Add & implement master key storage API

Change-Id: Ifb2ae4bc6161de58bc0b46770a31948cc2780ae2

diff --git a/lib/key-client.cpp b/lib/key-client.cpp
index 6bb30ad..ea3e122 100644 (file)
--- a/lib/key-client.cpp
+++ b/lib/key-client.cpp
@@ -85,4 +85,26 @@ int KeyClient::verifyPassword(const std::string& device,
        }
 }
 
+int KeyClient::storeMasterKey(const std::string& device,
+                                                         const std::string& password)
+{
+       try {
+               return context->methodCall<int>("KeyServer::storeMasterKey",
+                                                                               device,
+                                                                               password);
+       } catch (runtime::Exception& e) {
+               return error::Unknown;
+       }
+}
+
+int KeyClient::removeMasterKey(const std::string& device)
+{
+       try {
+               return context->methodCall<int>("KeyServer::removeMasterKey",
+                                                                               device);
+       } catch (runtime::Exception& e) {
+               return error::Unknown;
+       }
+}
+
 } // namespace ode

diff --git a/lib/key-client.h b/lib/key-client.h
index aeff433..02247a8 100644 (file)
--- a/lib/key-client.h
+++ b/lib/key-client.h
@@ -36,7 +36,8 @@ public:
                                           const std::string& curPW,
                                           const std::string& newPW);
        int verifyPassword(const std::string& dev, const std::string& password);
-
+       int storeMasterKey(const std::string& dev, const std::string& password);
+       int removeMasterKey(const std::string& dev);
 private:
        RmiClientPtr& context;
 };

diff --git a/lib/ode/keys.cpp b/lib/ode/keys.cpp
index c982700..ba6d24f 100644 (file)
--- a/lib/ode/keys.cpp
+++ b/lib/ode/keys.cpp
@@ -105,3 +105,24 @@ int ode_key_verify(const char* device, const char* password, bool* result)
 
        return ODE_ERROR_NONE;
 }
+
+int ode_key_store_master_key(const char* device, const char* password)
+{
+       RET_ON_FAILURE(device, ODE_ERROR_INVALID_PARAMETER);
+       RET_ON_FAILURE(password, ODE_ERROR_INVALID_PARAMETER);
+
+       ClientContext client;
+       RET_ON_FAILURE(client.connect() == 0, ODE_ERROR_CONNECTION_REFUSED);
+       KeyClient key = client.createInterface<KeyClient>();
+       return toApiError(key.storeMasterKey(device, password));
+}
+
+int ode_key_remove_master_key(const char* device)
+{
+       RET_ON_FAILURE(device, ODE_ERROR_INVALID_PARAMETER);
+
+       ClientContext client;
+       RET_ON_FAILURE(client.connect() == 0, ODE_ERROR_CONNECTION_REFUSED);
+       KeyClient key = client.createInterface<KeyClient>();
+       return toApiError(key.removeMasterKey(device));
+}

diff --git a/lib/ode/keys.h b/lib/ode/keys.h
index d085799..f509984 100644 (file)
--- a/lib/ode/keys.h
+++ b/lib/ode/keys.h
@@ -183,6 +183,63 @@ ODE_API int ode_key_verify_password(const char* device,
                                                                        const char* password,
                                                                        bool* result);
 
+/**
+ * @brief       Stores the master encryption key
+ *
+ * @details     This API can be used to store the @a device key for the purpose
+ *              of system upgrade. It will decrypt the key using @a password and
+ *              pass it to a key storage plugin. Storing the key will overwrite
+ *              a key stored previously for given device.The actual method for
+ *              storing the key depends on the plugin. This API requires that at
+ *              least one such plugin exists. During system upgrade the key will
+ *              be retrieved using this plugin. After the system upgrade is
+ *              finished the key should be removed using
+ *              ode_key_remove_master_key().
+ *
+ * @since_tizen 4.0
+ *
+ * @param[in]   device   The device for which the key should be stored
+ * @param[in]   password The current password the key is secured with
+ *
+ * @return      #ODE_ERROR_NONE on success, otherwise a negative value
+ * @retval      #ODE_ERROR_NONE Successful
+ * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
+ * @retval      #ODE_ERROR_KEY_REJECTED Password doesn't match
+ * @retval      #ODE_ERROR_NO_SUCH_FILE No key exists for given @a device
+ * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
+ *              the privilege to call this API
+ * @retval      #ODE_ERROR_CONNECTION_REFUSED Connection to the server failed
+ * @retval      #ODE_ERROR_UNKNOWN Unknown error
+ *
+ * @see         ode_key_remove_master_key()
+ */
+ODE_API int ode_key_store_master_key(const char* device, const char* password);
+
+/**
+ * @brief       Removes the master encryption key
+ *
+ * @details     This API can be used to remove the @a device key that was stored
+ *              earlier using ode_key_store_master_key(). It should be used when
+ *              system upgrade is finished and the key is no longer necessary.
+ *              Removing a non-existing key will succeed. This API requires that
+ *              at least one plugin supporting key storage is present.
+ *
+ * @since_tizen 4.0
+ *
+ * @param[in]   device   The device for which the key should be removed
+ *
+ * @return      #ODE_ERROR_NONE on success, otherwise a negative value
+ * @retval      #ODE_ERROR_NONE Successful
+ * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
+ * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
+ *              the privilege to call this API
+ * @retval      #ODE_ERROR_CONNECTION_REFUSED Connection to the server failed
+ * @retval      #ODE_ERROR_UNKNOWN Unknown error
+ *
+ * @see         ode_key_remove_master_key()
+ */
+ODE_API int ode_key_remove_master_key(const char* device);
+
 /*
  * @}
  */

