/*
* Copyright (C) 2009 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <unistd.h>
#include <signal.h>
#include <errno.h>
#include <dirent.h>
#include <fcntl.h>
#include <limits.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <arpa/inet.h>
#include <openssl/aes.h>
#include <openssl/evp.h>
#include <openssl/md5.h>
#define LOG_TAG "keystore"
#include <cutils/log.h>
#include <cutils/sockets.h>
#include <private/android_filesystem_config.h>
#include "keystore.h"
/* KeyStore is a secured storage for key-value pairs. In this implementation,
* each file stores one key-value pair. Keys are encoded in file names, and
* values are encrypted with checksums. The encryption key is protected by a
* user-defined password. To keep things simple, buffers are always larger than
* the maximum space we needed, so boundary checks on buffers are omitted. */
#define KEY_SIZE ((NAME_MAX - 15) / 2)
#define VALUE_SIZE 32768
#define PASSWORD_SIZE VALUE_SIZE
/* Here is the encoding of keys. This is necessary in order to allow arbitrary
* characters in keys. Characters in [0-~] are not encoded. Others are encoded
* into two bytes. The first byte is one of [+-.] which represents the first
* two bits of the character. The second byte encodes the rest of the bits into
* [0-o]. Therefore in the worst case the length of a key gets doubled. Note
* that Base64 cannot be used here due to the need of prefix match on keys. */
static int encode_key(char *out, uint8_t *in, int length)
{
int i;
for (i = length; i > 0; --i, ++in, ++out) {
if (*in >= '0' && *in <= '~') {
*out = *in;
} else {
*out = '+' + (*in >> 6);
*++out = '0' + (*in & 0x3F);
++length;
}
}
*out = 0;
return length;
}
static int decode_key(uint8_t *out, char *in, int length)
{
int i;
for (i = 0; i < length; ++i, ++in, ++out) {
if (*in >= '0' && *in <= '~') {
*out = *in;
} else {
*out = (*in - '+') << 6;
*out |= (*++in - '0') & 0x3F;
--length;
}
}
*out = 0;
return length;
}
/* Here is the protocol used in both requests and responses:
* code [length_1 message_1 ... length_n message_n] end-of-file
* where code is one byte long and lengths are unsigned 16-bit integers in
* network order. Thus the maximum length of a message is 65535 bytes. */
static int the_socket = -1;
static int recv_code(int8_t *code)
{
return recv(the_socket, code, 1, 0) == 1;
}
static int recv_message(uint8_t *message, int length)
{
uint8_t bytes[2];
if (recv(the_socket, &bytes[0], 1, 0) != 1 ||
recv(the_socket, &bytes[1], 1, 0) != 1) {
return -1;
} else {
int offset = bytes[0] << 8 | bytes[1];
if (length < offset) {
return -1;
}
length = offset;
offset = 0;
while (offset < length) {
int n = recv(the_socket, &message[offset], length - offset, 0);
if (n <= 0) {
return -1;
}
offset += n;
}
}
return length;
}
static int recv_end_of_file()
{
uint8_t byte;
return recv(the_socket, &byte, 1, 0) == 0;
}
static void send_code(int8_t code)
{
send(the_socket, &code, 1, 0);
}
static void send_message(uint8_t *message, int length)
{
uint16_t bytes = htons(length);
send(the_socket, &bytes, 2, 0);
send(the_socket, message, length, 0);
}
/* Here is the file format. Values are encrypted by AES CBC, and MD5 is used to
