Changing code to have better error logging
This changes the error logs to show the file and line number instead of
naming a specific a function where the error originated. In some cases
the function name is kept where it made sense for readibility of the
logs.
Test: Run and tested using `atest keystore2_test` for Rust test and CTS test with `atest CtsKeystoreTestCases`
Bug: 241924261
Change-Id: I2ea970dd83e18033506555f2726c716626697cdf
diff --git a/keystore2/src/apc.rs b/keystore2/src/apc.rs
index 1dc14ea..5d2083d 100644
--- a/keystore2/src/apc.rs
+++ b/keystore2/src/apc.rs
@@ -22,6 +22,7 @@
};
use crate::error::anyhow_error_to_cstring;
+use crate::ks_err;
use crate::utils::{compat_2_response_code, ui_opts_2_compat, watchdog as wd};
use android_security_apc::aidl::android::security::apc::{
IConfirmationCallback::IConfirmationCallback,
@@ -259,13 +260,10 @@
if let Ok(listener) = callback.into_interface::<dyn IConfirmationCallback>() {
if let Err(e) = listener.onCompleted(rc, data_confirmed) {
- log::error!(
- "In ApcManagerCallback::result: Reporting completion to client failed {:?}",
- e
- )
+ log::error!("Reporting completion to client failed {:?}", e)
}
} else {
- log::error!("In ApcManagerCallback::result: SpIBinder is not a IConfirmationCallback.");
+ log::error!("SpIBinder is not a IConfirmationCallback.");
}
}
@@ -279,8 +277,7 @@
) -> Result<()> {
let mut state = self.state.lock().unwrap();
if state.session.is_some() {
- return Err(Error::pending())
- .context("In ApcManager::present_prompt: Session pending.");
+ return Err(Error::pending()).context(ks_err!("APC Session pending."));
}
// Perform rate limiting.
@@ -289,8 +286,8 @@
None => {}
Some(rate_info) => {
if let Some(back_off) = rate_info.get_remaining_back_off() {
- return Err(Error::sys()).context(format!(
- "In ApcManager::present_prompt: Cooling down. Remaining back-off: {}s",
+ return Err(Error::sys()).context(ks_err!(
+ "APC Cooling down. Remaining back-off: {}s",
back_off.as_secs()
));
}
@@ -300,8 +297,7 @@
let hal = ApcHal::try_get_service();
let hal = match hal {
None => {
- return Err(Error::unimplemented())
- .context("In ApcManager::present_prompt: APC not supported.")
+ return Err(Error::unimplemented()).context(ks_err!("APC not supported."));
}
Some(h) => Arc::new(h),
};
@@ -319,7 +315,7 @@
},
)
.map_err(|rc| Error::Rc(compat_2_response_code(rc)))
- .context("In present_prompt: Failed to present prompt.")?;
+ .context(ks_err!("APC Failed to present prompt."))?;
state.session = Some(ApcSessionState {
hal,
cb: listener.as_binder(),
@@ -335,13 +331,12 @@
let hal = match &mut state.session {
None => {
return Err(Error::ignored())
- .context("In cancel_prompt: Attempt to cancel non existing session. Ignoring.")
+ .context(ks_err!("Attempt to cancel non existing session. Ignoring."));
}
Some(session) => {
if session.cb != listener.as_binder() {
- return Err(Error::ignored()).context(concat!(
- "In cancel_prompt: Attempt to cancel session not belonging to caller. ",
- "Ignoring."
+ return Err(Error::ignored()).context(ks_err!(
+ "Attempt to cancel session not belonging to caller. Ignoring."
