGIN, origin)
246 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_PADDING, paddingMode)
247 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_PURPOSE, keyPurpose)
248 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_USER_AUTH_TYPE, hardwareAuthenticatorType)
249 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_HARDWARE_TYPE, securityLevel)
250 MAKE_TAG_ENUM_VALUE_ACCESSOR(TAG_RSA_OAEP_MGF_DIGEST, digest)
251
252 #undef MAKE_TAG_ENUM_VALUE_ACCESSOR
253
254 template <TagType tag_type, Tag tag, typename ValueT>
255 inline KeyParameter makeKeyParameter(TypedTag<tag_type, tag> ttag, ValueT&& value) {
256 KeyParameter retval;
257 retval.tag = tag;
258 retval.value = KeyParameterValue::make<TypedTag2ValueType<decltype(ttag)>::unionTag>(
259 std::forward<ValueT>(value));
260 return retval;
261 }
262
263 // the boolean case
264 template <Tag tag>
makeKeyParameter(TypedTag<TagType::BOOL,tag>)265 inline KeyParameter makeKeyParameter(TypedTag<TagType::BOOL, tag>) {
266 KeyParameter retval;
267 retval.tag = tag;
268 retval.value = KeyParameterValue::make<KeyParameterValue::boolValue>(true);
269 return retval;
270 }
271
272 // the invalid case
makeKeyParameter(TypedTag<TagType::INVALID,Tag::INVALID>)273 inline KeyParameter makeKeyParameter(TypedTag<TagType::INVALID, Tag::INVALID>) {
274 KeyParameter retval;
275 retval.tag = Tag::INVALID;
276 retval.value = KeyParameterValue::make<KeyParameterValue::invalid>(0);
277 return retval;
278 }
279
280 template <typename... Pack>
281 struct FirstOrNoneHelper;
282 template <typename First>
283 struct FirstOrNoneHelper<First> {
284 typedef First type;
285 };
286 template <>
287 struct FirstOrNoneHelper<> {
288 struct type {};
289 };
290
291 template <typename... Pack>
292 using FirstOrNone = typename FirstOrNoneHelper<Pack...>::type;
293
294 template <TagType tag_type, Tag tag, typename... Args>
295 inline KeyParameter Authorization(TypedTag<tag_type, tag> ttag, Args&&... args) {
296 static_assert(tag_type != TagType::BOOL || (sizeof...(args) == 0),
297 "TagType::BOOL Authorizations do not take parameters. Presence is truth.");
298 static_assert(tag_type == TagType::BOOL || (sizeof...(args) == 1),
299 "Authorization other then TagType::BOOL take exactly one parameter.");
300 static_assert(
301 tag_type == TagType::BOOL ||
302 std::is_convertible<
303 std::remove_cv_t<std::remove_reference_t<FirstOrNone<Args...>>>,
304 typename TypedTag2ValueType<TypedTag<tag_type, tag>>::type>::value,
305 "Invalid argument type for given tag.");
306
307 return makeKeyParameter(ttag, std::forward<Args>(args)...);
308 }
309
310 template <typename T>
311 std::remove_reference_t<T> NullOrOr(T&& v) {
312 if (v) return v;
313 return {};
314 }
315
316 template <typename Head, typename... Tail>
317 std::remove_reference_t<Head> NullOrOr(Head&& head, Tail&&... tail) {
318 if (head) return head;
319 return NullOrOr(std::forward<Tail>(tail)...);
320 }
321
322 template <typename Default, typename Wrapped>
323 std::remove_reference_t<Wrapped> defaultOr(std::optional<Wrapped>&& optional, Default&& def) {
324 static_assert(std::is_convertible<std::remove_reference_t<Default>,
325 std::remove_reference_t<Wrapped>>::value,
326 "Type of default value must match the type wrapped by std::optional");
327 if (optional) return *optional;
328 return def;
329 }
330
331 template <TagType tag_type, Tag tag>
332 inline std::optional<
333 std::reference_wrapper<const typename TypedTag2ValueType<TypedTag<tag_type, tag>>::type>>
334 authorizationValue(TypedTag<tag_type, tag> ttag, const KeyParameter& param) {
335 // We only check if the parameter has the correct tag here; accessTagValue checks if the correct
336 // union field was initialized.
337 if (tag != param.tag) return {};
338 return accessTagValue(ttag, param);
339 }
340
341 } // namespace aidl::android::hardware::security::keymint
342