1 /* 2 * Copyright 2022 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.h> 18 #include <android/binder_manager.h> 19 #include <cppbor.h> 20 #include <keymaster/cppcose/cppcose.h> 21 22 #include <cstdint> 23 #include <memory> 24 #include <string> 25 #include <string_view> 26 #include <unordered_set> 27 #include <vector> 28 29 // Parse a comma-delimited string. 30 // Ignores any empty strings. 31 std::unordered_set<std::string> parseCommaDelimited(const std::string& input); 32 33 // Challenge size must be between 32 and 64 bytes inclusive. 34 constexpr size_t kChallengeSize = 64; 35 36 // How CSRs should be validated when the rkp_factory_extraction_tool's "self_test" 37 // flag is set to "true". 38 struct CsrValidationConfig { 39 // Names of IRemotelyProvisionedComponent instances for which degenerate DICE 40 // chains are allowed. 41 std::unordered_set<std::string>* allow_degenerate_irpc_names; 42 43 // Names of IRemotelyProvisionedComponent instances for which UDS certificate 44 // chains are required to be present in the CSR. 45 std::unordered_set<std::string>* require_uds_certs_irpc_names; 46 }; 47 48 // Contains a the result of an operation that should return cborData on success. 49 // Returns an an error message and null cborData on error. 50 template <typename T> struct CborResult { 51 std::unique_ptr<T> cborData; 52 std::string errMsg; 53 }; 54 55 // Generate a random challenge containing `kChallengeSize` bytes. 56 std::vector<uint8_t> generateChallenge(); 57 58 // Get a certificate signing request for the given IRemotelyProvisionedComponent. 59 // On error, the csr Array is null, and the string field contains a description of 60 // what went wrong. 61 CborResult<cppbor::Array> 62 getCsr(std::string_view componentName, 63 aidl::android::hardware::security::keymint::IRemotelyProvisionedComponent* irpc, 64 bool selfTest, bool allowDegenerate, bool requireUdsCerts);