diff --git a/rmi/key.h b/rmi/key.h
index 3628aef..dd1b52d 100644 (file)
--- a/rmi/key.h
+++ b/rmi/key.h
@@ -46,6 +46,9 @@ public:
                                                           const std::string& newPW) = 0;
        virtual int verifyPassword(const std::string& dev,
                                                           const std::string& password) = 0;
+       virtual int storeMasterKey(const std::string& dev,
+                                                          const std::string& password) = 0;
+       virtual int removeMasterKey(const std::string& dev) = 0;
 };
 
 } // namespace ode

diff --git a/server/key-server.cpp b/server/key-server.cpp
index 65ec714..a0b00dd 100644 (file)
--- a/server/key-server.cpp
+++ b/server/key-server.cpp
@@ -20,6 +20,8 @@
 #include <algorithm>
 #include <map>
 #include <utility>
+#include <sstream>
+#include <iomanip>
 
 #include "key-server.h"
 #include "file-footer.h"
@@ -28,8 +30,7 @@
 #include "rmi/common.h"
 #include "key-manager/encrypted-key.h"
 #include "key-manager/key-generator.h"
-
-#include <klay/exception.h>
+#include "upgrade-support.h"
 
 namespace ode {
 
@@ -52,6 +53,8 @@ KeyServer::KeyServer(ServerContext& srv) :
        server.expose(this, PRIVILEGE_PLATFORM, (int)(KeyServer::remove)(std::string, std::string));
        server.expose(this, PRIVILEGE_PLATFORM, (int)(KeyServer::changePassword)(std::string, std::string, std::string));
        server.expose(this, PRIVILEGE_PLATFORM, (int)(KeyServer::verifyPassword)(std::string, std::string));
+       server.expose(this, PRIVILEGE_PLATFORM, (int)(KeyServer::storeMasterKey)(std::string, std::string));
+       server.expose(this, PRIVILEGE_PLATFORM, (int)(KeyServer::removeMasterKey)(std::string));
 }
 
 KeyServer::~KeyServer()
@@ -178,4 +181,46 @@ void KeyServer::removePassword(const std::string& dev)
        FileFooter::clear(dev);
 }
 
+int KeyServer::storeMasterKey(const std::string& dev,
+                                                         const std::string& password)
+{
+       if (dev.empty() || password.empty())
+               return error::InvalidParameter;
+
+       if (!FileFooter::exist(dev)) {
+               ERROR(SINK, "Given device has no master key");
+               return error::NoSuchFile;
+       }
+
+       EncryptedKey ek(FileFooter::read(dev));
+
+       auto masterKey = ek.decrypt(password);
+       if (masterKey.empty()) {
+               ERROR(SINK, "Wrong password passed");
+               return error::WrongPassword;
+       }
+
+       try {
+               UpgradeSupport::storeMasterKey(dev, masterKey);
+       } catch (const runtime::Exception& e) {
+               ERROR(SINK, e.what());
+               return error::Unknown;
+       }
+       return error::None;
+}
+
+int KeyServer::removeMasterKey(const std::string& dev)
+{
+       if (dev.empty())
+               return error::InvalidParameter;
+
+       try {
+               UpgradeSupport::removeMasterKey(dev);
+       } catch (const runtime::Exception& e) {
+               ERROR(SINK, e.what());
+               return error::Unknown;
+       }
+       return error::None;
+}
+
 } // namespace ode

diff --git a/server/key-server.h b/server/key-server.h
index db77521..244719b 100644 (file)
--- a/server/key-server.h
+++ b/server/key-server.h
@@ -44,6 +44,8 @@ public:
                        const std::string& password,
                        BinaryData& masterKey) const;
        void removePassword(const std::string& dev);
+       int storeMasterKey(const std::string& dev, const std::string& password);
+       int removeMasterKey(const std::string& dev);
 
 private:
        ServerContext& server;