// Copyright 2020 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chromeos/ash/components/dbus/attestation/attestation_client.h"
#include <utility>
#include <google/protobuf/message_lite.h>
#include "base/check_op.h"
#include "base/command_line.h"
#include "base/functional/bind.h"
#include "base/location.h"
#include "base/logging.h"
#include "base/memory/raw_ptr.h"
#include "base/memory/weak_ptr.h"
#include "base/task/single_thread_task_runner.h"
#include "base/time/time.h"
#include "chromeos/ash/components/dbus/attestation/fake_attestation_client.h"
#include "chromeos/dbus/constants/dbus_switches.h"
#include "dbus/bus.h"
#include "dbus/message.h"
#include "dbus/object_path.h"
#include "dbus/object_proxy.h"
#include "third_party/cros_system_api/dbus/attestation/dbus-constants.h"
namespace ash {
namespace {
// Values for the attestation server switch.
const char kAttestationServerDefault[] = "default";
const char kAttestationServerTest[] = "test";
// An arbitrary timeout for getting a certificate.
constexpr base::TimeDelta kGetCertificateTimeout = base::Seconds(80);
AttestationClient* g_instance = nullptr;
// Tries to parse a proto message from |response| into |proto|.
// Returns false if |response| is nullptr or the message cannot be parsed.
bool ParseProto(dbus::Response* response,
google::protobuf::MessageLite* proto) {
if (!response) {
LOG(ERROR) << "Failed to call attestationd";
return false;
}
dbus::MessageReader reader(response);
if (!reader.PopArrayOfBytesAsProto(proto)) {
LOG(ERROR) << "Failed to parse response message from attestationd";
return false;
}
return true;
}
// "Real" implementation of AttestationClient talking to the Attestation daemon
// on the Chrome OS side.
class AttestationClientImpl : public AttestationClient {
public:
AttestationClientImpl() = default;
~AttestationClientImpl() override = default;
// Not copyable or movable.
AttestationClientImpl(const AttestationClientImpl&) = delete;
AttestationClientImpl& operator=(const AttestationClientImpl&) = delete;
AttestationClientImpl(AttestationClientImpl&&) = delete;
AttestationClientImpl& operator=(AttestationClientImpl&&) = delete;
// AttestationClient overrides:
void GetKeyInfo(const ::attestation::GetKeyInfoRequest& request,
GetKeyInfoCallback callback) override {
CallProtoMethod(attestation::kGetKeyInfo, request, std::move(callback));
}
void GetEndorsementInfo(
const ::attestation::GetEndorsementInfoRequest& request,
GetEndorsementInfoCallback callback) override {
CallProtoMethod(attestation::kGetEndorsementInfo, request,
std::move(callback));
}
void GetAttestationKeyInfo(
const ::attestation::GetAttestationKeyInfoRequest& request,
GetAttestationKeyInfoCallback callback) override {
CallProtoMethod(attestation::kGetAttestationKeyInfo, request,
std::move(callback));
}
void ActivateAttestationKey(
const ::attestation::ActivateAttestationKeyRequest& request,
ActivateAttestationKeyCallback callback) override {
CallProtoMethod(attestation::kActivateAttestationKey, request,
std::move(callback));
}
void CreateCertifiableKey(
const ::attestation::CreateCertifiableKeyRequest& request,
CreateCertifiableKeyCallback callback) override {
CallProtoMethod(attestation::kCreateCertifiableKey, request,
std::move(callback));
}
void Decrypt(const ::attestation::DecryptRequest& request,
DecryptCallback callback) override {
CallProtoMethod(attestation::kDecrypt, request, std::move(callback));
}
void Sign(const ::attestation::SignRequest& request,
SignCallback callback) override {
CallProtoMethod(attestation::kSign, request, std::move(callback));
}
void RegisterKeyWithChapsToken(
const ::attestation::RegisterKeyWithChapsTokenRequest& request,
RegisterKeyWithChapsTokenCallback callback) override {
CallProtoMethod(attestation::kRegisterKeyWithChapsToken, request,
std::move(callback));
}
void GetEnrollmentPreparations(
const ::attestation::GetEnrollmentPreparationsRequest& request,
GetEnrollmentPreparationsCallback callback) override {