* compute their checksums. To make the files portable, the length is stored in
* network order. Note that the first four bytes are reserved for future use and
* are always set to zero in this implementation. */
static int the_entropy = -1;
static struct __attribute__((packed)) {
uint32_t reserved;
uint8_t vector[AES_BLOCK_SIZE];
uint8_t encrypted[0];
uint8_t digest[MD5_DIGEST_LENGTH];
uint8_t digested[0];
int32_t length;
uint8_t value[VALUE_SIZE + AES_BLOCK_SIZE];
} blob;
static int8_t encrypt_blob(char *name, AES_KEY *aes_key)
{
uint8_t vector[AES_BLOCK_SIZE];
int length;
int fd;
if (read(the_entropy, vector, AES_BLOCK_SIZE) != AES_BLOCK_SIZE) {
return SYSTEM_ERROR;
}
length = blob.length + blob.value - blob.encrypted;
length = (length + AES_BLOCK_SIZE - 1) / AES_BLOCK_SIZE * AES_BLOCK_SIZE;
blob.length = htonl(blob.length);
MD5(blob.digested, length - (blob.digested - blob.encrypted), blob.digest);
memcpy(vector, blob.vector, AES_BLOCK_SIZE);
AES_cbc_encrypt(blob.encrypted, blob.encrypted, length, aes_key, vector,
AES_ENCRYPT);
blob.reserved = 0;
length += blob.encrypted - (uint8_t *)&blob;
fd = open(".tmp", O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
length -= write(fd, &blob, length);
close(fd);
return (length || rename(".tmp", name)) ? SYSTEM_ERROR : NO_ERROR;
}
static int8_t decrypt_blob(char *name, AES_KEY *aes_key)
{
int fd = open(name, O_RDONLY);
int length;
if (fd == -1) {
return (errno == ENOENT) ? KEY_NOT_FOUND : SYSTEM_ERROR;
}
length = read(fd, &blob, sizeof(blob));
close(fd);
length -= blob.encrypted - (uint8_t *)&blob;
if (length < blob.value - blob.encrypted || length % AES_BLOCK_SIZE != 0) {
return VALUE_CORRUPTED;
}
AES_cbc_encrypt(blob.encrypted, blob.encrypted, length, aes_key,
blob.vector, AES_DECRYPT);
length -= blob.digested - blob.encrypted;
if (memcmp(blob.digest, MD5(blob.digested, length, NULL),
MD5_DIGEST_LENGTH)) {
return VALUE_CORRUPTED;
}
length -= blob.value - blob.digested;
blob.length = ntohl(blob.length);
return (blob.length < 0 || blob.length > length) ? VALUE_CORRUPTED :
NO_ERROR;
}
/* Here are the actions. Each of them is a function without arguments. All
* information is defined in global variables, which are set properly before
* performing an action. The number of parameters required by each action is
* fixed and defined in a table. If the return value of an action is positive,
* it will be treated as a response code and transmitted to the client. Note
* that the lengths of parameters are checked when they are received, so
* boundary checks on parameters are omitted. */
#define MAX_PARAM 2
#define MAX_RETRY 4
static uid_t uid = -1;
static int8_t state = UNINITIALIZED;
static int8_t retry = MAX_RETRY;
static struct {
int length;
uint8_t value[VALUE_SIZE];
} params[MAX_PARAM];
static AES_KEY encryption_key;
static AES_KEY decryption_key;
static int8_t test()
{
return state;
}
static int8_t get()
{
char name[NAME_MAX];
int n = sprintf(name, "%u_", uid);
encode_key(&name[n], params[0].value, params[0].length);
n = decrypt_blob(name, &decryption_key);
if (n != NO_ERROR) {
return n;
}
send_code(NO_ERROR);
