android-16.0.0_r2/s

/*
 * Copyright (C) 2025 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

//! The implementation of the `IAuthMgrAuthorization` AIDL interface.
//#![allow(dead_code)]
use android_hardware_security_see_authmgr::aidl::android::hardware::security::see::authmgr::{
    DiceLeafArtifacts::DiceLeafArtifacts,
    DicePolicy::DicePolicy,
    ExplicitKeyDiceCertChain::ExplicitKeyDiceCertChain,
    IAuthMgrAuthorization::{BnAuthMgrAuthorization, IAuthMgrAuthorization},
    SignedConnectionRequest::SignedConnectionRequest,
};
use android_hardware_security_see_authmgr::binder;
use authgraph_core::key::{CertChain, InstanceIdentifier};
use authmgr_be::{
    am_err,
    authorization::AuthMgrBE,
    data_structures::{AuthenticatedConnectionState, MemoryLimits},
    error::{Error, ErrorCode},
    traits::{Device, RawConnection, RpcConnection},
};
use authmgr_be_impl::mock_storage::MockPersistentStorage;
use authmgr_common::signed_connection_request::{
    TransportID, TEMP_AUTHMGR_BE_TRANSPORT_ID, TEMP_AUTHMGR_FE_TRANSPORT_ID,
};
use authmgr_handover_aidl::aidl::android::trusty::handover::ITrustedServicesHandover::ITrustedServicesHandover;
use binder::ParcelFileDescriptor;
use binder::SpIBinder;
use binder::Strong;
use log::error;
use rpcbinder::{FileDescriptorTransportMode, RpcSession};
use std::ffi::CStr;
use std::os::fd::FromRawFd;
use std::os::fd::OwnedFd;
use std::sync::Arc;
use std::sync::Mutex;
use tipc::Handle;

// TODO: b/400118241. Construct the handover service's port from the given service name.
// For now, hardcode the port for the handover service of the HelloWorld TA.
const HANDOVER_SERVICE_PORT: &CStr = c"com.android.trusty.rust.handover.hello.service.V1";

/// Represents a per-session RPC binder object which implements the `IAuthMgrAuthorization`
/// interface. This encapsulates the connection information as well as the global state of the
/// AuthMgr Authorization service.
/// `global_state` is shared across the all the binder RPC root objects of
///  `AuthMgrAuthorizationRPCService` and the AuthMgr main service of this TA.
/// `connection_information` is shared across multiple binder RPC sessions of the samme connection.
/// Therefore, we are not locking both mutexes together. In the usage of both mutexes (which is
/// in the below implementation of `AuthMgrAuthorizationRPCService`, the locks on them should be
/// grabbed in the same order as they are ordered in the struct below.
pub struct AuthMgrAuthorizationRPCService {
    global_state: Arc<Mutex<AuthMgrGlobalState>>,
    connection_information: Arc<Mutex<RpcConnectionInformation>>,
}

impl binder::Interface for AuthMgrAuthorizationRPCService {}

impl AuthMgrAuthorizationRPCService {
    // TODO: b/392905377. Expect transport id (i.e. VM-ID) to be passed into this method
    pub fn new_authorization_session(
        global_state: Arc<Mutex<AuthMgrGlobalState>>,
    ) -> Option<SpIBinder> {
        let connection_information =
            RpcConnectionInformation::new(TEMP_AUTHMGR_FE_TRANSPORT_ID, None);
        let authmgr_authorization = AuthMgrAuthorizationRPCService {
            global_state,
            connection_information: Arc::new(Mutex::new(connection_information)),
        };
        Some(
            BnAuthMgrAuthorization::new_binder(
                authmgr_authorization,
                binder::BinderFeatures::default(),
            )
            .as_binder(),
        )
    }
}

impl Drop for AuthMgrAuthorizationRPCService {
    fn drop(&mut self) {
        let mut global_state = self.global_state.lock().unwrap();
        let mut connection_info = self.connection_information.lock().unwrap();
        let _ = global_state
            .authmgr_core
            .clear_cache_upon_main_connection_close(&mut *connection_info)
            .map_err(|e| {
                error!("Failed to clear cache: {:?}", e);
                errcode_to_binder_err(e.0)
            });
    }
}

