NIAP: remove keystore related code for now. (b87441f4) · Commits · e / os / android_packages_modules_Bluetooth

system/btif/Android.bp

+0 −17

Original line number	Diff line number	Diff line
		@@ -24,8 +24,6 @@ btifCommonIncludes = [
		"packages/modules/Bluetooth/system/utils/include",
		"packages/modules/Bluetooth/system/include",
		"system/libhwbinder/include",
		//"system/security/keystore/include",
		//"hardware/interfaces/keymaster/4.0/support/include",
		]

		// libbtif static library for target
		@@ -73,7 +71,6 @@ cc_library_static {
		"src/btif_hf_client.cc",
		"src/btif_hh.cc",
		"src/btif_hd.cc",
		//"src/btif_keystore.cc",
		"src/btif_mce.cc",
		"src/btif_pan.cc",
		"src/btif_profile_queue.cc",
		@@ -107,12 +104,6 @@ cc_library_static {
		"libhidlbase",
		"libutils",
		"libcrypto",
		//"android.hardware.keymaster@4.0",
		//"android.hardware.keymaster@3.0",
		//"libkeymaster4support",
		//"libkeystore_aidl",
		//"libkeystore_binder",
		//"libkeystore_parcelables",
		],
		whole_static_libs: [
		"avrcp-target-service",
		@@ -135,7 +126,6 @@ cc_test {
		include_dirs: btifCommonIncludes,
		srcs: [
		"test/btif_storage_test.cc",
		//"test/btif_keystore_test.cc"
		],
		header_libs: ["libbluetooth_headers"],
		shared_libs: [
		@@ -151,13 +141,6 @@ cc_test {
		"libprocessgroup",
		"libutils",
		"libcrypto",
		//"android.hardware.keymaster@4.0",
		//"android.hardware.keymaster@3.0",
		//"libkeymaster4support",
		//"libkeystore_aidl",
		//"libkeystore_binder",
		//"libkeystore_parcelables",
		//"libbinder",
		],
		static_libs: [
		"libbt-bta",

system/btif/include/btif_keystore.h

deleted100644 → 0

+0 −70

Original line number	Diff line number	Diff line
		/******************************************************************************
		*
		* Copyright 2019 Google, Inc.
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		******************************************************************************/

		#include <base/logging.h>
		#include <keystore/keystore_client_impl.h>
		#include <mutex>

		#include "osi/include/alarm.h"
		#include "osi/include/allocator.h"
		#include "osi/include/compat.h"
		#include "osi/include/config.h"
		#include "osi/include/log.h"
		#include "osi/include/osi.h"
		#include "osi/include/properties.h"

		namespace bluetooth {
		/**
		* Client wrapper to access AndroidKeystore.
		*
		* <p>Use to encrypt/decrypt data and store to disk.
		*/
		class BtifKeystore {
		public:
		/**
		* @param keystore_client injected pre-created client object for keystore
		*/
		BtifKeystore(keystore::KeystoreClient* keystore_client);

		/**
		* Encrypts given data
		*
		* <p>Returns a string representation of the encrypted data
		*
		* @param data to be encrypted
		* @param flags for keystore
		*/
		std::string Encrypt(const std::string& data, int32_t flags);

		/**
		* Returns a decrypted string representation of the encrypted data or empty
		* string on error.
		*
		* @param input encrypted data
		*/
		std::string Decrypt(const std::string& input_filename);

		private:
		std::unique_ptr<keystore::KeystoreClient> keystore_client_;
		std::mutex api_mutex_;
		keystore::KeyStoreNativeReturnCode GenerateKey(const std::string& name,
		int32_t flags,
		bool auth_bound);
		};

		} // namespace bluetooth

system/btif/src/btif_config.cc

+4 −117

Original line number	Diff line number	Diff line
		@@ -40,7 +40,6 @@
		#include "btif_api.h"
		#include "btif_common.h"
		#include "btif_config_transcode.h"
		//#include "btif_keystore.h"
		#include "btif_util.h"
		#include "common/address_obfuscator.h"
		#include "common/metric_id_allocator.h"
		@@ -64,17 +63,10 @@
		#define DISABLED "disabled"
		static const char* TIME_STRING_FORMAT = "%Y-%m-%d %H:%M:%S";

