// Copyright 2020 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROMEOS_ASH_COMPONENTS_DBUS_ATTESTATION_ATTESTATION_CLIENT_H_
#define CHROMEOS_ASH_COMPONENTS_DBUS_ATTESTATION_ATTESTATION_CLIENT_H_
#include <deque>
#include <vector>
#include "base/component_export.h"
#include "base/functional/callback.h"
#include "base/time/time.h"
#include "chromeos/ash/components/dbus/attestation/interface.pb.h"
#include "chromeos/dbus/common/dbus_callback.h"
namespace dbus {
class Bus;
}
namespace ash {
// AttestationClient is used to communicate with the org.chromium.Attestation
// service. All method should be called from the origin thread (UI thread) which
// initializes the DBusThreadManager instance.
class COMPONENT_EXPORT(ASH_DBUS_ATTESTATION) AttestationClient {
public:
using GetKeyInfoCallback =
base::OnceCallback<void(const ::attestation::GetKeyInfoReply&)>;
using GetEndorsementInfoCallback =
base::OnceCallback<void(const ::attestation::GetEndorsementInfoReply&)>;
using GetAttestationKeyInfoCallback = base::OnceCallback<void(
const ::attestation::GetAttestationKeyInfoReply&)>;
using ActivateAttestationKeyCallback = base::OnceCallback<void(
const ::attestation::ActivateAttestationKeyReply&)>;
using CreateCertifiableKeyCallback =
base::OnceCallback<void(const ::attestation::CreateCertifiableKeyReply&)>;
using DecryptCallback =
base::OnceCallback<void(const ::attestation::DecryptReply&)>;
using SignCallback =
base::OnceCallback<void(const ::attestation::SignReply&)>;
using RegisterKeyWithChapsTokenCallback = base::OnceCallback<void(
const ::attestation::RegisterKeyWithChapsTokenReply&)>;
using GetEnrollmentPreparationsCallback = base::OnceCallback<void(
const ::attestation::GetEnrollmentPreparationsReply&)>;
using GetFeaturesCallback =
base::OnceCallback<void(const ::attestation::GetFeaturesReply&)>;
using GetStatusCallback =
base::OnceCallback<void(const ::attestation::GetStatusReply&)>;
using VerifyCallback =
base::OnceCallback<void(const ::attestation::VerifyReply&)>;
using CreateEnrollRequestCallback =
base::OnceCallback<void(const ::attestation::CreateEnrollRequestReply&)>;
using FinishEnrollCallback =
base::OnceCallback<void(const ::attestation::FinishEnrollReply&)>;
using CreateCertificateRequestCallback = base::OnceCallback<void(
const ::attestation::CreateCertificateRequestReply&)>;
using FinishCertificateRequestCallback = base::OnceCallback<void(
const ::attestation::FinishCertificateRequestReply&)>;
using EnrollCallback =
base::OnceCallback<void(const ::attestation::EnrollReply&)>;
using GetCertificateCallback =
base::OnceCallback<void(const ::attestation::GetCertificateReply&)>;
using SignEnterpriseChallengeCallback = base::OnceCallback<void(
const ::attestation::SignEnterpriseChallengeReply&)>;
using SignSimpleChallengeCallback =
base::OnceCallback<void(const ::attestation::SignSimpleChallengeReply&)>;
using SetKeyPayloadCallback =
base::OnceCallback<void(const ::attestation::SetKeyPayloadReply&)>;
using DeleteKeysCallback =
base::OnceCallback<void(const ::attestation::DeleteKeysReply&)>;
using ResetIdentityCallback =
base::OnceCallback<void(const ::attestation::ResetIdentityReply&)>;
using GetEnrollmentIdCallback =
base::OnceCallback<void(const ::attestation::GetEnrollmentIdReply&)>;
using GetCertifiedNvIndexCallback =
base::OnceCallback<void(const ::attestation::GetCertifiedNvIndexReply&)>;
// Interface with testing functionality. Accessed through GetTestInterface(),
// only implemented in the fake implementation.
class TestInterface {
public:
// Sets the preparation status to |is_prepared|. If no injected sequence by
// |ConfigureEnrollmentPreparationsSequence| the enrollment preparations
// always returns |is_prepared|.
virtual void ConfigureEnrollmentPreparations(bool is_prepared) = 0;
// Injects |sequence| of enrollment preparations. Once injected, the
// returned enrollment preparations status will be the element popped from
// the |sequence| one-by-one until all the elements are consumed.
virtual void ConfigureEnrollmentPreparationsSequence(
std::deque<bool> sequence) = 0;
// Injects a bad status to `GetEnrollmentPreparations()` calls. By design,
// this only accepts bad status so |STATUS_SUCCESS| is seen as an illegal
// input and abort the program. To recover the fake behavior to successful
// calls, call ConfigureEnrollmentPreparations(Sequence)?.
virtual void ConfigureEnrollmentPreparationsStatus(
::attestation::AttestationStatus status) = 0;
// Gets the mutable |GetFeaturesReply| that is returned when queried.
virtual ::attestation::GetFeaturesReply* mutable_features_reply() = 0;
// Gets the mutable |GetStatusReply| that is returned when queried.
