1/*
2 * Copyright (C) 2015 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef IGATEKEEPER_SERVICE_H_
18#define IGATEKEEPER_SERVICE_H_
19
20#include <binder/IInterface.h>
21#include <binder/Parcel.h>
22
23namespace android {
24
25/*
26 * This must be kept manually in sync with frameworks/base's IGateKeeperService.aidl
27 */
28class IGateKeeperService : public IInterface {
29public:
30    enum {
31        ENROLL = IBinder::FIRST_CALL_TRANSACTION + 0,
32        VERIFY = IBinder::FIRST_CALL_TRANSACTION + 1,
33        VERIFY_CHALLENGE = IBinder::FIRST_CALL_TRANSACTION + 2,
34        GET_SECURE_USER_ID = IBinder::FIRST_CALL_TRANSACTION + 3,
35        CLEAR_SECURE_USER_ID = IBinder::FIRST_CALL_TRANSACTION + 4,
36    };
37
38    enum {
39        GATEKEEPER_RESPONSE_OK = 0,
40        GATEKEEPER_RESPONSE_RETRY = 1,
41        GATEKEEPER_RESPONSE_ERROR = -1,
42    };
43
44    // DECLARE_META_INTERFACE - C++ client interface not needed
45    static const android::String16 descriptor;
46    virtual const android::String16& getInterfaceDescriptor() const;
47    IGateKeeperService() {}
48    virtual ~IGateKeeperService() {}
49
50    /**
51     * Enrolls a password with the GateKeeper. Returns 0 on success, negative on failure.
52     * Returns:
53     * - 0 on success
54     * - A timestamp T > 0 if the call has failed due to throttling and should not
55     *   be reattempted until T milliseconds have elapsed
56     * - -1 on failure
57     */
58    virtual int enroll(uint32_t uid,
59            const uint8_t *current_password_handle, uint32_t current_password_handle_length,
60            const uint8_t *current_password, uint32_t current_password_length,
61            const uint8_t *desired_password, uint32_t desired_password_length,
62            uint8_t **enrolled_password_handle, uint32_t *enrolled_password_handle_length) = 0;
63
64    /**
65     * Verifies a password previously enrolled with the GateKeeper.
66     * Returns:
67     * - 0 on success
68     * - A timestamp T > 0 if the call has failed due to throttling and should not
69     *   be reattempted until T milliseconds have elapsed
70     * - -1 on failure
71     */
72    virtual int verify(uint32_t uid, const uint8_t *enrolled_password_handle,
73            uint32_t enrolled_password_handle_length,
74            const uint8_t *provided_password, uint32_t provided_password_length,
75            bool *request_reenroll) = 0;
76
77    /**
78     * Verifies a password previously enrolled with the GateKeeper.
79     * Returns:
80     * - 0 on success
81     * - A timestamp T > 0 if the call has failed due to throttling and should not
82     *   be reattempted until T milliseconds have elapsed
83     * - -1 on failure
84     */
85    virtual int verifyChallenge(uint32_t uid, uint64_t challenge,
86            const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length,
87            const uint8_t *provided_password, uint32_t provided_password_length,
88            uint8_t **auth_token, uint32_t *auth_token_length, bool *request_reenroll) = 0;
89    /**
90     * Returns the secure user ID for the provided android user
91     */
92    virtual uint64_t getSecureUserId(uint32_t uid) = 0;
93
94    /**
95     * Clears the secure user ID associated with the user.
96     */
97    virtual void clearSecureUserId(uint32_t uid) = 0;
98};
99
100// ----------------------------------------------------------------------------
101
102class BnGateKeeperService: public BnInterface<IGateKeeperService> {
103public:
104    virtual status_t onTransact(uint32_t code, const Parcel& data, Parcel* reply,
105            uint32_t flags = 0);
106};
107
108} // namespace android
109
110#endif
111
112