		// constexpr int kBufferSize = 400 * 10; // initial file is ~400B

		/*static bool use_key_attestation() {
		return getuid() == AID_BLUETOOTH && is_single_user_mode();
		}*/

		#define BT_CONFIG_METRICS_SECTION "Metrics"
		#define BT_CONFIG_METRICS_SALT_256BIT "Salt256Bit"
		#define BT_CONFIG_METRICS_ID_KEY "MetricsId"

		// using bluetooth::BtifKeystore;
		using bluetooth::common::AddressObfuscator;
		using bluetooth::common::MetricIdAllocator;

		@@ -86,8 +78,6 @@ static const char* CONFIG_LEGACY_FILE_PATH = "bt_config.xml";
		#else // !defined(OS_GENERIC)
		static const char* CONFIG_FILE_PATH = "/data/misc/bluedroid/bt_config.conf";
		static const char* CONFIG_BACKUP_PATH = "/data/misc/bluedroid/bt_config.bak";
		static const char* CONFIG_FILE_CHECKSUM_PATH = "/data/misc/bluedroid/bt_config.conf.encrypted-checksum";
		static const char* CONFIG_BACKUP_CHECKSUM_PATH = "/data/misc/bluedroid/bt_config.bak.encrypted-checksum";
		static const char* CONFIG_LEGACY_FILE_PATH =
		"/data/misc/bluedroid/bt_config.xml";
		#endif // defined(OS_GENERIC)
		@@ -99,13 +89,7 @@ static bool is_factory_reset(void);
		static void delete_config_files(void);
		static void btif_config_remove_unpaired(config_t* config);
		static void btif_config_remove_restricted(config_t* config);
		static std::unique_ptr<config_t> btif_config_open(const char* filename, const char* checksum_filename);

		// Key attestation
		// static std::string hash_file(const char* filename);
		// static std::string read_checksum_file(const char* filename);
		// static void write_checksum_file(const char* filename, const std::string&
		// hash);
		static std::unique_ptr<config_t> btif_config_open(const char* filename);

		static enum ConfigSource {
		NOT_LOADED,
		@@ -260,27 +244,21 @@ static std::recursive_mutex config_lock; // protects operations on \|config\|.
		static std::unique_ptr<config_t> config;
		static alarm_t* config_timer;

		// static BtifKeystore btif_keystore(new keystore::KeystoreClientImpl);

		// Module lifecycle functions

		static future_t* init(void) {
		std::unique_lock<std::recursive_mutex> lock(config_lock);

		if (is_factory_reset()) delete_config_files();
		/*if (is_factory_reset() \|\|
		(use_key_attestation() && !btif_keystore.DoesKeyExist()))
		delete_config_files();*/

		std::string file_source;

		config = btif_config_open(CONFIG_FILE_PATH, CONFIG_FILE_CHECKSUM_PATH);
		config = btif_config_open(CONFIG_FILE_PATH);
		btif_config_source = ORIGINAL;
		if (!config) {
		LOG_WARN(LOG_TAG, "%s unable to load config file: %s; using backup.",
		__func__, CONFIG_FILE_PATH);
		remove(CONFIG_FILE_CHECKSUM_PATH);
		config = btif_config_open(CONFIG_BACKUP_PATH, CONFIG_BACKUP_CHECKSUM_PATH);
		config = btif_config_open(CONFIG_BACKUP_PATH);
		btif_config_source = BACKUP;
		file_source = "Backup";
		}
		@@ -288,7 +266,6 @@ static future_t* init(void) {
		LOG_WARN(LOG_TAG,
		"%s unable to load backup; attempting to transcode legacy file.",
		__func__);
		remove(CONFIG_BACKUP_CHECKSUM_PATH);
		config = btif_config_transcode(CONFIG_LEGACY_FILE_PATH);
		btif_config_source = LEGACY;
		file_source = "Legacy";
		@@ -353,25 +330,7 @@ error:
		return future_new_immediate(FUTURE_FAIL);
		}