CallProtoMethod(attestation::kGetEnrollmentPreparations, request,
std::move(callback));
}
void GetFeatures(const ::attestation::GetFeaturesRequest& request,
GetFeaturesCallback callback) override {
CallProtoMethod(attestation::kGetFeatures, request, std::move(callback));
}
void GetStatus(const ::attestation::GetStatusRequest& request,
GetStatusCallback callback) override {
CallProtoMethod(attestation::kGetStatus, request, std::move(callback));
}
void Verify(const ::attestation::VerifyRequest& request,
VerifyCallback callback) override {
CallProtoMethod(attestation::kVerify, request, std::move(callback));
}
void CreateEnrollRequest(
const ::attestation::CreateEnrollRequestRequest& request,
CreateEnrollRequestCallback callback) override {
CallProtoMethod(attestation::kCreateEnrollRequest, request,
std::move(callback));
}
void FinishEnroll(const ::attestation::FinishEnrollRequest& request,
FinishEnrollCallback callback) override {
CallProtoMethod(attestation::kFinishEnroll, request, std::move(callback));
}
void CreateCertificateRequest(
const ::attestation::CreateCertificateRequestRequest& request,
CreateCertificateRequestCallback callback) override {
CallProtoMethod(attestation::kCreateCertificateRequest, request,
std::move(callback));
}
void FinishCertificateRequest(
const ::attestation::FinishCertificateRequestRequest& request,
FinishCertificateRequestCallback callback) override {
CallProtoMethod(attestation::kFinishCertificateRequest, request,
std::move(callback));
}
void Enroll(const ::attestation::EnrollRequest& request,
EnrollCallback callback) override {
CallProtoMethod(attestation::kEnroll, request, std::move(callback));
}
void GetCertificate(const ::attestation::GetCertificateRequest& request,
GetCertificateCallback callback) override {
CallProtoMethodWithTimeout(attestation::kGetCertificate,
kGetCertificateTimeout.InMilliseconds(), request,
std::move(callback));
}
void SignEnterpriseChallenge(
const ::attestation::SignEnterpriseChallengeRequest& request,
SignEnterpriseChallengeCallback callback) override {
CallProtoMethod(attestation::kSignEnterpriseChallenge, request,
std::move(callback));
}
void SignSimpleChallenge(
const ::attestation::SignSimpleChallengeRequest& request,
SignSimpleChallengeCallback callback) override {
CallProtoMethod(attestation::kSignSimpleChallenge, request,
std::move(callback));
}
void SetKeyPayload(const ::attestation::SetKeyPayloadRequest& request,
SetKeyPayloadCallback callback) override {
CallProtoMethod(attestation::kSetKeyPayload, request, std::move(callback));
}
void DeleteKeys(const ::attestation::DeleteKeysRequest& request,
DeleteKeysCallback callback) override {
CallProtoMethod(attestation::kDeleteKeys, request, std::move(callback));
}
void ResetIdentity(const ::attestation::ResetIdentityRequest& request,
ResetIdentityCallback callback) override {
CallProtoMethod(attestation::kResetIdentity, request, std::move(callback));
}
void GetEnrollmentId(const ::attestation::GetEnrollmentIdRequest& request,
GetEnrollmentIdCallback callback) override {
CallProtoMethod(attestation::kGetEnrollmentId, request,
std::move(callback));
}
void GetCertifiedNvIndex(
const ::attestation::GetCertifiedNvIndexRequest& request,
GetCertifiedNvIndexCallback callback) override {
CallProtoMethod(attestation::kGetCertifiedNvIndex, request,
std::move(callback));
}
void WaitForServiceToBeAvailable(
chromeos::WaitForServiceToBeAvailableCallback callback) override {
proxy_->WaitForServiceToBeAvailable(std::move(callback));
}
void Init(dbus::Bus* bus) {
proxy_ = bus->GetObjectProxy(
::attestation::kAttestationServiceName,
dbus::ObjectPath(attestation::kAttestationServicePath));
}
private:
TestInterface* GetTestInterface() override { return nullptr; }
// Calls attestationd's |method_name| method, passing in |request| as input
// with |timeout_ms|. Once the (asynchronous) call finishes, |callback| is
// called with the response proto.