));
}
session.client_aborted = true;
diff --git a/keystore2/src/attestation_key_utils.rs b/keystore2/src/attestation_key_utils.rs
index 3408942..f53a88c 100644
--- a/keystore2/src/attestation_key_utils.rs
+++ b/keystore2/src/attestation_key_utils.rs
@@ -18,6 +18,7 @@
use crate::database::{BlobMetaData, KeyEntryLoadBits, KeyType};
use crate::database::{KeyIdGuard, KeystoreDB};
use crate::error::{Error, ErrorCode};
+use crate::ks_err;
use crate::permission::KeyPerm;
use crate::remote_provisioning::RemProvState;
use crate::utils::check_key_permission;
@@ -65,10 +66,7 @@
// Do not select an RKP key if DEVICE_UNIQUE_ATTESTATION is present.
None if challenge_present && !is_device_unique_attestation => rem_prov_state
.get_remotely_provisioned_attestation_key_and_certs(key, caller_uid, params, db)
- .context(concat!(
- "In get_attest_key_and_cert_chain: ",
- "Trying to get remotely provisioned attestation key."
- ))
+ .context(ks_err!("Trying to get remotely provisioned attestation key."))
.map(|result| {
result.map(|(key_id_guard, attestation_key, attestation_certs)| {
AttestationKeyInfo::RemoteProvisioned {
@@ -80,7 +78,7 @@
}),
None => Ok(None),
Some(attest_key) => get_user_generated_attestation_key(attest_key, caller_uid, db)
- .context("In get_attest_key_and_cert_chain: Trying to load attest key")
+ .context(ks_err!("Trying to load attest key"))
.map(Some),
}
}
@@ -92,11 +90,10 @@
) -> Result<AttestationKeyInfo> {
let (key_id_guard, blob, cert, blob_metadata) =
load_attest_key_blob_and_cert(key, caller_uid, db)
- .context("In get_user_generated_attestation_key: Failed to load blob and cert")?;
+ .context(ks_err!("Failed to load blob and cert"))?;
- let issuer_subject: Vec<u8> = parse_subject_from_certificate(&cert).context(
- "In get_user_generated_attestation_key: Failed to parse subject from certificate.",
- )?;
+ let issuer_subject: Vec<u8> = parse_subject_from_certificate(&cert)
+ .context(ks_err!("Failed to parse subject from certificate"))?;
Ok(AttestationKeyInfo::UserGenerated { key_id_guard, blob, issuer_subject, blob_metadata })
}
@@ -107,9 +104,8 @@
db: &mut KeystoreDB,
) -> Result<(KeyIdGuard, Vec<u8>, Vec<u8>, BlobMetaData)> {
match key.domain {
- Domain::BLOB => Err(Error::Km(ErrorCode::INVALID_ARGUMENT)).context(
- "In load_attest_key_blob_and_cert: Domain::BLOB attestation keys not supported",
- ),
+ Domain::BLOB => Err(Error::Km(ErrorCode::INVALID_ARGUMENT))
+ .context(ks_err!("Domain::BLOB attestation keys not supported")),
_ => {
let (key_id_guard, mut key_entry) = db
.load_key_entry(
@@ -119,17 +115,16 @@
caller_uid,
|k, av| check_key_permission(KeyPerm::Use, k, &av),
)
- .context("In load_attest_key_blob_and_cert: Failed to load key.")?;
+ .context(ks_err!("Failed to load key."))?;
- let (blob, blob_metadata) =
- key_entry.take_key_blob_info().ok_or_else(Error::sys).context(concat!(
- "In load_attest_key_blob_and_cert: Successfully loaded key entry,",
- " but KM blob was missing."
- ))?;
- let cert = key_entry.take_cert().ok_or_else(Error::sys).context(concat!(
- "In load_attest_key_blob_and_cert: Successfully loaded key entry,",
- " but cert was missing."
- ))?;
+ let (blob, blob_metadata) = key_entry
+ .take_key_blob_info()
+ .ok_or_else(Error::sys)
+ .context(ks_err!("Successfully loaded key entry, but KM blob was missing"))?;
+ let cert = key_entry
+ .take_cert()
+ .ok_or_else(Error::sys)
+ .context(ks_err!("Successfully loaded key entry, but cert was missing"))?;
Ok((key_id_guard, blob, cert, blob_metadata))
}
}
diff --git a/keystore2/src/authorization.rs b/keystore2/src/authorization.rs
index 666daeb..1953920 100644
--- a/keystore2/src/authorization.rs
+++ b/keystore2/src/authorization.rs
@@ -14,6 +14,7 @@
//! This module implements IKeystoreAuthorization AIDL interface.
