From a82011ff964f4e27f38d0d8ebbc1e04fdf9db22e Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Mon, 25 Jun 2012 20:27:35 +0200 Subject: [PATCH] Introduce keyring unlock key concept. * Rename fKeyMessage to fUnlockKey and the KeyMessage() getter to UnlockKey(). * Keep track of whether the keyring has an unlock key set. * Store and restore that info separately. * En- and decryption will depend on unlock key presence later. * Add functions to set and remove an unlock key and query for it. --- src/servers/keystore/KeyStoreServer.cpp | 9 ++-- src/servers/keystore/Keyring.cpp | 72 +++++++++++++++++++++---- src/servers/keystore/Keyring.h | 12 +++-- 3 files changed, 78 insertions(+), 15 deletions(-) diff --git a/src/servers/keystore/KeyStoreServer.cpp b/src/servers/keystore/KeyStoreServer.cpp index c46761108a..05b367d0ce 100644 --- a/src/servers/keystore/KeyStoreServer.cpp +++ b/src/servers/keystore/KeyStoreServer.cpp @@ -350,7 +350,7 @@ KeyStoreServer::MessageReceived(BMessage* message) break; BString secondaryIdentifier = keyring->Name(); - BMessage keyMessage = keyring->KeyMessage(); + BMessage keyMessage = keyring->UnlockKey(); keyMessage.RemoveName("identifier"); keyMessage.AddString("identifier", kKeyringKeysIdentifier); keyMessage.RemoveName("secondaryIdentifier"); @@ -720,6 +720,9 @@ KeyStoreServer::_RemoveKeyring(const BString& name) status_t KeyStoreServer::_UnlockKeyring(Keyring& keyring) { + if (!keyring.HasUnlockKey()) + return keyring.Unlock(NULL); + // If we are accessing a keyring that has been added to master access we // get the key from the master keyring and unlock with that. BMessage keyMessage; @@ -727,7 +730,7 @@ KeyStoreServer::_UnlockKeyring(Keyring& keyring) if (fMasterKeyring->FindKey(kKeyringKeysIdentifier, keyring.Name(), false, &keyMessage) == B_OK) { // We found a key for this keyring, try to unlock with it. - if (keyring.Unlock(keyMessage) == B_OK) + if (keyring.Unlock(&keyMessage) == B_OK) return B_OK; } } @@ -737,7 +740,7 @@ KeyStoreServer::_UnlockKeyring(Keyring& keyring) if (result != B_OK) return result; - return keyring.Unlock(keyMessage); + return keyring.Unlock(&keyMessage); } diff --git a/src/servers/keystore/Keyring.cpp b/src/servers/keystore/Keyring.cpp index 28bcaaf1b3..5575ceabe7 100644 --- a/src/servers/keystore/Keyring.cpp +++ b/src/servers/keystore/Keyring.cpp @@ -9,6 +9,7 @@ Keyring::Keyring() : + fHasUnlockKey(false), fUnlocked(false), fModified(false) { @@ -18,6 +19,7 @@ Keyring::Keyring() Keyring::Keyring(const char* name) : fName(name), + fHasUnlockKey(false), fUnlocked(false), fModified(false) { @@ -36,6 +38,10 @@ Keyring::ReadFromMessage(const BMessage& message) if (result != B_OK) return result; + result = message.FindBool("hasUnlockKey", &fHasUnlockKey); + if (result != B_OK) + return result; + ssize_t size; const void* data; result = message.FindData("data", B_RAW_TYPE, &data, &size); @@ -68,18 +74,29 @@ Keyring::WriteToMessage(BMessage& message) if (result != B_OK) return result; + result = message.AddBool("hasUnlockKey", fHasUnlockKey); + if (result != B_OK) + return result; + return message.AddString("name", fName); } status_t -Keyring::Unlock(const BMessage& keyMessage) +Keyring::Unlock(const BMessage* keyMessage) { - fKeyMessage = keyMessage; + if (fUnlocked) + return B_OK; + + if (fHasUnlockKey == (keyMessage == NULL)) + return B_BAD_VALUE; + + if (keyMessage != NULL) + fUnlockKey = *keyMessage; status_t result = _DecryptFromFlatBuffer(); if (result != B_OK) { - fKeyMessage.MakeEmpty(); + fUnlockKey.MakeEmpty(); return result; } @@ -96,7 +113,7 @@ Keyring::Lock() _EncryptToFlatBuffer(); - fKeyMessage.MakeEmpty(); + fUnlockKey.MakeEmpty(); fData.MakeEmpty(); fApplications.MakeEmpty(); fUnlocked = false; @@ -110,10 +127,43 @@ Keyring::IsUnlocked() const } -const BMessage& -Keyring::KeyMessage() const +bool +Keyring::HasUnlockKey() const { - return fKeyMessage; + return fHasUnlockKey; +} + + +const BMessage& +Keyring::UnlockKey() const +{ + return fUnlockKey; +} + + +status_t +Keyring::SetUnlockKey(const BMessage& keyMessage) +{ + if (!fUnlocked) + return B_NOT_ALLOWED; + + fHasUnlockKey = true; + fUnlockKey = keyMessage; + fModified = true; + return B_OK; +} + + +status_t +Keyring::RemoveUnlockKey() +{ + if (!fUnlocked) + return B_NOT_ALLOWED; + + fUnlockKey.MakeEmpty(); + fHasUnlockKey = false; + fModified = true; + return B_OK; } @@ -430,7 +480,9 @@ Keyring::_EncryptToFlatBuffer() if (result != B_OK) return result; - // TODO: Actually encrypt the flat buffer... + if (fHasUnlockKey) { + // TODO: Actually encrypt the flat buffer... + } fModified = false; return B_OK; @@ -443,7 +495,9 @@ Keyring::_DecryptFromFlatBuffer() if (fFlatBuffer.BufferLength() == 0) return B_OK; - // TODO: Actually decrypt the flat buffer... + if (fHasUnlockKey) { + // TODO: Actually decrypt the flat buffer... + } BMessage container; fFlatBuffer.Seek(0, SEEK_SET); diff --git a/src/servers/keystore/Keyring.h b/src/servers/keystore/Keyring.h index d0ba76f875..de8d931ccd 100644 --- a/src/servers/keystore/Keyring.h +++ b/src/servers/keystore/Keyring.h @@ -20,10 +20,15 @@ public: status_t ReadFromMessage(const BMessage& message); status_t WriteToMessage(BMessage& message); - status_t Unlock(const BMessage& keyMessage); + status_t Unlock(const BMessage* keyMessage); void Lock(); bool IsUnlocked() const; - const BMessage& KeyMessage() const; + + bool HasUnlockKey() const; + const BMessage& UnlockKey() const; + + status_t SetUnlockKey(const BMessage& keyMessage); + status_t RemoveUnlockKey(); status_t GetNextApplication(uint32& cookie, BString& signature, BString& path); @@ -61,7 +66,8 @@ private: BMallocIO fFlatBuffer; BMessage fData; BMessage fApplications; - BMessage fKeyMessage; + BMessage fUnlockKey; + bool fHasUnlockKey; bool fUnlocked; bool fModified; };