tequilaOS/platform_system_security
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Keystore 2.0: Fix shared secret negotiation for Keymaster 4.x"

Browse source
This commit is contained in:
Janis Danisevskis 2021-06-09 20:06:04 +00:00 committed by Gerrit Code Review
commit d955c25a00
3 changed files with 29 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
keystore2/src/km_compat/km_compat.cpp
View file

@ -1395,8 +1395,7 @@ KeystoreCompatService::getKeyMintDevice(KeyMintSecurityLevel in_securityLevel,
if (!device) {
return ScopedAStatus::fromStatus(STATUS_NAME_NOT_FOUND);
}
bool inserted = false;
std::tie(i, inserted) = mDeviceCache.insert({in_securityLevel, std::move(device)});
i = mDeviceCache.insert(i, {in_securityLevel, std::move(device)});
}
*_aidl_return = i->second;
return ScopedAStatus::ok();
@ -1404,14 +1403,15 @@ KeystoreCompatService::getKeyMintDevice(KeyMintSecurityLevel in_securityLevel,
ScopedAStatus KeystoreCompatService::getSharedSecret(KeyMintSecurityLevel in_securityLevel,
std::shared_ptr<ISharedSecret>* _aidl_return) {
if (!mSharedSecret) {
auto i = mSharedSecretCache.find(in_securityLevel);
if (i == mSharedSecretCache.end()) {
auto secret = SharedSecret::createSharedSecret(in_securityLevel);
if (!secret) {
return ScopedAStatus::fromStatus(STATUS_NAME_NOT_FOUND);
}
mSharedSecret = std::move(secret);
i = mSharedSecretCache.insert(i, {in_securityLevel, std::move(secret)});
}
*_aidl_return = mSharedSecret;
*_aidl_return = i->second;
return ScopedAStatus::ok();
}

2
keystore2/src/km_compat/km_compat.h
View file

@ -197,7 +197,7 @@ class SecureClock : public aidl::android::hardware::security::secureclock::BnSec
class KeystoreCompatService : public BnKeystoreCompatService {
private:
std::unordered_map<KeyMintSecurityLevel, std::shared_ptr<IKeyMintDevice>> mDeviceCache;
std::shared_ptr<ISharedSecret> mSharedSecret;
std::unordered_map<KeyMintSecurityLevel, std::shared_ptr<ISharedSecret>> mSharedSecretCache;
std::shared_ptr<ISecureClock> mSecureClock;
public:

25
keystore2/src/shared_secret_negotiation.rs
View file

@ -109,7 +109,11 @@ static COMPAT_PACKAGE_NAME: &str = "android.security.compat";
/// Lists participants.
fn list_participants() -> Result<Vec<SharedSecretParticipant>> {
Ok([(4, 0), (4, 1)]
// 4.1 implementation always also register as 4.0. So only the highest version of each
// "default" and "strongbox" makes the cut.
let mut legacy_default_found: bool = false;
let mut legacy_strongbox_found: bool = false;
Ok([(4, 1), (4, 0)]
.iter()
.map(|(ma, mi)| {
get_hidl_instances(KEYMASTER_PACKAGE_NAME, *ma, *mi, KEYMASTER_INTERFACE_NAME)
@ -119,7 +123,24 @@ fn list_participants() -> Result<Vec<SharedSecretParticipant>> {
instances
.into_iter()
.filter_map(|name| {
filter_map_legacy_km_instances(name.to_string(), (*ma, *mi))
filter_map_legacy_km_instances(name.to_string(), (*ma, *mi)).and_then(
|sp| {
if let SharedSecretParticipant::Hidl {
is_strongbox: true,
..
} = &sp
{
if !legacy_strongbox_found {
legacy_strongbox_found = true;
return Some(sp);
}
} else if !legacy_default_found {
legacy_default_found = true;
return Some(sp);
}
None
},
)
})
.collect::<Vec<SharedSecretParticipant>>()
})