blob: 2becc49a19ad8c9a8768e8a73faf51b75de83bbc
| 1 | /* |
| 2 | * Copyright (C) 2014 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #ifndef TRUSTY_GATEKEEPER_H |
| 18 | #define TRUSTY_GATEKEEPER_H |
| 19 | |
| 20 | #include <hardware/gatekeeper.h> |
| 21 | #include <gatekeeper/gatekeeper_messages.h> |
| 22 | |
| 23 | #include "gatekeeper_ipc.h" |
| 24 | |
| 25 | namespace gatekeeper { |
| 26 | |
| 27 | class TrustyGateKeeperDevice { |
| 28 | public: |
| 29 | |
| 30 | explicit TrustyGateKeeperDevice(const hw_module_t* module); |
| 31 | ~TrustyGateKeeperDevice(); |
| 32 | |
| 33 | hw_device_t* hw_device(); |
| 34 | |
| 35 | /** |
| 36 | * Enrolls password_payload, which should be derived from a user selected pin or password, |
| 37 | * with the authentication factor private key used only for enrolling authentication |
| 38 | * factor data. |
| 39 | * |
| 40 | * Returns: 0 on success or an error code less than 0 on error. |
| 41 | * On error, enrolled_password will not be allocated. |
| 42 | */ |
| 43 | int Enroll(uint32_t uid, const uint8_t *current_password_handle, |
| 44 | uint32_t current_password_handle_length, const uint8_t *current_password, |
| 45 | uint32_t current_password_length, const uint8_t *desired_password, |
| 46 | uint32_t desired_password_length, uint8_t **enrolled_password_handle, |
| 47 | uint32_t *enrolled_password_handle_length); |
| 48 | |
| 49 | /** |
| 50 | * Verifies provided_password matches expected_password after enrolling |
| 51 | * with the authentication factor private key. |
| 52 | * |
| 53 | * Implementations of this module may retain the result of this call |
| 54 | * to attest to the recency of authentication. |
| 55 | * |
| 56 | * On success, writes the address of a verification token to verification_token, |
| 57 | * |
| 58 | * Returns: 0 on success or an error code less than 0 on error |
| 59 | * On error, verification token will not be allocated |
| 60 | */ |
| 61 | int Verify(uint32_t uid, uint64_t challenge, const uint8_t *enrolled_password_handle, |
| 62 | uint32_t enrolled_password_handle_length, const uint8_t *provided_password, |
| 63 | uint32_t provided_password_length, uint8_t **auth_token, uint32_t *auth_token_length, |
| 64 | bool *request_reenroll); |
| 65 | |
| 66 | private: |
| 67 | |
| 68 | gatekeeper_error_t Send(uint32_t command, const GateKeeperMessage& request, |
| 69 | GateKeeperMessage* response); |
| 70 | |
| 71 | gatekeeper_error_t Send(const EnrollRequest& request, EnrollResponse *response) { |
| 72 | return Send(GK_ENROLL, request, response); |
| 73 | } |
| 74 | |
| 75 | gatekeeper_error_t Send(const VerifyRequest& request, VerifyResponse *response) { |
| 76 | return Send(GK_VERIFY, request, response); |
| 77 | } |
| 78 | |
| 79 | // Static methods interfacing the HAL API with the TrustyGateKeeper device |
| 80 | |
| 81 | /** |
| 82 | * Enrolls desired_password, which should be derived from a user selected pin or password, |
| 83 | * with the authentication factor private key used only for enrolling authentication |
| 84 | * factor data. |
| 85 | * |
| 86 | * If there was already a password enrolled, it should be provided in |
| 87 | * current_password_handle, along with the current password in current_password |
| 88 | * that should validate against current_password_handle. |
| 89 | * |
| 90 | * Returns: 0 on success or an error code less than 0 on error. |
| 91 | * On error, enrolled_password_handle will not be allocated. |
| 92 | */ |
| 93 | static int enroll(const struct gatekeeper_device *dev, uint32_t uid, |
| 94 | const uint8_t *current_password_handle, uint32_t current_password_handle_length, |
| 95 | const uint8_t *current_password, uint32_t current_password_length, |
| 96 | const uint8_t *desired_password, uint32_t desired_password_length, |
| 97 | uint8_t **enrolled_password_handle, uint32_t *enrolled_password_handle_length); |
| 98 | |
| 99 | /** |
| 100 | * Verifies provided_password matches enrolled_password_handle. |
| 101 | * |
| 102 | * Implementations of this module may retain the result of this call |
| 103 | * to attest to the recency of authentication. |
| 104 | * |
| 105 | * On success, writes the address of a verification token to auth_token, |
| 106 | * usable to attest password verification to other trusted services. Clients |
| 107 | * may pass NULL for this value. |
| 108 | * |
| 109 | * Returns: 0 on success or an error code less than 0 on error |
| 110 | * On error, verification token will not be allocated |
| 111 | */ |
| 112 | static int verify(const struct gatekeeper_device *dev, uint32_t uid, uint64_t challenge, |
| 113 | const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length, |
| 114 | const uint8_t *provided_password, uint32_t provided_password_length, |
| 115 | uint8_t **auth_token, uint32_t *auth_token_length, bool *request_reenroll); |
| 116 | |
| 117 | static int close_device(hw_device_t* dev); |
| 118 | |
| 119 | gatekeeper_device device_; |
| 120 | int error_; |
| 121 | |
| 122 | }; |
| 123 | } |
| 124 | |
| 125 | #endif |
| 126 | |
| 127 |