path: root/src/manager/service/ckm-service.cpp

/*
 *  Copyright (c) 2000 - 2015 Samsung Electronics Co., Ltd All Rights Reserved
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License
 *
 *
 * @file        ckm-service.cpp
 * @author      Bartlomiej Grzelewski (b.grzelewski@samsung.com)
 * @version     1.0
 * @brief       CKM service implementation.
 */

#include <protocols.h>

#include <dpl/serialization.h>
#include <dpl/log/log.h>

#include <ckm-service.h>
#include <ckm-logic.h>
#include <initial-value-loader.h>

namespace {
const CKM::InterfaceID SOCKET_ID_CONTROL = 0;
const CKM::InterfaceID SOCKET_ID_STORAGE = 1;
} // namespace anonymous

namespace CKM {

CKMService::CKMService() :
	m_logic(new CKMLogic)
{
	InitialValues::LoadFiles(*m_logic);
}

CKMService::~CKMService()
{
	delete m_logic;
}

void CKMService::Start()
{
	// unlock system db at first to migrate old ss data earlier than user db unlocked.
	// Because data should be migrated to both of system db and user(default owner) db
	// and old data resource will be removed after migrated to user db
	m_logic->unlockSystemDB();

	Create();
}

void CKMService::Stop()
{
	Join();
}

GenericSocketService::ServiceDescriptionVector
CKMService::GetServiceDescription()
{
	// empty string on privilege field means non-privileged
	return ServiceDescriptionVector {
		{SERVICE_SOCKET_CKM_CONTROL, "http://tizen.org/privilege/internal/service", SOCKET_ID_CONTROL},
		{SERVICE_SOCKET_CKM_STORAGE, "", SOCKET_ID_STORAGE}
	};
}

void CKMService::SetCommManager(CommMgr *manager)
{
	ThreadService::SetCommManager(manager);
	Register(*manager);
}

bool CKMService::ProcessOne(
	const ConnectionID &conn,
	ConnectionInfo &info,
	bool allowed)
{
	LogDebug("process One");
	RawBuffer response;

	try {
		if (!info.buffer.Ready())
			return false;

		if (info.interfaceID == SOCKET_ID_CONTROL)
			response = ProcessControl(info.buffer, allowed);
		else
			response = ProcessStorage(info.credentials, info.buffer);

		m_serviceManager->Write(conn, response);

		return true;
	} catch (const MessageBuffer::Exception::Base &e) {
		LogError("Broken protocol. Closing socket: " << e.DumpToString());
	} catch (const Exception::BrokenProtocol &e) {
		LogError("Broken protocol. Closing socket: " << e.DumpToString());
	} catch (const std::string &e) {
		LogError("String exception(" << e << "). Closing socket");
	} catch (const std::exception &e) {
		LogError("Std exception:: " << e.what());
	} catch (...) {
		LogError("Unknown exception. Closing socket.");
	}

	m_serviceManager->Close(conn);
	return false;
}

RawBuffer CKMService::ProcessControl(MessageBuffer &buffer, bool allowed)
{
	int command = 0;
	uid_t user = 0;
	ControlCommand cc;
	Password newPass, oldPass;
	ClientId explicitOwner;

	buffer.Deserialize(command);

	LogDebug("Process control. Command: " << command);

	std::function<RawBuffer(void)> logicFunc;

	cc = static_cast<ControlCommand>(command);

	switch (cc) {
	case ControlCommand::UNLOCK_USER_KEY:
		buffer.Deserialize(user, newPass);
		logicFunc = [&]() {
			return m_logic->unlockUserKey(user, newPass);
		};
		break;

	case ControlCommand::LOCK_USER_KEY:
		buffer.Deserialize(user);
		logicFunc = [&]() {
			return m_logic->lockUserKey(user);
		};
		break;

	case ControlCommand::REMOVE_USER_DATA:
		buffer.Deserialize(user);
		logicFunc = [&]() {
			return m_logic->removeUserData(user);
		};
		break;

	case ControlCommand::CHANGE_USER_PASSWORD:
		buffer.Deserialize(user, oldPass, newPass);
		logicFunc = [&]() {
			return m_logic->changeUserPassword(user, oldPass, newPass);
		};
		break;

