* @version 1.0
* @brief Sample service implementation.
*/
+#include <vconf/vconf.h>
#include <dpl/serialization.h>
#include <dpl/log/log.h>
#include <ckm/ckm-error.h>
#include <ckm-logic.h>
#include <key-impl.h>
+#ifndef VCONFKEY_SECURITY_MDPP_STATE
+#define VCONFKEY_SECURITY_MDPP_STATE = "file/security_mdpp/security_mdpp_state";
+#endif
+
namespace {
const char * const CERT_SYSTEM_DIR = "/etc/ssl/certs";
+
+const char* const MDPP_MODE_ENFORCING = "Enforcing";
+const char* const MDPP_MODE_ENABLED = "Enabled";
+
} // anonymous namespace
namespace CKM {
-CKMLogic::CKMLogic()
+CKMLogic::CKMLogic() : m_ccMode(false)
{
int retCode = FileSystem::init();
// TODO what can I do when init went wrong? exit(-1) ??
LogError("Fatal error in CertificateStore::setSystemCertificateDir. Chain creation will not work");
}
- cc_mode_status = CCModeState::CC_MODE_OFF;
+ updateCCMode_internal();
}
CKMLogic::~CKMLogic(){}
m_userDataMap.erase(user);
}
- MessageBuffer response;
- Serialization::Serialize(response, retCode);
- return response.Pop();
+ return MessageBuffer::Serialize(retCode).Pop();
}
-RawBuffer CKMLogic::setCCModeStatus(CCModeState mode_status) {
+void CKMLogic::updateCCMode_internal() {
+ int fipsModeStatus = 0;
+ int rc = 0;
+ bool newMode;
- int retCode = CKM_API_SUCCESS;
+ char *mdppState = vconf_get_str(VCONFKEY_SECURITY_MDPP_STATE);
+ newMode = ( mdppState && (!strcmp(mdppState, MDPP_MODE_ENABLED) ||
+ !strcmp(mdppState, MDPP_MODE_ENFORCING)) );
+ if (newMode == m_ccMode)
+ return;
- if((mode_status != CCModeState:: CC_MODE_OFF) && (mode_status != CCModeState:: CC_MODE_ON)) {
- retCode = CKM_API_ERROR_INPUT_PARAM;
- }
+ m_ccMode = newMode;
- cc_mode_status = mode_status;
+ fipsModeStatus = FIPS_mode();
- MessageBuffer response;
- Serialization::Serialize(response, retCode);
- return response.Pop();
+ if(m_ccMode) {
+ if(fipsModeStatus == 0) { // If FIPS mode off
+ rc = FIPS_mode_set(1); // Change FIPS_mode from off to on
+ if(rc == 0) {
+ LogError("Error in FIPS_mode_set function");
+ }
+ }
+ } else {
+ if(fipsModeStatus == 1) { // If FIPS mode on
+ rc = FIPS_mode_set(0); // Change FIPS_mode from on to off
+ if(rc == 0) {
+ LogError("Error in FIPS_mode_set function");
+ }
+ }
+ }
+}
+
+RawBuffer CKMLogic::updateCCMode() {
+ updateCCMode_internal();
+ return MessageBuffer::Serialize(CKM_API_SUCCESS).Pop();
}
RawBuffer CKMLogic::lockUserKey(uid_t user) {
// TODO try catch for all errors that should be supported by error code
m_userDataMap.erase(user);
- MessageBuffer response;
- Serialization::Serialize(response, retCode);
- return response.Pop();
+ return MessageBuffer::Serialize(retCode).Pop();
+
}
RawBuffer CKMLogic::removeUserData(uid_t user) {
FileSystem fs(user);
fs.removeUserData();
- MessageBuffer response;
- Serialization::Serialize(response, retCode);
- return response.Pop();
+ return MessageBuffer::Serialize(retCode).Pop();
}
RawBuffer CKMLogic::changeUserPassword(
retCode = CKM_API_ERROR_SERVER_ERROR;
}
- MessageBuffer response;
- Serialization::Serialize(response, retCode);
- return response.Pop();
+ return MessageBuffer::Serialize(retCode).Pop();
}
RawBuffer CKMLogic::resetUserPassword(
fs.saveDKEK(handler.keyProvider.getWrappedDomainKEK(newPassword));
}
- MessageBuffer response;
- Serialization::Serialize(response, retCode);
- return response.Pop();
+ return MessageBuffer::Serialize(retCode).Pop();
}
RawBuffer CKMLogic::removeApplicationData(const std::string &smackLabel) {
retCode = CKM_API_ERROR_DB_ERROR;
}
- MessageBuffer response;
- Serialization::Serialize(response, retCode);
- return response.Pop();
+ return MessageBuffer::Serialize(retCode).Pop();
}
int CKMLogic::saveDataHelper(
if (0 == m_userDataMap.count(cred.uid))
return CKM_API_ERROR_DB_LOCKED;
+ // proceed to data save
DBRow row = { alias, cred.smackLabel,
policy.extractable, dataType, DBCMAlgType::NONE,
0, RawBuffer(), static_cast<int>(key.size()), key, RawBuffer() };
}
// Do not encrypt data with password during cc_mode on
- if(cc_mode_status == CCModeState::CC_MODE_ON) {
+ if(m_ccMode) {
handler.crypto.encryptRow("", row);
} else {
handler.crypto.encryptRow(policy.password, row);
return CKM_API_SUCCESS;
}
+void CKMLogic::verifyBinaryData(DBDataType dataType, const RawBuffer &input_data) const
+{
+ // verify the data integrity
+ switch(dataType)
+ {
+ case DBDataType::KEY_RSA_PUBLIC:
+ case DBDataType::KEY_RSA_PRIVATE:
+ case DBDataType::KEY_ECDSA_PUBLIC:
+ case DBDataType::KEY_ECDSA_PRIVATE:
+ case DBDataType::KEY_DSA_PUBLIC:
+ case DBDataType::KEY_DSA_PRIVATE:
+ case DBDataType::KEY_AES:
+ {
+ KeyShPtr output_key = CKM::Key::create(input_data);
+ if(output_key.get() == NULL)
+ ThrowMsg(CKMLogic::Exception::InputDataInvalid, "provided binary data is not valid key data");
+ break;
+ }
+
+ case DBDataType::CERTIFICATE:
+ {
+ CertificateShPtr cert = CKM::Certificate::create(input_data, DataFormat::FORM_DER);
+ if(cert.get() == NULL)
+ ThrowMsg(CKMLogic::Exception::InputDataInvalid, "provided binary data is not valid certificate data");
+ break;
+ }
+
+ // TODO: add here BINARY_DATA verification, i.e: max size etc.
