Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e3240934 authored by weichinweng's avatar weichinweng
Browse files

DO NOT MERGE: NIAP: Use keystore to encrypt KEY 

Encrypt Classic and LE key via kerstore.

Bug: 140483038
Test: Manual
- Pair a device after OOBE
- adb shell settings put global niap_mode 1
- Re-enable Bluetooth
- Ensured that the Key was read correctly
- Ensured that the Key was encrypted when stored on disk

Change-Id: I6ece990135fb0a16eef3ecf6508ca759eee2c4c6
parent b806184d

system/btif/include/btif_api.h

+2 −2
Original line number Diff line number Diff line
@@ -105,7 +105,7 @@ bool is_restricted_mode(void); 


/*******************************************************************************

 *

 * Function         is_single_user_mode_

 * Function         is_niap_mode

 *

 * Description      Checks if BT was enabled in single user mode. In this

 *                  mode, use of keystore for key attestation of LTK is limitee
@@ -114,7 +114,7 @@ bool is_restricted_mode(void); 
 * Returns          bool

 *

 ******************************************************************************/

bool is_single_user_mode(void);

bool is_niap_mode(void);



/*******************************************************************************

 *

system/btif/include/btif_keystore.h

+8 −0
Original line number Diff line number Diff line
@@ -59,6 +59,14 @@ class BtifKeystore { 
   */

  std::string Decrypt(const std::string& input_filename);



  /**

   * Check for existence of keystore key.

   *

   * This key can be cleared if a user manually wipes bluetooth storage data

   * b/133214365

   */

  bool DoesKeyExist();



 private:

  std::unique_ptr<keystore::KeystoreClient> keystore_client_;

  std::mutex api_mutex_;

system/btif/src/bluetooth.cc

+6 −6
Original line number Diff line number Diff line
@@ -81,7 +81,7 @@ using bluetooth::hearing_aid::HearingAidInterface; 


bt_callbacks_t* bt_hal_cbacks = NULL;

bool restricted_mode = false;

bool single_user_mode = false;

bool niap_mode = false;



/*******************************************************************************

 *  Externs
@@ -134,9 +134,9 @@ static bool is_profile(const char* p1, const char* p2) { 
 ****************************************************************************/



static int init(bt_callbacks_t* callbacks, bool start_restricted,

                bool is_single_user_mode) {

  LOG_INFO(LOG_TAG, "%s: start restricted = %d ; single user = %d", __func__,

           start_restricted, is_single_user_mode);

                bool is_niap_mode) {

  LOG_INFO(LOG_TAG, "%s: start restricted = %d ; niap = %d", __func__,

           start_restricted, is_niap_mode);



  if (interface_ready()) return BT_STATUS_DONE;
@@ -146,7 +146,7 @@ static int init(bt_callbacks_t* callbacks, bool start_restricted, 


  bt_hal_cbacks = callbacks;

  restricted_mode = start_restricted;

  single_user_mode = is_single_user_mode;

  niap_mode = is_niap_mode;

  stack_manager_get_interface()->init_stack();

  btif_debug_init();

  return BT_STATUS_SUCCESS;
@@ -169,7 +169,7 @@ static int disable(void) { 
static void cleanup(void) { stack_manager_get_interface()->clean_up_stack(); }



bool is_restricted_mode() { return restricted_mode; }

bool is_single_user_mode() { return single_user_mode; }

bool is_niap_mode() { return niap_mode; }



static int get_adapter_properties(void) {

  /* sanity check */

system/btif/src/btif_config.cc

+118 −10
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 


#include "btif_config.h"



#include <base/base64.h>

#include <base/logging.h>

#include <ctype.h>

#include <openssl/rand.h>
@@ -60,8 +61,8 @@ static const char* TIME_STRING_FORMAT = "%Y-%m-%d %H:%M:%S"; 


constexpr int kBufferSize = 400 * 10;  // initial file is ~400B



static bool use_key_attestation() {

  return getuid() == AID_BLUETOOTH && is_single_user_mode();

static bool btif_is_niap_mode() {

  return getuid() == AID_BLUETOOTH && is_niap_mode();

}



#define BT_CONFIG_METRICS_SECTION "Metrics"
@@ -93,10 +94,22 @@ static void btif_config_remove_restricted(config_t* config); 
static std::unique_ptr<config_t> btif_config_open(const char* filename, const char* checksum_filename);



