1 /*
2 * Copyright (c) 2021-2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hks_request.h"
17
18 #include <iservice_registry.h>
19 #include <message_option.h>
20 #include <securec.h>
21
22 #include "hks_base_check.h" // for HksAttestIsAnonymous
23 #include "hks_log.h"
24 #include "hks_param.h"
25 #include "hks_sa_interface.h"
26 #include "hks_template.h"
27 #include "hks_type.h"
28 #include "huks_service_ipc_interface_code.h"
29
30 using namespace OHOS;
31
32 namespace {
33 constexpr int SA_ID_KEYSTORE_SERVICE = 3510;
34 const std::u16string SA_KEYSTORE_SERVICE_DESCRIPTOR = u"ohos.security.hks.service";
35 }
36
GetHksProxy()37 static sptr<IRemoteObject> GetHksProxy()
38 {
39 auto registry = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
40 HKS_IF_NULL_LOGE_RETURN(registry, nullptr, "GetHksProxy registry is null")
41
42 sptr<IRemoteObject> hksProxy = registry->GetSystemAbility(SA_ID_KEYSTORE_SERVICE);
43 HKS_IF_NULL_LOGE_RETURN(hksProxy, nullptr,
44 "GetHksProxy GetSystemAbility %" LOG_PUBLIC "d is null", SA_ID_KEYSTORE_SERVICE)
45
46 return hksProxy;
47 }
48
HksReadRequestReply(MessageParcel & reply,struct HksBlob * outBlob)49 static int32_t HksReadRequestReply(MessageParcel &reply, struct HksBlob *outBlob)
50 {
51 int32_t ret = reply.ReadInt32();
52 HKS_IF_NOT_SUCC_RETURN(ret, ret)
53
54 uint32_t outLen = reply.ReadUint32();
55 if (outLen == 0) {
56 if (outBlob != nullptr) {
57 outBlob->size = 0;
58 }
59 return ret;
60 }
61
62 HKS_IF_NOT_SUCC_RETURN(CheckBlob(outBlob), HKS_ERROR_INVALID_ARGUMENT)
63
64 const uint8_t *outData = reply.ReadBuffer(outLen);
65 HKS_IF_NULL_RETURN(outData, HKS_ERROR_IPC_MSG_FAIL)
66
67 if (outBlob->size < outLen) {
68 HKS_LOG_E("outBlob size[%" LOG_PUBLIC "u] smaller than outLen[%" LOG_PUBLIC "u]", outBlob->size, outLen);
69 return HKS_ERROR_BUFFER_TOO_SMALL;
70 }
71
72 (void)memcpy_s(outBlob->data, outBlob->size, outData, outLen);
73 outBlob->size = outLen;
74 return HKS_SUCCESS;
75 }
76
HksSendAnonAttestRequestAndWaitAsyncReply(MessageParcel & data,const struct HksParamSet * paramSet,sptr<IRemoteObject> hksProxy,sptr<Security::Hks::HksStub> hksCallback,struct HksBlob * outBlob)77 static int32_t HksSendAnonAttestRequestAndWaitAsyncReply(MessageParcel &data, const struct HksParamSet *paramSet,
78 sptr<IRemoteObject> hksProxy, sptr<Security::Hks::HksStub> hksCallback, struct HksBlob *outBlob)
79 {
80 HKS_IF_NOT_SUCC_LOGE_RETURN(CheckBlob(outBlob), HKS_ERROR_INVALID_ARGUMENT, "invalid outBlob");
81 MessageParcel reply{};
82 // We send the request in sync mode, and we send a stub instance in the request.
83 // We wait for the instance callback later.