send_message(blob.value, blob.length);
return -NO_ERROR;
}
static int8_t insert()
{
char name[NAME_MAX];
int n = sprintf(name, "%u_", uid);
encode_key(&name[n], params[0].value, params[0].length);
blob.length = params[1].length;
memcpy(blob.value, params[1].value, params[1].length);
return encrypt_blob(name, &encryption_key);
}
static int8_t delete()
{
char name[NAME_MAX];
int n = sprintf(name, "%u_", uid);
encode_key(&name[n], params[0].value, params[0].length);
return (unlink(name) && errno != ENOENT) ? SYSTEM_ERROR : NO_ERROR;
}
static int8_t exist()
{
char name[NAME_MAX];
int n = sprintf(name, "%u_", uid);
encode_key(&name[n], params[0].value, params[0].length);
if (access(name, R_OK) == -1) {
return (errno != ENOENT) ? SYSTEM_ERROR : KEY_NOT_FOUND;
}
return NO_ERROR;
}
static int8_t saw()
{
DIR *dir = opendir(".");
struct dirent *file;
char name[NAME_MAX];
int n;
if (!dir) {
return SYSTEM_ERROR;
}
n = sprintf(name, "%u_", uid);
n += encode_key(&name[n], params[0].value, params[0].length);
send_code(NO_ERROR);
while ((file = readdir(dir)) != NULL) {
if (!strncmp(name, file->d_name, n)) {
char *p = &file->d_name[n];
params[0].length = decode_key(params[0].value, p, strlen(p));
send_message(params[0].value, params[0].length);
}
}
closedir(dir);
return -NO_ERROR;
}
static int8_t reset()
{
DIR *dir = opendir(".");
struct dirent *file;
memset(&encryption_key, 0, sizeof(encryption_key));
memset(&decryption_key, 0, sizeof(decryption_key));
state = UNINITIALIZED;
retry = MAX_RETRY;
if (!dir) {
return SYSTEM_ERROR;
}
while ((file = readdir(dir)) != NULL) {
unlink(file->d_name);
}
closedir(dir);
return NO_ERROR;
}
#define MASTER_KEY_FILE ".masterkey"
#define MASTER_KEY_SIZE 16
static void generate_key(uint8_t *key, uint8_t *password, int length)
{
PKCS5_PBKDF2_HMAC_SHA1((char *)password, length, (uint8_t *)"keystore",
sizeof("keystore"), 1024, MASTER_KEY_SIZE, key);
}
static int8_t password()
{
uint8_t key[MASTER_KEY_SIZE];
AES_KEY aes_key;
int n;
if (state == UNINITIALIZED) {
blob.length = MASTER_KEY_SIZE;
if (read(the_entropy, blob.value, MASTER_KEY_SIZE) != MASTER_KEY_SIZE) {
return SYSTEM_ERROR;
}
} else {
generate_key(key, params[0].value, params[0].length);
AES_set_decrypt_key(key, MASTER_KEY_SIZE * 8, &aes_key);
n = decrypt_blob(MASTER_KEY_FILE, &aes_key);
if (n == SYSTEM_ERROR) {
return SYSTEM_ERROR;
}
if (n != NO_ERROR || blob.length != MASTER_KEY_SIZE) {
if (retry <= 0) {
reset();
return UNINITIALIZED;
}
return WRONG_PASSWORD + --retry;
}
}
if (params[1].length == -1) {
memcpy(key, blob.value, MASTER_KEY_SIZE);
} else {
generate_key(key, params[1].value, params[1].length);
AES_set_encrypt_key(key, MASTER_KEY_SIZE * 8, &aes_key);
memcpy(key, blob.value, MASTER_KEY_SIZE);
n = encrypt_blob(MASTER_KEY_FILE, &aes_key);
}
if (n == NO_ERROR) {
AES_set_encrypt_key(key, MASTER_KEY_SIZE * 8, &encryption_key);
AES_set_decrypt_key(key, MASTER_KEY_SIZE * 8, &decryption_key);
state = NO_ERROR;
retry = MAX_RETRY;
}
return n;
}
static int8_t lock()
{
memset(&encryption_key, 0, sizeof(encryption_key));
memset(&decryption_key, 0, sizeof(decryption_key));
state = LOCKED;
return NO_ERROR;
}