		static std::unique_ptr<config_t> btif_config_open(const char* filename, const char* checksum_filename) {
		/*// START KEY ATTESTATION
		// Get hash of current file
		std::string current_hash = hash_file(filename);
		// Get stored hash
		std::string stored_hash = read_checksum_file(checksum_filename);
		if (stored_hash.empty()) {
		LOG(ERROR) << __func__ << ": stored_hash=<empty>";
		if (!current_hash.empty()) {
		write_checksum_file(checksum_filename, current_hash);
		stored_hash = read_checksum_file(checksum_filename);
		}
		}
		// Compare hashes
		if (current_hash != stored_hash) {
		return nullptr;
		}
		// END KEY ATTESTATION*/

		static std::unique_ptr<config_t> btif_config_open(const char* filename) {
		std::unique_ptr<config_t> config =
		storage_config_get_interface()->config_new(filename);
		if (!config) return nullptr;
		@@ -623,12 +582,6 @@ bool btif_config_clear(void) {
		storage_config_get_interface()->config_save(*config, CONFIG_FILE_PATH);
		btif_config_source = RESET;

		/*// Save encrypted hash
		std::string current_hash = hash_file(CONFIG_FILE_PATH);
		if (!current_hash.empty()) {
		write_checksum_file(CONFIG_FILE_CHECKSUM_PATH, current_hash);
		}*/

		return ret;
		}

		@@ -646,16 +599,10 @@ static void btif_config_write(UNUSED_ATTR uint16_t event,

		std::unique_lock<std::recursive_mutex> lock(config_lock);
		rename(CONFIG_FILE_PATH, CONFIG_BACKUP_PATH);
		rename(CONFIG_FILE_CHECKSUM_PATH, CONFIG_BACKUP_CHECKSUM_PATH);
		std::unique_ptr<config_t> config_paired =
		storage_config_get_interface()->config_new_clone(*config);
		btif_config_remove_unpaired(config_paired.get());
		storage_config_get_interface()->config_save(*config_paired, CONFIG_FILE_PATH);
		/*// Save hash
		std::string current_hash = hash_file(CONFIG_FILE_PATH);
		if (!current_hash.empty()) {
		write_checksum_file(CONFIG_FILE_CHECKSUM_PATH, current_hash);
		}*/
		}

		static void btif_config_remove_unpaired(config_t* conf) {
		@@ -749,65 +696,5 @@ static bool is_factory_reset(void) {
		static void delete_config_files(void) {
		remove(CONFIG_FILE_PATH);
		remove(CONFIG_BACKUP_PATH);
		// remove(CONFIG_FILE_CHECKSUM_PATH);
		// remove(CONFIG_BACKUP_CHECKSUM_PATH);
		osi_property_set("persist.bluetooth.factoryreset", "false");
		}

		/static std::string hash_file(const char filename) {
		if (!use_key_attestation()) {
		LOG(INFO) << __func__ << ": Disabled for multi-user";
		return DISABLED;
		}
		FILE* fp = fopen(filename, "rb");
		if (!fp) {
		LOG(ERROR) << __func__ << ": unable to open config file: '" << filename
		<< "': " << strerror(errno);
		return "";
		}
		uint8_t hash[SHA256_DIGEST_LENGTH];
		SHA256_CTX sha256;
		SHA256_Init(&sha256);
		std::array<std::byte, kBufferSize> buffer;
		int bytes_read = 0;
		while ((bytes_read = fread(buffer.data(), 1, buffer.size(), fp))) {
		SHA256_Update(&sha256, buffer.data(), bytes_read);
		}
		SHA256_Final(hash, &sha256);
		std::stringstream ss;
		for (int i = 0; i < SHA256_DIGEST_LENGTH; i++) {
		ss << std::hex << std::setw(2) << std::setfill('0') << (int)hash[i];
		}
		fclose(fp);
		return ss.str();
		}

		static std::string read_checksum_file(const char* checksum_filename) {
		if (!use_key_attestation()) {
		LOG(INFO) << __func__ << ": Disabled for multi-user";
		return DISABLED;
		}
		std::string encrypted_hash = checksum_read(checksum_filename);
		if (encrypted_hash.empty()) {
		LOG(INFO) << __func__ << ": read empty hash.";
		return "";
		}
		return btif_keystore.Decrypt(encrypted_hash);
		}