84 MessageOption option = MessageOption::TF_SYNC;
85 int error = hksProxy->SendRequest(HKS_MSG_ATTEST_KEY_ASYNC_REPLY, data, reply, option);
86 HKS_IF_NOT_SUCC_LOGE_RETURN(error, HKS_ERROR_IPC_MSG_FAIL, "hksProxy->SendRequest failed %" LOG_PUBLIC "d", error);
87
88 int ret = HksReadRequestReply(reply, outBlob);
89 if (ret != HKS_SUCCESS) {
90 HKS_LOG_E("HksSendAnonAttestRequestAndWaitAsyncReply HksReadRequestReply failed %" LOG_PUBLIC "d", ret);
91 return ret;
92 }
93
94 #ifndef HKS_UNTRUSTED_RUNNING_ENV
95 int timeout = 10; // seconds
96 auto [errCode, packedCerts, packedSize] = hksCallback->WaitForAsyncReply(timeout);
97 if (errCode != HKS_SUCCESS || packedCerts == nullptr || packedSize == 0) {
98 HKS_LOG_E("errCode %" LOG_PUBLIC "u fail or packedCerts empty or size %" LOG_PUBLIC "u 0", errCode, packedSize);
99 return HUKS_ERR_CODE_EXTERNAL_ERROR;
100 }
101
102 if (outBlob->size < packedSize) {
103 HKS_LOG_E("out blob empty or too small %" LOG_PUBLIC "u %" LOG_PUBLIC "u", outBlob->size, packedSize);
104 return HKS_ERROR_INVALID_ARGUMENT;
105 }
106
107 errno_t err = memcpy_s(outBlob->data, outBlob->size, packedCerts.get(), packedSize);
108 if (err != EOK) {
109 HKS_LOG_E("memcpy_s failed destMax %" LOG_PUBLIC "u count %" LOG_PUBLIC "u", outBlob->size, packedSize);
110 return HKS_ERROR_INVALID_ARGUMENT;
111 }
112 outBlob->size = packedSize;
113 return HKS_SUCCESS;
114 #else
115 (void)(paramSet);
116 (void)(hksCallback);
117 return ret;
118 #endif
119 }
120
HksSendRequest(enum HksIpcInterfaceCode type,const struct HksBlob * inBlob,struct HksBlob * outBlob,const struct HksParamSet * paramSet)121 int32_t HksSendRequest(enum HksIpcInterfaceCode type, const struct HksBlob *inBlob,
122 struct HksBlob *outBlob, const struct HksParamSet *paramSet)
123 {
124 enum HksSendType sendType = HKS_SEND_TYPE_SYNC;
125 struct HksParam *sendTypeParam = nullptr;
126 int32_t ret = HksGetParam(paramSet, HKS_TAG_IS_ASYNCHRONIZED, &sendTypeParam);
127 if (ret == HKS_SUCCESS) {
128 sendType = static_cast<enum HksSendType>(sendTypeParam->uint32Param);
129 }
130
131 MessageParcel data;
132 MessageParcel reply;
133 MessageOption option;
134 if (sendType == HKS_SEND_TYPE_SYNC) {
135 option = MessageOption::TF_SYNC;
136 } else {
137 option = MessageOption::TF_ASYNC;
138 }
139 HKS_IF_NOT_TRUE_LOGE_RETURN(data.WriteInterfaceToken(SA_KEYSTORE_SERVICE_DESCRIPTOR), HKS_ERROR_BAD_STATE);
140
141 if (outBlob == nullptr) {
142 HKS_IF_NOT_TRUE_LOGE_RETURN(data.WriteUint32(0), HKS_ERROR_BAD_STATE);
143 } else {
144 HKS_IF_NOT_TRUE_LOGE_RETURN(data.WriteUint32(outBlob->size), HKS_ERROR_BAD_STATE);
145 }
146 HKS_IF_NOT_TRUE_LOGE_RETURN(data.WriteUint32(inBlob->size), HKS_ERROR_BAD_STATE);
147 HKS_IF_NOT_TRUE_LOGE_RETURN(data.WriteBuffer(inBlob->data, static_cast<size_t>(inBlob->size)), HKS_ERROR_BAD_STATE);
148
149 sptr<IRemoteObject> hksProxy = GetHksProxy();
150 HKS_IF_NULL_LOGE_RETURN(hksProxy, HKS_ERROR_BAD_STATE, "GetHksProxy registry is null")
151
152 if (type == HKS_MSG_ATTEST_KEY_ASYNC_REPLY) {
153 sptr<Security::Hks::HksStub> hksCallback = new (std::nothrow) Security::Hks::HksStub();
154 HKS_IF_NULL_LOGE_RETURN(hksCallback, HKS_ERROR_INSUFFICIENT_MEMORY, "new HksStub failed")
155 // We write a HksStub instance if type == HKS_MSG_ATTEST_KEY_ASYNC_REPLY,
156 // then we can read it in the server side if type == HKS_MSG_ATTEST_KEY_ASYNC_REPLY.
157 bool result = data.WriteRemoteObject(hksCallback);
158 if (!result) {
159 HKS_LOG_E("WriteRemoteObject hksCallback failed %" LOG_PUBLIC "d", result);
160 return HKS_ERROR_IPC_MSG_FAIL;
161 }
162 return HksSendAnonAttestRequestAndWaitAsyncReply(data, paramSet, hksProxy, hksCallback, outBlob);
163 // If the mode is non-anonymous attest, we write a HksStub instance here, then go back and process as normal.
164 }
165
166 int error = hksProxy->SendRequest(type, data, reply, option);
167 if (error != 0) {
168 HKS_LOG_E("hksProxy->SendRequest failed %" LOG_PUBLIC "d", error);
169 return HKS_ERROR_IPC_MSG_FAIL;
170 }
171
172 return HksReadRequestReply(reply, outBlob);
173 }
174