// Key attestation

static std::string btif_convert_to_encrypt_key(

    const std::string& unencrypt_str);

static std::string btif_convert_to_unencrypt_key(

    const std::string& encrypt_str);

static bool btif_in_encrypt_key_name_list(std::string key);

static bool btif_is_key_encrypted(int key_from_config_size,

                                  std::string key_type_string);

static std::string hash_file(const char* filename);

static std::string read_checksum_file(const char* filename);

static void write_checksum_file(const char* filename, const std::string& hash);



static const int ENCRYPT_KEY_NAME_LIST_SIZE = 7;

static const std::string encrypt_key_name_list[] = {

    "LinkKey",      "LE_KEY_PENC", "LE_KEY_PID",  "LE_KEY_LID",

    "LE_KEY_PCSRK", "LE_KEY_LENC", "LE_KEY_LCSRK"};



static enum ConfigSource {

  NOT_LOADED,

  ORIGINAL,
@@ -269,7 +282,8 @@ static std::unique_ptr<config_t> btif_config_open(const char* filename, const ch 
  std::string stored_hash = read_checksum_file(checksum_filename);

  if (stored_hash.empty()) {

    LOG(ERROR) << __func__ << ": stored_hash=<empty>";

    if (!current_hash.empty()) {

    // Will encrypt once since the bt_config never encrypt.

    if (!btif_keystore.DoesKeyExist() && !current_hash.empty()) {

      write_checksum_file(checksum_filename, current_hash);

      stored_hash = read_checksum_file(checksum_filename);

    }
@@ -406,14 +420,28 @@ bool btif_config_get_bin(const std::string& section, const std::string& key, 
  CHECK(length != NULL);



  std::unique_lock<std::recursive_mutex> lock(config_lock);

  const std::string* value_str = config_get_string(*config, section, key, NULL);

  const std::string* value_str;

  const std::string* value_str_from_config =

      config_get_string(*config, section, key, NULL);



  if (!value_str) {

  if (!value_str_from_config) {

    VLOG(1) << __func__ << ": cannot find string for section " << section

            << ", key " << key;

    return false;

  }



  bool in_encrypt_key_name_list = btif_in_encrypt_key_name_list(key);

  bool is_key_encrypted =

      btif_is_key_encrypted(value_str_from_config->size(), key);



  if (in_encrypt_key_name_list && is_key_encrypted) {

    std::string tmp_value_str =

        btif_convert_to_unencrypt_key(*value_str_from_config);

    value_str = &tmp_value_str;

  } else {

    value_str = value_str_from_config;

  }



  size_t value_len = value_str->length();

  if ((value_len % 2) != 0 || *length < (value_len / 2)) {

    LOG(WARNING) << ": value size not divisible by 2, size is " << value_len;
@@ -427,12 +455,71 @@ bool btif_config_get_bin(const std::string& section, const std::string& key, 
    }



  const char* ptr = value_str->c_str();

  for (*length = 0; *ptr; ptr += 2, *length += 1)

  for (*length = 0; *ptr; ptr += 2, *length += 1) {

    sscanf(ptr, "%02hhx", &value[*length]);

  }



  if (btif_is_niap_mode()) {

    if (in_encrypt_key_name_list && !is_key_encrypted) {

      std::string encrypt_str =

          btif_convert_to_encrypt_key(*value_str_from_config);

      config_set_string(config.get(), section, key, encrypt_str);

    }

  } else {

    if (in_encrypt_key_name_list && is_key_encrypted) {

      config_set_string(config.get(), section, key, value_str->c_str());

    }

  }



  return true;

}



static bool btif_in_encrypt_key_name_list(std::string key) {

  return std::find(encrypt_key_name_list,

                   encrypt_key_name_list + ENCRYPT_KEY_NAME_LIST_SIZE,

                   key) != (encrypt_key_name_list + ENCRYPT_KEY_NAME_LIST_SIZE);

}



static bool btif_is_key_encrypted(int key_from_config_size,

                                  std::string key_type_string) {

  if (key_type_string.compare("LinkKey") == 0) {

    return sizeof(LinkKey) * 2 != key_from_config_size;

  } else if (key_type_string.compare("LE_KEY_PENC") == 0) {

    return sizeof(tBTM_LE_PENC_KEYS) * 2 != key_from_config_size;