template <typename RequestType, typename ReplyType>
void CallProtoMethodWithTimeout(
const char* method_name,
int timeout_ms,
const RequestType& request,
base::OnceCallback<void(const ReplyType&)> callback) {
dbus::MethodCall method_call(attestation::kAttestationInterface,
method_name);
dbus::MessageWriter writer(&method_call);
if (!writer.AppendProtoAsArrayOfBytes(request)) {
ReplyType reply;
reply.set_status(attestation::STATUS_INVALID_PARAMETER);
base::SingleThreadTaskRunner::GetCurrentDefault()->PostTask(
FROM_HERE, base::BindOnce(std::move(callback), reply));
return;
}
// Bind with the weak pointer of |this| so the response is not
// handled once |this| is already destroyed.
proxy_->CallMethod(
&method_call, timeout_ms,
base::BindOnce(&AttestationClientImpl::HandleResponse<ReplyType>,
weak_factory_.GetWeakPtr(), std::move(callback)));
}
// Calls attestationd's |method_name| method, passing in |request| as input
// with the default timeout. Once the (asynchronous) call finishes, |callback|
// is called with the response proto.
template <typename RequestType, typename ReplyType>
void CallProtoMethod(const char* method_name,
const RequestType& request,
base::OnceCallback<void(const ReplyType&)> callback) {
CallProtoMethodWithTimeout(method_name,
dbus::ObjectProxy::TIMEOUT_USE_DEFAULT, request,
std::move(callback));
}
// Parses the response proto message from |response| and calls |callback| with
// the decoded message. Calls |callback| with an |STATUS_DBUS_ERROR| message
// on error, including timeout.
template <typename ReplyType>
void HandleResponse(base::OnceCallback<void(const ReplyType&)> callback,
dbus::Response* response) {
ReplyType reply_proto;
if (!ParseProto(response, &reply_proto))
reply_proto.set_status(attestation::STATUS_DBUS_ERROR);
std::move(callback).Run(reply_proto);
}
// D-Bus proxy for the Attestation daemon, not owned.
raw_ptr<dbus::ObjectProxy> proxy_ = nullptr;
base::WeakPtrFactory<AttestationClientImpl> weak_factory_{this};
};
} // namespace
AttestationClient::AttestationClient() {
CHECK(!g_instance);
g_instance = this;
}
AttestationClient::~AttestationClient() {
CHECK_EQ(this, g_instance);
g_instance = nullptr;
}
// static
void AttestationClient::Initialize(dbus::Bus* bus) {
CHECK(bus);
(new AttestationClientImpl())->Init(bus);
}
// static
void AttestationClient::InitializeFake() {
new FakeAttestationClient();
}
// static
void AttestationClient::Shutdown() {
CHECK(g_instance);
delete g_instance;
// The destructor resets |g_instance|.
DCHECK(!g_instance);
}
// static
AttestationClient* AttestationClient::Get() {
return g_instance;
}
// static
bool AttestationClient::IsAttestationPrepared(
const ::attestation::GetEnrollmentPreparationsReply& reply) {
if (reply.status() != ::attestation::STATUS_SUCCESS) {
return false;
}
for (const auto& preparation : reply.enrollment_preparations()) {
if (preparation.second) {
return true;
}
}
return false;
}
// static
::attestation::VAType AttestationClient::GetVerifiedAccessServerType() {
std::string value =
base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
chromeos::switches::kAttestationServer);
if (value.empty() || value == kAttestationServerDefault) {
return ::attestation::DEFAULT_VA;
}
if (value == kAttestationServerTest) {
return ::attestation::TEST_VA;
}
LOG(WARNING) << "Invalid Verified Access server value: " << value
<< ". Using default.";
return attestation::DEFAULT_VA;
}
} // namespace ash
Codebase Browser
chromium