+use crate::ks_err;
use crate::error::Error as KeystoreError;
use crate::error::anyhow_error_to_cstring;
use crate::globals::{ENFORCEMENTS, SUPER_KEY, DB, LEGACY_IMPORTER};
@@ -23,15 +24,15 @@
use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
HardwareAuthToken::HardwareAuthToken,
};
-use android_security_authorization::binder::{BinderFeatures,ExceptionCode, Interface, Result as BinderResult,
- Strong, Status as BinderStatus};
+use android_security_authorization::binder::{BinderFeatures, ExceptionCode, Interface, Result as BinderResult,
+ Strong, Status as BinderStatus};
use android_security_authorization::aidl::android::security::authorization::{
IKeystoreAuthorization::BnKeystoreAuthorization, IKeystoreAuthorization::IKeystoreAuthorization,
LockScreenEvent::LockScreenEvent, AuthorizationTokens::AuthorizationTokens,
ResponseCode::ResponseCode,
};
use android_system_keystore2::aidl::android::system::keystore2::{
- ResponseCode::ResponseCode as KsResponseCode };
+ ResponseCode::ResponseCode as KsResponseCode};
use anyhow::{Context, Result};
use keystore2_crypto::Password;
use keystore2_selinux as selinux;
@@ -126,7 +127,7 @@
fn add_auth_token(&self, auth_token: &HardwareAuthToken) -> Result<()> {
// Check keystore permission.
- check_keystore_permission(KeystorePerm::AddAuth).context("In add_auth_token.")?;
+ check_keystore_permission(KeystorePerm::AddAuth).context(ks_err!())?;
ENFORCEMENTS.add_auth_token(auth_token.clone());
Ok(())
@@ -151,7 +152,7 @@
// This corresponds to the unlock() method in legacy keystore API.
// check permission
check_keystore_permission(KeystorePerm::Unlock)
- .context("In on_lock_screen_event: Unlock with password.")?;
+ .context(ks_err!("Unlock with password."))?;
ENFORCEMENTS.set_device_locked(user_id, false);
let mut skm = SUPER_KEY.write().unwrap();
@@ -163,7 +164,7 @@
&password,
)
})
- .context("In on_lock_screen_event: unlock_screen_lock_bound_key failed")?;
+ .context(ks_err!("unlock_screen_lock_bound_key failed"))?;
// Unlock super key.
if let UserState::Uninitialized = DB
@@ -175,7 +176,7 @@
&password,
)
})
- .context("In on_lock_screen_event: Unlock with password.")?
+ .context(ks_err!("Unlock with password."))?
{
log::info!(
"In on_lock_screen_event. Trying to unlock when LSKF is uninitialized."
@@ -185,19 +186,17 @@
Ok(())
}
(LockScreenEvent::UNLOCK, None) => {
- check_keystore_permission(KeystorePerm::Unlock)
- .context("In on_lock_screen_event: Unlock.")?;
+ check_keystore_permission(KeystorePerm::Unlock).context(ks_err!("Unlock."))?;
ENFORCEMENTS.set_device_locked(user_id, false);
let mut skm = SUPER_KEY.write().unwrap();
DB.with(|db| {
skm.try_unlock_user_with_biometric(&mut db.borrow_mut(), user_id as u32)
})
- .context("In on_lock_screen_event: try_unlock_user_with_biometric failed")?;
+ .context(ks_err!("try_unlock_user_with_biometric failed"))?;
Ok(())
}
(LockScreenEvent::LOCK, None) => {
- check_keystore_permission(KeystorePerm::Lock)
- .context("In on_lock_screen_event: Lock")?;
+ check_keystore_permission(KeystorePerm::Lock).context(ks_err!("Lock"))?;
ENFORCEMENTS.set_device_locked(user_id, true);
let mut skm = SUPER_KEY.write().unwrap();
DB.with(|db| {
@@ -211,8 +210,7 @@
}
_ => {
// Any other combination is not supported.