impl IAuthMgrAuthorization for AuthMgrAuthorizationRPCService {
    fn initAuthentication(
        &self,
        dice_cert_chain: &ExplicitKeyDiceCertChain,
        instance_id: Option<&[u8]>,
    ) -> binder::Result<[u8; 32]> {
        let mut global_state = self.global_state.lock().unwrap();
        let connection_info = self.connection_information.lock().unwrap();
        global_state
            .authmgr_core
            .init_authentication(&*connection_info, &dice_cert_chain.diceCertChain, instance_id)
            .map_err(|e| {
                error!("Failed step 1 of phase 1: {:?}", e);
                errcode_to_binder_err(e.0)
            })
    }

    fn completeAuthentication(
        &self,
        signed_response: &SignedConnectionRequest,
        dice_policy: &DicePolicy,
    ) -> binder::Result<()> {
        let mut global_state = self.global_state.lock().unwrap();
        let mut connection_info = self.connection_information.lock().unwrap();
        global_state
            .authmgr_core
            .complete_authentication(
                &mut *connection_info,
                &signed_response.signedConnectionRequest,
                &dice_policy.dicePolicy,
            )
            .map_err(|e| {
                error!("Failed step 2 of phase 1: {:?}", e);
                errcode_to_binder_err(e.0)
            })
    }

    fn authorizeAndConnectClientToTrustedService(
        &self,
        client_id: &[u8],
        service_name: &str,
        token: &[u8; 32],
        client_dice_artifacts: &DiceLeafArtifacts,
    ) -> binder::Result<()> {
        let mut global_state = self.global_state.lock().unwrap();
        let mut connection_info = self.connection_information.lock().unwrap();
        global_state
            .authmgr_core
            .authorize_and_connect_client_to_trusted_service(
                &mut *connection_info,
                client_id,
                service_name,
                *token,
                &client_dice_artifacts.diceLeaf.diceChainEntry,
                &client_dice_artifacts.diceLeafPolicy.dicePolicy,
            )
            .map_err(|e| {
                error!("Failed step 2 of phase 1: {:?}", e);
                errcode_to_binder_err(e.0)
            })
    }
}

/// Convert an AuthMgr ErrorCode into a binder error.
pub fn errcode_to_binder_err(err: ErrorCode) -> binder::Status {
    // Translate the internal errors for `Unimplemented` and `InternalError` to their counterparts
    // in binder errors
    match err {
        ErrorCode::Unimplemented => {
            binder::Status::new_exception(binder::ExceptionCode::UNSUPPORTED_OPERATION, None)
        }
        ErrorCode::InternalError => {
            binder::Status::new_exception(binder::ExceptionCode::SERVICE_SPECIFIC, None)
        }
        _ => binder::Status::new_service_specific_error(err as i32, None),
    }
}

/// The global state that needs to be maintained by the AuthMgr service.
pub struct AuthMgrGlobalState {
    pub authmgr_core: AuthMgrBE,
}

impl AuthMgrGlobalState {
    pub fn new() -> Result<Self, Error> {
        // TODO: Here we use the default constants in the reference implementation. These should be
        // adjusted appropriately.
        let memory_limits = MemoryLimits::default();

        let authmgr_core = AuthMgrBE::new(
            authmgr_be_impl::crypto_trait_impls(),
            Box::new(DeviceInformation::new()?),
            Box::new(MockPersistentStorage::new()),
            memory_limits,
        )?;

        Ok(AuthMgrGlobalState { authmgr_core })
    }
}

pub struct RpcConnectionInformation {
    transport_id: TransportID,
    connection_state: Option<AuthenticatedConnectionState>,
}

impl RpcConnectionInformation {
    /// Constructor
    pub fn new(
        transport_id: TransportID,
        connection_state: Option<AuthenticatedConnectionState>,
    ) -> Self {
        RpcConnectionInformation { transport_id, connection_state }
    }
}

impl RpcConnection for RpcConnectionInformation {
    fn get_peer_transport_id(&self) -> Result<TransportID, Error> {
        Ok(self.transport_id)
    }

