1bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// 2bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// Copyright (C) 2015 The Android Open Source Project 3bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// 4bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// Licensed under the Apache License, Version 2.0 (the "License"); 5bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// you may not use this file except in compliance with the License. 6bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// You may obtain a copy of the License at 7bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// 8bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// http://www.apache.org/licenses/LICENSE-2.0 9bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// 10bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// Unless required by applicable law or agreed to in writing, software 11bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// distributed under the License is distributed on an "AS IS" BASIS, 12bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// See the License for the specific language governing permissions and 14bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// limitations under the License. 15bbef5dff2b94fef72012e721cd6124cd87621af4Utkarsh Sanghi// 16ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 17ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#ifndef TRUNKS_POLICY_SESSION_IMPL_H_ 18ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#define TRUNKS_POLICY_SESSION_IMPL_H_ 19ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 20ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#include "trunks/policy_session.h" 21ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 2230c921db09d27768acc1ea0d8b6a9c8e814f931aLuis Hector Chavez#include <memory> 23ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#include <string> 24fc942a5ffc967b7b2b206aee8b91b3bae1933382Utkarsh Sanghi#include <vector> 25ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 26ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#include "trunks/hmac_authorization_delegate.h" 27ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#include "trunks/session_manager.h" 28ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#include "trunks/trunks_factory.h" 29ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 30ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghinamespace trunks { 31ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 32ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// This class implements the PolicySession interface. It is used for 33ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// keeping track of the HmacAuthorizationDelegate used for commands, and to 34ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// provide authorization for commands that need it. It can also be used to 35ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// create custom policies to restrict the usage of keys. 36ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// PolicySessionImpl session(factory); 37ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// session.StartBoundSession(bind_entity, bind_authorization, true); 38ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// session.PolicyPCR(pcr_index, pcr_value); 39ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// factory.GetTpm()->RSA_EncrpytSync(_,_,_,_, session.GetDelegate()); 40ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// NOTE: StartBoundSession/StartUnboundSession should not be called before 41ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// TPM Ownership is taken. This is because starting a session uses the 42ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi// SaltingKey, which is only created after ownership is taken. 434dc4629c415e7ca90ff146d7bb75b5646ecd8b17Darren Krahnclass TRUNKS_EXPORT PolicySessionImpl : public PolicySession { 44ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi public: 45ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi explicit PolicySessionImpl(const TrunksFactory& factory); 46be41115c49f10e8b81ae27963dfebb893c98f06aUtkarsh Sanghi // |session_type| specifies what type of session this is. It can only 47be41115c49f10e8b81ae27963dfebb893c98f06aUtkarsh Sanghi // be TPM_SE_TRIAL or TPM_SE_POLICY. If other values are used, 48be41115c49f10e8b81ae27963dfebb893c98f06aUtkarsh Sanghi // StartBoundSession will return SAPI_RC_INVALID_SESSIONS. 49be41115c49f10e8b81ae27963dfebb893c98f06aUtkarsh Sanghi PolicySessionImpl(const TrunksFactory& factory, TPM_SE session_type); 50ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi ~PolicySessionImpl() override; 51ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 52ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi // PolicySession methods 53ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi AuthorizationDelegate* GetDelegate() override; 54ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi TPM_RC StartBoundSession(TPMI_DH_ENTITY bind_entity, 55ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi const std::string& bind_authorization_value, 56ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi bool enable_encryption) override; 57ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi TPM_RC StartUnboundSession(bool enable_encryption) override; 58fc942a5ffc967b7b2b206aee8b91b3bae1933382Utkarsh Sanghi TPM_RC GetDigest(std::string* digest) override; 59fc942a5ffc967b7b2b206aee8b91b3bae1933382Utkarsh Sanghi TPM_RC PolicyOR(const std::vector<std::string>& digests) override; 60fc942a5ffc967b7b2b206aee8b91b3bae1933382Utkarsh Sanghi TPM_RC PolicyPCR(uint32_t pcr_index, const std::string& pcr_value) override; 61fc942a5ffc967b7b2b206aee8b91b3bae1933382Utkarsh Sanghi TPM_RC PolicyCommandCode(TPM_CC command_code) override; 62fc942a5ffc967b7b2b206aee8b91b3bae1933382Utkarsh Sanghi TPM_RC PolicyAuthValue() override; 63b180754b429c078cbc99175a6059a8b5d0491002Darren Krahn TPM_RC PolicyRestart() override; 64fc942a5ffc967b7b2b206aee8b91b3bae1933382Utkarsh Sanghi void SetEntityAuthorizationValue(const std::string& value) override; 65ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 66ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi private: 67ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi // This factory is only set in the constructor and is used to instantiate 68ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi // The TPM class to forward commands to the TPM chip. 69ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi const TrunksFactory& factory_; 70be41115c49f10e8b81ae27963dfebb893c98f06aUtkarsh Sanghi // This field determines if this session is of type TPM_SE_TRIAL or 71be41115c49f10e8b81ae27963dfebb893c98f06aUtkarsh Sanghi // TPM_SE_POLICY. 72be41115c49f10e8b81ae27963dfebb893c98f06aUtkarsh Sanghi TPM_SE session_type_; 73ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi // This delegate is what provides authorization to commands. It is what is 74ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi // returned when the GetDelegate method is called. 75ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi HmacAuthorizationDelegate hmac_delegate_; 76ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi // This object is used to manage the TPM session associated with this 77ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi // AuthorizationSession. 7830c921db09d27768acc1ea0d8b6a9c8e814f931aLuis Hector Chavez std::unique_ptr<SessionManager> session_manager_; 79ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 80ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi friend class PolicySessionTest; 81ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi DISALLOW_COPY_AND_ASSIGN(PolicySessionImpl); 82ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi}; 83ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 84ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi} // namespace trunks 85ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi 86ff7f2da556b21253a52abbc82e7cf7bee54a850eUtkarsh Sanghi#endif // TRUNKS_POLICY_SESSION_IMPL_H_ 87