tequilaOS/platform_system_security
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Keystore 2.0: Fix shared secret negotiation for Keymaster 4.x"

Browse source
This commit is contained in:
Janis Danisevskis 2021-06-09 20:06:04 +00:00 committed by Gerrit Code Review
commit d955c25a00
3 changed files with 29 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
keystore2/src/km_compat/km_compat.cpp
View file

@ -1395,8 +1395,7 @@ KeystoreCompatService::getKeyMintDevice(KeyMintSecurityLevel in_securityLevel,
if (!device) { if (!device) {
return ScopedAStatus::fromStatus(STATUS_NAME_NOT_FOUND); return ScopedAStatus::fromStatus(STATUS_NAME_NOT_FOUND);
} }
bool inserted = false; i = mDeviceCache.insert(i, {in_securityLevel, std::move(device)});
std::tie(i, inserted) = mDeviceCache.insert({in_securityLevel, std::move(device)});
} }
*_aidl_return = i->second; *_aidl_return = i->second;
return ScopedAStatus::ok(); return ScopedAStatus::ok();
@ -1404,14 +1403,15 @@ KeystoreCompatService::getKeyMintDevice(KeyMintSecurityLevel in_securityLevel,
ScopedAStatus KeystoreCompatService::getSharedSecret(KeyMintSecurityLevel in_securityLevel, ScopedAStatus KeystoreCompatService::getSharedSecret(KeyMintSecurityLevel in_securityLevel,
std::shared_ptr<ISharedSecret>* _aidl_return) { std::shared_ptr<ISharedSecret>* _aidl_return) {
if (!mSharedSecret) { auto i = mSharedSecretCache.find(in_securityLevel);
if (i == mSharedSecretCache.end()) {
auto secret = SharedSecret::createSharedSecret(in_securityLevel); auto secret = SharedSecret::createSharedSecret(in_securityLevel);
if (!secret) { if (!secret) {
return ScopedAStatus::fromStatus(STATUS_NAME_NOT_FOUND); return ScopedAStatus::fromStatus(STATUS_NAME_NOT_FOUND);
} }
mSharedSecret = std::move(secret); i = mSharedSecretCache.insert(i, {in_securityLevel, std::move(secret)});
} }
*_aidl_return = mSharedSecret; *_aidl_return = i->second;
return ScopedAStatus::ok(); return ScopedAStatus::ok();
} }

2
keystore2/src/km_compat/km_compat.h
View file

@ -197,7 +197,7 @@ class SecureClock : public aidl::android::hardware::security::secureclock::BnSec
class KeystoreCompatService : public BnKeystoreCompatService { class KeystoreCompatService : public BnKeystoreCompatService {
private: private:
std::unordered_map<KeyMintSecurityLevel, std::shared_ptr<IKeyMintDevice>> mDeviceCache; std::unordered_map<KeyMintSecurityLevel, std::shared_ptr<IKeyMintDevice>> mDeviceCache;
std::shared_ptr<ISharedSecret> mSharedSecret; std::unordered_map<KeyMintSecurityLevel, std::shared_ptr<ISharedSecret>> mSharedSecretCache;
std::shared_ptr<ISecureClock> mSecureClock; std::shared_ptr<ISecureClock> mSecureClock;
public: public:

25
keystore2/src/shared_secret_negotiation.rs
View file

@ -109,7 +109,11 @@ static COMPAT_PACKAGE_NAME: &str = "android.security.compat";
/// Lists participants. /// Lists participants.
fn list_participants() -> Result<Vec<SharedSecretParticipant>> { fn list_participants() -> Result<Vec<SharedSecretParticipant>> {
Ok([(4, 0), (4, 1)] // 4.1 implementation always also register as 4.0. So only the highest version of each
// "default" and "strongbox" makes the cut.
let mut legacy_default_found: bool = false;
let mut legacy_strongbox_found: bool = false;
Ok([(4, 1), (4, 0)]
.iter() .iter()
.map(|(ma, mi)| { .map(|(ma, mi)| {
get_hidl_instances(KEYMASTER_PACKAGE_NAME, *ma, *mi, KEYMASTER_INTERFACE_NAME) get_hidl_instances(KEYMASTER_PACKAGE_NAME, *ma, *mi, KEYMASTER_INTERFACE_NAME)
@ -119,7 +123,24 @@ fn list_participants() -> Result<Vec<SharedSecretParticipant>> {
instances instances
.into_iter() .into_iter()
.filter_map(|name| { .filter_map(|name| {
filter_map_legacy_km_instances(name.to_string(), (*ma, *mi)) filter_map_legacy_km_instances(name.to_string(), (*ma, *mi)).and_then(
|sp| {
if let SharedSecretParticipant::Hidl {
is_strongbox: true,
..
} = &sp
{
if !legacy_strongbox_found {
legacy_strongbox_found = true;
return Some(sp);
}
} else if !legacy_default_found {
legacy_default_found = true;
return Some(sp);
}
None
},
)
}) })
.collect::<Vec<SharedSecretParticipant>>() .collect::<Vec<SharedSecretParticipant>>()
}) })