virtual ::attestation::GetStatusReply* mutable_status_reply() = 0;
// Allowlists |request| so the certificate requests that comes in afterwards
// will get a fake certificate. If any alias of |request| has been
// allowlisted this functions performs no-ops.
virtual void AllowlistCertificateRequest(
const ::attestation::GetCertificateRequest& request) = 0;
// Gets the history of `DeleteKeys()` requests.
virtual const std::vector<::attestation::DeleteKeysRequest>&
delete_keys_history() const = 0;
// Clears the request history of `DeleteKeys()`.
virtual void ClearDeleteKeysHistory() = 0;
// Sets returned enrollment ids, when ignoring/not ignoring cache,
// respectively.
virtual void set_enrollment_id_ignore_cache(const std::string& id) = 0;
virtual void set_cached_enrollment_id(const std::string& id) = 0;
// Sets the returned status of `GetEnrollmentId()` to be D-Bus error for
// `count` times to emulate D-Bus late availability.
virtual void set_enrollment_id_dbus_error_count(int count) = 0;
// Gets the reply to the key info query as a fake database.
virtual ::attestation::GetKeyInfoReply* GetMutableKeyInfoReply(
const std::string& username,
const std::string& label) = 0;
// Sets the returned status of `GetKeyInfo()` to be D-Bus error for
// `count` times to emulate D-Bus late availability.
virtual void set_key_info_dbus_error_count(int count) = 0;
// Gets the remaining count of `GetKeyInfo()` replying D-Bus error.
virtual int key_info_dbus_error_count() const = 0;
// Verifies if `signed_data` is signed against `challenge`.
virtual bool VerifySimpleChallengeResponse(
const std::string& challenge,
const ::attestation::SignedData& signed_data) = 0;
// Sets the status code returned by `SignSimpleChallenge()`.
virtual void set_sign_simple_challenge_status(
::attestation::AttestationStatus status) = 0;
// Allowlists the key used to sign simple challenge.
virtual void AllowlistSignSimpleChallengeKey(const std::string& username,
const std::string& label) = 0;
// Sets the status code returned by `Sign()`.
virtual void set_sign_status(::attestation::AttestationStatus status) = 0;
// Sets the status code returned by `RegisterKeyWithChapsToken()`.
virtual void set_register_key_status(
::attestation::AttestationStatus status) = 0;
// Allowlists the key allowed to be registered to the key store.
virtual void AllowlistRegisterKey(const std::string& username,
const std::string& label) = 0;
// Sets the status code returned by `SignEnterpriseChallenge()`.
virtual void set_sign_enterprise_challenge_status(
::attestation::AttestationStatus status) = 0;
// Allowlists the key used to sign enterprise challenge. Note that
// `include_signed_public_key` and `challenge` are ignored for key
// comparison because they are are part of the key but the inputs for
// signature generation.
virtual void AllowlistSignEnterpriseChallengeKey(
const ::attestation::SignEnterpriseChallengeRequest& request) = 0;
// Signs the enterprise `challenge` with this class the same way the
// enterprise challenge is signed.
virtual std::string GetEnterpriseChallengeFakeSignature(
const std::string& challenge,
bool include_spkac) const = 0;
// Sets the delay to the time we reply to `SignEnterpriseChallenge()`.
virtual void set_sign_enterprise_challenge_delay(
const base::TimeDelta& delay) = 0;
// Sets the allowed ACA type for the legacy attestation flow. The enroll
// request can be created/finished only if the ACA type matches the set ACA
// type. By default, it is default ACA.
virtual void set_aca_type_for_legacy_flow(
::attestation::ACAType aca_type) = 0;
// Sets the status code returned by `CreateEnrollRequestRequest()`.
virtual void set_enroll_request_status(
::attestation::AttestationStatus status) = 0;
// Gets the fake enroll request when the status is configured to be good.
virtual std::string GetFakePcaEnrollRequest() const = 0;
// Gets the fake enroll response that is accepted by `FinishEnroll()`.
virtual std::string GetFakePcaEnrollResponse() const = 0;
// Allowlists the request that has `username`, `request_origin`, `profile`,
// and `key_type`, so the certificate requests that comes in afterwards will
// be successfully created.
virtual void AllowlistLegacyCreateCertificateRequest(
const std::string& username,
const std::string& request_origin,
::attestation::CertificateProfile profile,
::attestation::KeyType key_type) = 0;
// Sets the status code returned by `CreateCertificateRequest()`.
virtual void set_cert_request_status(
::attestation::AttestationStatus status) = 0;
// Gets the fake certificate request when the status is configured to be
// good.
virtual std::string GetFakePcaCertRequest() const = 0;
// Gets the fake enroll response that is accepted by
// `FinishCertificateRequest()`.
virtual std::string GetFakePcaCertResponse() const = 0;
// Gets the fake certificate that is returned by
// successful `FinishCertificateRequest()`.
virtual std::string GetFakeCertificate() const = 0;
// Sets the status code returned by `DeleteKeys()`.
virtual void set_delete_keys_status(
::attestation::AttestationStatus status) = 0;
};
// Not copyable or movable.