	case ControlCommand::RESET_USER_PASSWORD:
		buffer.Deserialize(user, newPass);
		logicFunc = [&]() {
			return m_logic->resetUserPassword(user, newPass);
		};
		break;

	case ControlCommand::REMOVE_APP_DATA:
		buffer.Deserialize(explicitOwner);
		logicFunc = [&]() {
			return m_logic->removeApplicationData(explicitOwner);
		};
		break;

	case ControlCommand::UPDATE_CC_MODE:
		logicFunc = [&]() {
			return m_logic->updateCCMode();
		};
		break;

	case ControlCommand::SET_PERMISSION: {
		Name name;
		ClientId accessor;
		PermissionMask permissionMask = 0;

		buffer.Deserialize(user, name, explicitOwner, accessor, permissionMask);

		Credentials cred(user, explicitOwner);
		logicFunc = [&, name, explicitOwner, accessor, permissionMask, cred]() {
			return m_logic->setPermission(
					   cred,
					   command,
					   0, // dummy
					   name,
					   explicitOwner,
					   accessor,
					   permissionMask);
		};
		break;
	}

	default:
		Throw(Exception::BrokenProtocol);
	}

	if (!allowed) {
		LogError("Access denied!");
		return MessageBuffer::Serialize(CKM_API_ERROR_ACCESS_DENIED).Pop();
	}

	return logicFunc();
}

RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
{
	int command = 0;
	int msgID = 0;
	int tmpDataType = 0;
	Name name;
	ClientId explicitOwner, accessor;

	buffer.Deserialize(command);
	buffer.Deserialize(msgID);

	// This is a workaround solution for locktype=None in Tizen 2.2.1
	// When locktype is None, lockscreen app doesn't interfere with unlocking process.
	// Therefor lockscreen app cannot notify unlock events to key-manager when locktype is None.
	// So, to unlock user data when lock type is None, key-manager always try to unlock user data with null password.
	// Even if the result is fail, it will be ignored.
	Password nullPassword("");
	m_logic->unlockUserKey(cred.clientUid, nullPassword);

	LogDebug("Process storage. Command: " << command);

	switch (static_cast<LogicCommand>(command)) {
	case LogicCommand::SAVE: {
		RawBuffer rawData;
		PolicySerializable policy;
		buffer.Deserialize(tmpDataType, name, explicitOwner, rawData, policy);
		return m_logic->saveData(
				   cred,
				   msgID,
				   name,
				   explicitOwner,
				   Crypto::Data(DataType(tmpDataType), std::move(rawData)),
				   policy);
	}

	case LogicCommand::SAVE_PKCS12: {
		RawBuffer rawData;
		PKCS12Serializable pkcs;
		PolicySerializable keyPolicy, certPolicy;
		buffer.Deserialize(name, explicitOwner, pkcs, keyPolicy, certPolicy);
		return m_logic->savePKCS12(
				   cred,
				   msgID,
				   name,
				   explicitOwner,
				   pkcs,
				   keyPolicy,
				   certPolicy);
	}

	case LogicCommand::REMOVE: {
		buffer.Deserialize(name, explicitOwner);
		return m_logic->removeData(
				   cred,
				   msgID,
				   name,
				   explicitOwner);
	}

	case LogicCommand::GET: {
		Password password;
		buffer.Deserialize(tmpDataType, name, explicitOwner, password);
		return m_logic->getData(
				   cred,
				   msgID,
				   DataType(tmpDataType),
				   name,
				   explicitOwner,
				   password);
	}

	case LogicCommand::GET_PKCS12: {
		Password passKey;
		Password passCert;
		buffer.Deserialize(
			name,
			explicitOwner,
			passKey,
			passCert);
		return m_logic->getPKCS12(
				   cred,
				   msgID,
				   name,
				   explicitOwner,
				   passKey,
				   passCert);
	}

	case LogicCommand::GET_LIST: {
		buffer.Deserialize(tmpDataType);
		return m_logic->getDataList(
				   cred,
				   msgID,
				   DataType(tmpDataType));
	}