    fn store_authenticated_state(
        &mut self,
        connection_state: AuthenticatedConnectionState,
    ) -> Result<(), Error> {
        self.connection_state = Some(connection_state);
        Ok(())
    }

    fn get_authenticated_state(&self) -> Result<Option<&AuthenticatedConnectionState>, Error> {
        Ok(self.connection_state.as_ref())
    }

    fn get_mutable_authenticated_state(
        &mut self,
    ) -> Result<Option<&mut AuthenticatedConnectionState>, Error> {
        Ok((self.connection_state).as_mut())
    }

    fn remove_authenticated_state(&mut self) -> Result<(), Error> {
        self.connection_state = None;
        Ok(())
    }
}

pub struct RawConnectionInformation {
    // Raw file descriptor
    handle: Handle,
    peer_transport_id: TransportID,
}

impl RawConnectionInformation {
    /// Constructor
    pub fn new(handle: Handle, peer_transport_id: TransportID) -> Self {
        RawConnectionInformation { handle, peer_transport_id }
    }
}

impl RawConnection for RawConnectionInformation {
    fn get_peer_transport_id(&self) -> Result<TransportID, Error> {
        Ok(self.peer_transport_id)
    }

    fn into_raw_fd(self: Box<Self>) -> i32 {
        let fd = self.handle.as_raw_fd();
        // Prevent the destructor of the handle from being called
        core::mem::forget(self.handle);
        fd
    }
}

#[derive(Default)]
struct DeviceInformation;

impl DeviceInformation {
    fn new() -> Result<Self, Error> {
        Ok(Self)
    }
}

impl Device for DeviceInformation {
    fn get_self_transport_id(&self) -> Result<TransportID, Error> {
        // TODO: b/392905377. This is temporary, until we can integrate the transport ID from FFA.
        Ok(TEMP_AUTHMGR_BE_TRANSPORT_ID)
    }

    fn is_persistent_instance(&self, _instance_id: &InstanceIdentifier) -> Result<bool, Error> {
        // TODO: 399707150
        // In the scope of Android 16, we support only persistent instances created in the factory.
        // Therefore, we can simply return true here.
        Ok(true)
    }

    fn handover_client_connection(
        &self,
        _service_name: &str,
        client_seq_number: i32,
        client_conn_handle: Box<dyn RawConnection>,
        _is_persistent: bool,
    ) -> Result<(), Error> {
        // TODO: b/400118241.
        // Currently we have the port of the hand over service hardcoded to that of the example TA.
        // Instead the AuthMgr should construct the appropriate hand over service port based on the
        // input `service_name`.
        // TODO: We may be able to retrieve an already setup RPC session to a trusted service from
        // the cache
        let rpc_session = RpcSession::new();
        rpc_session.set_file_descriptor_transport_mode(FileDescriptorTransportMode::Trusty);
        let rpc_session: Strong<dyn ITrustedServicesHandover> =
            rpc_session.setup_trusty_client(HANDOVER_SERVICE_PORT).map_err(|_e| {
                am_err!(
                    ConnectionHandoverFailed,
                    "Failed to setup connection to the handover service."
                )
            })?;

        let raw_fd: i32 = client_conn_handle.into_raw_fd();
        // SAFETY: As specified in the definition of the `RawConnection` trait (in system/see/
        // authmgr/authmgr-be/src/traits.rs), `RawConnection` trait object should have the ownership
        // of the underlying file descriptor. Therefore, the `raw_fd` passed into the `from_raw_fd`
        // is an owned file descriptor.
        let owned_fd = unsafe { OwnedFd::from_raw_fd(raw_fd) };
        let fd = ParcelFileDescriptor::new(owned_fd);
        rpc_session.handoverConnection(&fd, client_seq_number).map_err(|_e| {
            am_err!(ConnectionHandoverFailed, "Failed to handover the connection.")
        })?;
        Ok(())
    }

    fn is_persistent_instance_creation_allowed(
        &self,
        _instance_id: &InstanceIdentifier,
        _dice_chain: &CertChain,
    ) -> Result<bool, Error> {
        // TODO: b/400116782. Check the system state and return true if the device is in factory
        Ok(true)
    }
}