		static void write_checksum_file(const char* checksum_filename,
		const std::string& hash) {
		if (!use_key_attestation()) {
		LOG(INFO) << __func__
		<< ": Disabled for multi-user, since config changed removing "
		"checksums.";
		remove(CONFIG_FILE_CHECKSUM_PATH);
		remove(CONFIG_BACKUP_CHECKSUM_PATH);
		return;
		}
		std::string encrypted_checksum = btif_keystore.Encrypt(hash, 0);
		CHECK(!encrypted_checksum.empty())
		<< __func__ << ": Failed encrypting checksum";
		CHECK(checksum_save(encrypted_checksum, checksum_filename))
		<< __func__ << ": Failed to save checksum!";
		}*/

system/btif/src/btif_keystore.cc

deleted100644 → 0

+0 −101

Original line number	Diff line number	Diff line
		/******************************************************************************
		*
		* Copyright 2019 Google, Inc.
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		******************************************************************************/

		#include "btif_keystore.h"

		#include <base/files/file_util.h>
		#include <base/logging.h>
		#include <base/strings/string_number_conversions.h>
		#include <base/strings/string_split.h>
		#include <base/strings/string_util.h>
		#include <base/strings/utf_string_conversions.h>
		#include <sys/stat.h>

		using namespace keystore;
		using namespace bluetooth;

		constexpr char kKeyStore[] = "AndroidKeystore";

		namespace bluetooth {

		BtifKeystore::BtifKeystore(keystore::KeystoreClient* keystore_client)
		: keystore_client_(keystore_client) {}

		std::string BtifKeystore::Encrypt(const std::string& data, int32_t flags) {
		std::lock_guard<std::mutex> lock(api_mutex_);
		std::string output;
		if (data.empty()) {
		LOG(ERROR) << __func__ << ": empty data";
		return output;
		}
		if (!keystore_client_->doesKeyExist(kKeyStore)) {
		auto gen_result = GenerateKey(kKeyStore, 0, false);
		if (!gen_result.isOk()) {
		LOG(FATAL) << "EncryptWithAuthentication Failed: generateKey response="
		<< gen_result;
		return output;
		}
		}
		if (!keystore_client_->encryptWithAuthentication(kKeyStore, data, flags,
		&output)) {
		LOG(FATAL) << "EncryptWithAuthentication failed.";
		return output;
		}
		return output;
		}

		std::string BtifKeystore::Decrypt(const std::string& input) {
		std::lock_guard<std::mutex> lock(api_mutex_);
		if (input.empty()) {
		LOG(ERROR) << __func__ << ": empty input data";
		return "";
		}
		std::string output;
		if (!keystore_client_->decryptWithAuthentication(kKeyStore, input, &output)) {
		LOG(FATAL) << "DecryptWithAuthentication failed.\n";
		}
		return output;
		}

		// Note: auth_bound keys created with this tool will not be usable.
		KeyStoreNativeReturnCode BtifKeystore::GenerateKey(const std::string& name,
		int32_t flags,
		bool auth_bound) {
		AuthorizationSetBuilder params;
		params.RsaSigningKey(2048, 65537)
		.Digest(Digest::SHA_2_224)
		.Digest(Digest::SHA_2_256)
		.Digest(Digest::SHA_2_384)
		.Digest(Digest::SHA_2_512)
		.Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)
		.Padding(PaddingMode::RSA_PSS);
		if (auth_bound) {
		// Gatekeeper normally generates the secure user id.
		// Using zero allows the key to be created, but it will not be usuable.
		params.Authorization(TAG_USER_SECURE_ID, 0);
		} else {
		params.Authorization(TAG_NO_AUTH_REQUIRED);
		}
		AuthorizationSet hardware_enforced_characteristics;
		AuthorizationSet software_enforced_characteristics;
		return keystore_client_->generateKey(name, params, flags,
		&hardware_enforced_characteristics,
		&software_enforced_characteristics);
		}

		} // namespace bluetooth

system/main/Android.bp

+0 −3

Original line number	Diff line number	Diff line
		@@ -95,9 +95,6 @@ cc_library_shared {
		"libtinyxml2",
		"libz",
		"libcrypto",
		//"android.hardware.keymaster@4.0",
		//"libkeymaster4support",
		//"libkeystore_binder",
		],
		static_libs: [
		"libbte",