+
+ default: break;
+ }
+}
+
RawBuffer CKMLogic::saveData(
Credentials &cred,
int commandId,
{
int retCode = CKM_API_SUCCESS;
try {
+ verifyBinaryData(dataType, key);
+
retCode = saveDataHelper(cred, dataType, alias, key, policy);
LogDebug("SaveDataHelper returned: " << retCode);
+ } catch (const CKMLogic::Exception::InputDataInvalid &e) {
+ LogError("Provided data invalid: " << e.GetMessage());
+ retCode = CKM_API_ERROR_INPUT_PARAM;
} catch (const KeyProvider::Exception::Base &e) {
LogError("KeyProvider failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
retCode = CKM_API_ERROR_DB_ERROR;
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::SAVE));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
- Serialization::Serialize(response, static_cast<int>(dataType));
-
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::SAVE),
+ commandId,
+ retCode,
+ static_cast<int>(dataType));
return response.Pop();
}
retCode = CKM_API_ERROR_DB_LOCKED;
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::REMOVE));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
- Serialization::Serialize(response, static_cast<int>(dataType));
-
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::REMOVE),
+ commandId,
+ retCode,
+ static_cast<int>(dataType));
return response.Pop();
}
}
// Prevent extracting private keys during cc-mode on
- if((cc_mode_status == CCModeState::CC_MODE_ON) && (row.dataType == DBDataType::KEY_RSA_PRIVATE || row.dataType == DBDataType::KEY_ECDSA_PRIVATE || row.dataType == DBDataType::KEY_DSA_PRIVATE)) {
+ if((m_ccMode) && (row.dataType == DBDataType::KEY_RSA_PRIVATE ||
+ row.dataType == DBDataType::KEY_ECDSA_PRIVATE ||
+ row.dataType == DBDataType::KEY_DSA_PRIVATE))
+ {
row.data.clear();
retCode = CKM_API_ERROR_BAD_REQUEST;
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::GET));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
- Serialization::Serialize(response, static_cast<int>(row.dataType));
- Serialization::Serialize(response, row.data);
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::GET),
+ commandId,
+ retCode,
+ static_cast<int>(row.dataType),
+ row.data);
return response.Pop();
}
retCode = CKM_API_ERROR_DB_LOCKED;
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::GET_LIST));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
- Serialization::Serialize(response, static_cast<int>(dataType));
- Serialization::Serialize(response, aliasVector);
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::GET_LIST),
+ commandId,
+ retCode,
+ static_cast<int>(dataType),
+ aliasVector);
return response.Pop();
}
retCode = CKM_API_ERROR_DB_ERROR;
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(protocol_cmd));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
-
- return response.Pop();
+ return MessageBuffer::Serialize(static_cast<int>(protocol_cmd), commandId, retCode).Pop();
}
RawBuffer CKMLogic::getCertificateChain(
chainRawVector.push_back(e.getDER());
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::GET_CHAIN_CERT));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
- Serialization::Serialize(response, chainRawVector);
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::GET_CHAIN_CERT),
+ commandId,
+ retCode,
+ chainRawVector);
return response.Pop();
}
}
senderror:
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::GET_CHAIN_ALIAS));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
- Serialization::Serialize(response, chainRawVector);
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::GET_CHAIN_ALIAS),
+ commandId,
+ retCode,
+ chainRawVector);
return response.Pop();
}
retCode = CKM_API_ERROR_SERVER_ERROR;
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::CREATE_SIGNATURE));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
- Serialization::Serialize(response, signature);
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::CREATE_SIGNATURE),
+ commandId,
+ retCode,
+ signature);
return response.Pop();
}
retCode = CKM_API_ERROR_SERVER_ERROR;
}
- MessageBuffer response;
- Serialization::Serialize(response, static_cast<int>(LogicCommand::VERIFY_SIGNATURE));
- Serialization::Serialize(response, commandId);
- Serialization::Serialize(response, retCode);
-
+ auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::VERIFY_SIGNATURE),
+ commandId,
+ retCode);
return response.Pop();
}
retCode = CKM_API_ERROR_DB_LOCKED;
}
- MessageBuffer response;
- Serialization::Serialize(response, command);
- Serialization::Serialize(response, msgID);
- Serialization::Serialize(response, retCode);
-
- return response.Pop();
+ return MessageBuffer::Serialize(command, msgID, retCode).Pop();
}
RawBuffer CKMLogic::denyAccess(
retCode = CKM_API_ERROR_DB_LOCKED;
}
- MessageBuffer response;
- Serialization::Serialize(response, command);
- Serialization::Serialize(response, msgID);
- Serialization::Serialize(response, retCode);
-
- return response.Pop();
+ return MessageBuffer::Serialize(command, msgID, retCode).Pop();
}
} // namespace CKM
projects / platform / core / security / key-manager.git / blobdiff