1 // 2 // Copyright (C) 2020 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 16 #pragma once 17 18 #include "gatekeeper/gatekeeper.h" 19 #include "tss2/tss2_esys.h" 20 21 #include "host/commands/secure_env/gatekeeper_storage.h" 22 #include "host/commands/secure_env/tpm_resource_manager.h" 23 24 namespace cuttlefish { 25 26 /** 27 * See method descriptions for this class in 28 * system/gatekeeper/include/gatekeeper/gatekeeper.h 29 */ 30 class TpmGatekeeper : public gatekeeper::GateKeeper { 31 public: 32 TpmGatekeeper( 33 TpmResourceManager& resource_manager, 34 GatekeeperStorage& secure_storage, 35 GatekeeperStorage& insecure_storage); 36 37 bool GetAuthTokenKey( 38 const uint8_t** auth_token_key, uint32_t* length) const override; 39 40 void GetPasswordKey(const uint8_t** pasword_key, uint32_t* length) override; 41 42 void ComputePasswordSignature( 43 uint8_t* signature, 44 uint32_t signature_length, 45 const uint8_t* key, 46 uint32_t key_length, 47 const uint8_t* password, 48 uint32_t password_length, 49 gatekeeper::salt_t salt) const override; 50 51 void GetRandom(void* random, uint32_t requested_size) const override; 52 53 void ComputeSignature( 54 uint8_t* signature, 55 uint32_t signature_length, 56 const uint8_t* key, 57 uint32_t key_length, 58 const uint8_t* message, 59 uint32_t length) const override; 60 61 uint64_t GetMillisecondsSinceBoot() const override; 62 63 /** 64 * Retrieves the failure record for user `uid`, assuming a user secret value 65 * of `user_id`. If the secret value `user_id` is incorrect, the original 66 * secret `user_id` value will be lost and cannot be recovered. 67 */ 68 bool GetFailureRecord( 69 uint32_t uid, 70 gatekeeper::secure_id_t user_id, 71 gatekeeper::failure_record_t *record, 72 bool secure) override; 73 74 bool ClearFailureRecord( 75 uint32_t uid, gatekeeper::secure_id_t user_id, bool secure) override; 76 77 bool WriteFailureRecord( 78 uint32_t uid, gatekeeper::failure_record_t *record, bool secure) override; 79 80 bool IsHardwareBacked() const override; 81 private: 82 TpmResourceManager& resource_manager_; 83 GatekeeperStorage& secure_storage_; 84 GatekeeperStorage& insecure_storage_; 85 }; 86 87 } // namespace cuttlefish 88