  } else if (key_type_string.compare("LE_KEY_PID") == 0) {

    return sizeof(tBTM_LE_PID_KEYS) * 2 != key_from_config_size;

  } else if (key_type_string.compare("LE_KEY_LID") == 0) {

    return sizeof(tBTM_LE_PID_KEYS) * 2 != key_from_config_size;

  } else if (key_type_string.compare("LE_KEY_PCSRK") == 0) {

    return sizeof(tBTM_LE_PCSRK_KEYS) * 2 != key_from_config_size;

  } else if (key_type_string.compare("LE_KEY_LENC") == 0) {

    return sizeof(tBTM_LE_LENC_KEYS) * 2 != key_from_config_size;

  } else if (key_type_string.compare("LE_KEY_LCSRK") == 0) {

    return sizeof(tBTM_LE_LCSRK_KEYS) * 2 != key_from_config_size;

  } else {

    VLOG(2) << __func__ << ": " << key_type_string

            << " Key type is unknown, return false first";

    return false;

  }

}



static std::string btif_convert_to_unencrypt_key(

    const std::string& encrypt_str) {

  if (!encrypt_str.empty()) {

    std::string tmp_encrypt_str("");

    if (base::Base64Decode(encrypt_str, &tmp_encrypt_str)) {

      std::string unencrypt_str = btif_keystore.Decrypt(tmp_encrypt_str);

      if (!unencrypt_str.empty()) {

        return unencrypt_str;

      }

    } else {

      LOG(WARNING) << __func__

                   << ": base64string decode fail, will return empty string";

    }

  }

  return "";

}



size_t btif_config_get_bin_length(const std::string& section,

                                  const std::string& key) {

  CHECK(config != NULL);
@@ -466,15 +553,36 @@ bool btif_config_set_bin(const std::string& section, const std::string& key, 
    str[(i * 2) + 1] = lookup[value[i] & 0x0F];

  }



  std::string value_str;

  if (btif_is_niap_mode() && btif_in_encrypt_key_name_list(key)) {

    value_str = btif_convert_to_encrypt_key(str);

  } else {

    value_str = str;

  }



  {

    std::unique_lock<std::recursive_mutex> lock(config_lock);

    config_set_string(config.get(), section, key, str);

    config_set_string(config.get(), section, key, value_str);

  }



  osi_free(str);

  return true;

}



static std::string btif_convert_to_encrypt_key(

    const std::string& unencrypt_str) {

  if (!unencrypt_str.empty()) {

    std::string encrypt_str = btif_keystore.Encrypt(unencrypt_str, 0);

    if (!encrypt_str.empty()) {

      base::Base64Encode(encrypt_str, &encrypt_str);

      return encrypt_str;

    } else {

      LOG(ERROR) << __func__ << ": Encrypt fail, will return empty str.";

    }

  }

  return "";

}



std::list<section_t>& btif_config_sections() { return config->sections; }



bool btif_config_remove(const std::string& section, const std::string& key) {
@@ -641,7 +749,7 @@ static void delete_config_files(void) { 
}



static std::string hash_file(const char* filename) {

  if (!use_key_attestation()) {

  if (!btif_is_niap_mode()) {

    LOG(INFO) << __func__ << ": Disabled for multi-user";

    return DISABLED;

  }
@@ -669,7 +777,7 @@ static std::string hash_file(const char* filename) { 
}



static std::string read_checksum_file(const char* checksum_filename) {

  if (!use_key_attestation()) {

  if (!btif_is_niap_mode()) {

    LOG(INFO) << __func__ << ": Disabled for multi-user";

    return DISABLED;

  }
@@ -683,7 +791,7 @@ static std::string read_checksum_file(const char* checksum_filename) { 


static void write_checksum_file(const char* checksum_filename,

                                const std::string& hash) {

  if (!use_key_attestation()) {

  if (!btif_is_niap_mode()) {

    LOG(INFO) << __func__

              << ": Disabled for multi-user, since config changed removing "

                 "checksums.";

system/btif/src/btif_keystore.cc

+4 −0
Original line number Diff line number Diff line
@@ -98,4 +98,8 @@ KeyStoreNativeReturnCode BtifKeystore::GenerateKey(const std::string& name, 
                                       &software_enforced_characteristics);

}



bool BtifKeystore::DoesKeyExist() {

  return keystore_client_->doesKeyExist(kKeyStore);

}



}  // namespace bluetooth