	case LogicCommand::CREATE_KEY_AES: {
		int size = 0;
		Name keyName;
		ClientId keyExplicitOwner;
		PolicySerializable policyKey;
		buffer.Deserialize(
			size,
			policyKey,
			keyName,
			keyExplicitOwner);
		return m_logic->createKeyAES(
				   cred,
				   msgID,
				   size,
				   keyName,
				   keyExplicitOwner,
				   policyKey);
	}

	case LogicCommand::CREATE_KEY_PAIR: {
		CryptoAlgorithmSerializable keyGenAlgorithm;
		Name privateKeyName;
		ClientId explicitOwnerPrivate;
		Name publicKeyName;
		ClientId explicitOwnerPublic;
		PolicySerializable policyPrivateKey;
		PolicySerializable policyPublicKey;
		buffer.Deserialize(keyGenAlgorithm,
						   policyPrivateKey,
						   policyPublicKey,
						   privateKeyName,
						   explicitOwnerPrivate,
						   publicKeyName,
						   explicitOwnerPublic);
		return m_logic->createKeyPair(
				   cred,
				   msgID,
				   keyGenAlgorithm,
				   privateKeyName,
				   explicitOwnerPrivate,
				   publicKeyName,
				   explicitOwnerPublic,
				   policyPrivateKey,
				   policyPublicKey);
	}

	case LogicCommand::GET_CHAIN_CERT: {
		RawBuffer certificate;
		RawBufferVector untrustedVector;
		RawBufferVector trustedVector;
		bool systemCerts = false;
		buffer.Deserialize(certificate, untrustedVector, trustedVector, systemCerts);
		return m_logic->getCertificateChain(
				   cred,
				   msgID,
				   certificate,
				   untrustedVector,
				   trustedVector,
				   systemCerts);
	}

	case LogicCommand::GET_CHAIN_ALIAS: {
		RawBuffer certificate;
		OwnerNameVector untrustedVector;
		OwnerNameVector trustedVector;
		bool systemCerts = false;
		buffer.Deserialize(certificate, untrustedVector, trustedVector, systemCerts);
		return m_logic->getCertificateChain(
				   cred,
				   msgID,
				   certificate,
				   untrustedVector,
				   trustedVector,
				   systemCerts);
	}

	case LogicCommand::CREATE_SIGNATURE: {
		Password password;        // password for private_key
		RawBuffer message;

		CryptoAlgorithmSerializable cAlgorithm;
		buffer.Deserialize(name, explicitOwner, password, message, cAlgorithm);

		return m_logic->createSignature(
				   cred,
				   msgID,
				   name,
				   explicitOwner,
				   password,           // password for private_key
				   message,
				   cAlgorithm);
	}

	case LogicCommand::VERIFY_SIGNATURE: {
		Password password;           // password for public_key (optional)
		RawBuffer message;
		RawBuffer signature;
		CryptoAlgorithmSerializable cAlg;

		buffer.Deserialize(name,
						   explicitOwner,
						   password,
						   message,
						   signature,
						   cAlg);

		return m_logic->verifySignature(
				   cred,
				   msgID,
				   name,
				   explicitOwner,
				   password,           // password for public_key (optional)
				   message,
				   signature,
				   cAlg);
	}

	case LogicCommand::SET_PERMISSION: {
		PermissionMask permissionMask = 0;
		buffer.Deserialize(name, explicitOwner, accessor, permissionMask);
		return m_logic->setPermission(
				   cred,
				   command,
				   msgID,
				   name,
				   explicitOwner,
				   accessor,
				   permissionMask);
	}

	default:
		Throw(Exception::BrokenProtocol);
	}
}

void CKMService::ProcessMessage(MsgKeyRequest msg)
{
	Crypto::GObjShPtr key;
	int ret = m_logic->getKeyForService(msg.cred,
										msg.name,
										msg.explicitOwner,
										msg.password,
										key);
	MsgKeyResponse kResp(msg.id, key, ret);

	try {
		if (!m_commMgr->SendMessage(kResp))
			LogError("No listener found"); // can't do much more
	} catch (...) {
		LogError("Uncaught exception in SendMessage. Check listeners.");
	}
}

void CKMService::ProcessMessage(MsgRemoveAppData msg)
{
	LogDebug("Call removeApplicationData. pkgId: " << msg.pkgId);
	m_logic->removeApplicationData(msg.pkgId);
}

} // namespace CKM