AttestationClient(const AttestationClient&) = delete;
AttestationClient& operator=(const AttestationClient&) = delete;
AttestationClient(AttestationClient&&) = delete;
AttestationClient& operator=(AttestationClient&&) = delete;
// Creates and initializes the global instance. |bus| must not be null.
static void Initialize(dbus::Bus* bus);
// Creates and initializes a fake global instance if not already created.
static void InitializeFake();
// Destroys the global instance.
static void Shutdown();
// Returns the global instance which may be null if not initialized.
static AttestationClient* Get();
// Checks if |reply| indicates the attestation service is prepared with any
// ACA.
static bool IsAttestationPrepared(
const ::attestation::GetEnrollmentPreparationsReply& reply);
// Gets the verified access server type from command-line arguments.
static ::attestation::VAType GetVerifiedAccessServerType();
// Attestation daemon D-Bus method calls. See org.chromium.Attestation.xml and
// the corresponding protobuf definitions in Chromium OS code for the
// documentation of the methods and request/ messages.
virtual void GetKeyInfo(const ::attestation::GetKeyInfoRequest& request,
GetKeyInfoCallback callback) = 0;
virtual void GetEndorsementInfo(
const ::attestation::GetEndorsementInfoRequest& request,
GetEndorsementInfoCallback callback) = 0;
virtual void GetAttestationKeyInfo(
const ::attestation::GetAttestationKeyInfoRequest& request,
GetAttestationKeyInfoCallback callback) = 0;
virtual void ActivateAttestationKey(
const ::attestation::ActivateAttestationKeyRequest& request,
ActivateAttestationKeyCallback callback) = 0;
virtual void CreateCertifiableKey(
const ::attestation::CreateCertifiableKeyRequest& request,
CreateCertifiableKeyCallback callback) = 0;
virtual void Decrypt(const ::attestation::DecryptRequest& request,
DecryptCallback callback) = 0;
virtual void Sign(const ::attestation::SignRequest& request,
SignCallback callback) = 0;
virtual void RegisterKeyWithChapsToken(
const ::attestation::RegisterKeyWithChapsTokenRequest& request,
RegisterKeyWithChapsTokenCallback callback) = 0;
virtual void GetEnrollmentPreparations(
const ::attestation::GetEnrollmentPreparationsRequest& request,
GetEnrollmentPreparationsCallback callback) = 0;
virtual void GetFeatures(const ::attestation::GetFeaturesRequest& request,
GetFeaturesCallback callback) = 0;
virtual void GetStatus(const ::attestation::GetStatusRequest& request,
GetStatusCallback callback) = 0;
virtual void Verify(const ::attestation::VerifyRequest& request,
VerifyCallback callback) = 0;
virtual void CreateEnrollRequest(
const ::attestation::CreateEnrollRequestRequest& request,
CreateEnrollRequestCallback callback) = 0;
virtual void FinishEnroll(const ::attestation::FinishEnrollRequest& request,
FinishEnrollCallback callback) = 0;
virtual void CreateCertificateRequest(
const ::attestation::CreateCertificateRequestRequest& request,
CreateCertificateRequestCallback callback) = 0;
virtual void FinishCertificateRequest(
const ::attestation::FinishCertificateRequestRequest& request,
FinishCertificateRequestCallback callback) = 0;
virtual void Enroll(const ::attestation::EnrollRequest& request,
EnrollCallback callback) = 0;
virtual void GetCertificate(
const ::attestation::GetCertificateRequest& request,
GetCertificateCallback callback) = 0;
virtual void SignEnterpriseChallenge(
const ::attestation::SignEnterpriseChallengeRequest& request,
SignEnterpriseChallengeCallback callback) = 0;
virtual void SignSimpleChallenge(
const ::attestation::SignSimpleChallengeRequest& request,
SignSimpleChallengeCallback callback) = 0;
virtual void SetKeyPayload(const ::attestation::SetKeyPayloadRequest& request,
SetKeyPayloadCallback callback) = 0;
virtual void DeleteKeys(const ::attestation::DeleteKeysRequest& request,
DeleteKeysCallback callback) = 0;
virtual void ResetIdentity(const ::attestation::ResetIdentityRequest& request,
ResetIdentityCallback callback) = 0;
virtual void GetEnrollmentId(
const ::attestation::GetEnrollmentIdRequest& request,
GetEnrollmentIdCallback callback) = 0;
virtual void GetCertifiedNvIndex(
const ::attestation::GetCertifiedNvIndexRequest& request,
GetCertifiedNvIndexCallback callback) = 0;
// Runs the callback as soon as the service becomes available.
virtual void WaitForServiceToBeAvailable(
chromeos::WaitForServiceToBeAvailableCallback callback) = 0;
// Returns an interface for testing (fake only), or returns nullptr.
virtual TestInterface* GetTestInterface() = 0;
protected:
// Initialize/Shutdown should be used instead.
AttestationClient();
virtual ~AttestationClient();
};
} // namespace ash
#endif // CHROMEOS_ASH_COMPONENTS_DBUS_ATTESTATION_ATTESTATION_CLIENT_H_
Codebase Browser
chromium