static int8_t unlock()
{
params[1].length = -1;
return password();
}
/* Here are the permissions, actions, users, and the main function. */
enum perm {
TEST = 1,
GET = 2,
INSERT = 4,
DELETE = 8,
EXIST = 16,
SAW = 32,
RESET = 64,
PASSWORD = 128,
LOCK = 256,
UNLOCK = 512,
};
static struct action {
int8_t (*run)();
int8_t code;
int8_t state;
uint32_t perm;
int lengths[MAX_PARAM];
} actions[] = {
{test, 't', 0, TEST, {0}},
{get, 'g', NO_ERROR, GET, {KEY_SIZE}},
{insert, 'i', NO_ERROR, INSERT, {KEY_SIZE, VALUE_SIZE}},
{delete, 'd', 0, DELETE, {KEY_SIZE}},
{exist, 'e', 0, EXIST, {KEY_SIZE}},
{saw, 's', 0, SAW, {KEY_SIZE}},
{reset, 'r', 0, RESET, {0}},
{password, 'p', 0, PASSWORD, {PASSWORD_SIZE, PASSWORD_SIZE}},
{lock, 'l', NO_ERROR, LOCK, {0}},
{unlock, 'u', LOCKED, UNLOCK, {PASSWORD_SIZE}},
{NULL, 0 , 0, 0, {0}},
};
static struct user {
uid_t uid;
uid_t euid;
uint32_t perms;
} users[] = {
{AID_SYSTEM, ~0, ~GET},
{AID_VPN, AID_SYSTEM, GET},
{AID_WIFI, AID_SYSTEM, GET},
{AID_ROOT, AID_SYSTEM, GET},
{~0, ~0, TEST | GET | INSERT | DELETE | EXIST | SAW},
};
static int8_t process(int8_t code) {
struct user *user = users;
struct action *action = actions;
int i;
while (~user->uid && user->uid != uid) {
++user;
}
while (action->code && action->code != code) {
++action;
}
if (!action->code) {
return UNDEFINED_ACTION;
}
if (!(action->perm & user->perms)) {
return PERMISSION_DENIED;
}
if (action->state && action->state != state) {
return state;
}
if (~user->euid) {
uid = user->euid;
}
for (i = 0; i < MAX_PARAM && action->lengths[i]; ++i) {
params[i].length = recv_message(params[i].value, action->lengths[i]);
if (params[i].length == -1) {
return PROTOCOL_ERROR;
}
}
if (!recv_end_of_file()) {
return PROTOCOL_ERROR;
}
return action->run();
}
#define RANDOM_DEVICE "/dev/urandom"
int main(int argc, char **argv)
{
int control_socket = android_get_control_socket("keystore");
if (argc < 2) {
LOGE("A directory must be specified!");
return 1;
}
if (chdir(argv[1]) == -1) {
LOGE("chdir: %s: %s", argv[1], strerror(errno));
return 1;
}
if ((the_entropy = open(RANDOM_DEVICE, O_RDONLY)) == -1) {
LOGE("open: %s: %s", RANDOM_DEVICE, strerror(errno));
return 1;
}
if (listen(control_socket, 3) == -1) {
LOGE("listen: %s", strerror(errno));
return 1;
}
signal(SIGPIPE, SIG_IGN);
if (access(MASTER_KEY_FILE, R_OK) == 0) {
state = LOCKED;
}
while ((the_socket = accept(control_socket, NULL, 0)) != -1) {
struct timeval tv = {.tv_sec = 3};
struct ucred cred;
socklen_t size = sizeof(cred);
int8_t request;
setsockopt(the_socket, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
setsockopt(the_socket, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
if (getsockopt(the_socket, SOL_SOCKET, SO_PEERCRED, &cred, &size)) {
LOGW("getsockopt: %s", strerror(errno));
} else if (recv_code(&request)) {
int8_t old_state = state;
int8_t response;
uid = cred.uid;
if ((response = process(request)) > 0) {
send_code(response);
response = -response;
}
LOGI("uid: %d action: %c -> %d state: %d -> %d retry: %d",
cred.uid, request, -response, old_state, state, retry);
}
close(the_socket);
}
LOGE("accept: %s", strerror(errno));
return 1;
}