- Err(Error::Rc(ResponseCode::INVALID_ARGUMENT))
- .context("In on_lock_screen_event: Unknown event.")
+ Err(Error::Rc(ResponseCode::INVALID_ARGUMENT)).context(ks_err!("Unknown event."))
}
}
}
@@ -225,13 +223,12 @@
) -> Result<AuthorizationTokens> {
// Check permission. Function should return if this failed. Therefore having '?' at the end
// is very important.
- check_keystore_permission(KeystorePerm::GetAuthToken)
- .context("In get_auth_tokens_for_credstore.")?;
+ check_keystore_permission(KeystorePerm::GetAuthToken).context(ks_err!("GetAuthToken"))?;
// If the challenge is zero, return error
if challenge == 0 {
return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT))
- .context("In get_auth_tokens_for_credstore. Challenge can not be zero.");
+ .context(ks_err!("Challenge can not be zero."));
}
// Obtain the auth token and the timestamp token from the enforcement module.
let (auth_token, ts_token) =
diff --git a/keystore2/src/boot_level_keys.rs b/keystore2/src/boot_level_keys.rs
index 237d7d2..e2e67ff 100644
--- a/keystore2/src/boot_level_keys.rs
+++ b/keystore2/src/boot_level_keys.rs
@@ -14,6 +14,7 @@
//! Offer keys based on the "boot level" for superencryption.
+use crate::ks_err;
use crate::{
database::{KeyType, KeystoreDB},
key_parameter::KeyParameterValue,
@@ -47,9 +48,8 @@
const PROPERTY_NAME: &str = "ro.keystore.boot_level_key.strategy";
fn lookup_level_zero_km_and_strategy() -> Result<Option<(SecurityLevel, DenyLaterStrategy)>> {
- let property_val = rustutils::system_properties::read(PROPERTY_NAME).with_context(|| {
- format!("In lookup_level_zero_km_and_strategy: property read failed: {}", PROPERTY_NAME)
- })?;
+ let property_val = rustutils::system_properties::read(PROPERTY_NAME)
+ .with_context(|| ks_err!("property read failed: {}", PROPERTY_NAME))?;
// TODO: use feature(let_else) when that's stabilized.
let property_val = if let Some(p) = property_val {
p
@@ -86,18 +86,17 @@
fn get_level_zero_key_km_and_strategy() -> Result<(KeyMintDevice, DenyLaterStrategy)> {
if let Some((level, strategy)) = lookup_level_zero_km_and_strategy()? {
return Ok((
- KeyMintDevice::get(level)
- .context("In get_level_zero_key_km_and_strategy: Get KM instance failed.")?,
+ KeyMintDevice::get(level).context(ks_err!("Get KM instance failed."))?,
strategy,
));
}
let tee = KeyMintDevice::get(SecurityLevel::TRUSTED_ENVIRONMENT)
- .context("In get_level_zero_key_km_and_strategy: Get TEE instance failed.")?;
+ .context(ks_err!("Get TEE instance failed."))?;
if tee.version() >= KeyMintDevice::KEY_MASTER_V4_1 {
Ok((tee, DenyLaterStrategy::EarlyBootOnly))
} else {
match KeyMintDevice::get_or_none(SecurityLevel::STRONGBOX)
- .context("In get_level_zero_key_km_and_strategy: Get Strongbox instance failed.")?
+ .context(ks_err!("Get Strongbox instance failed."))?
{
Some(strongbox) if strongbox.version() >= KeyMintDevice::KEY_MASTER_V4_1 => {
Ok((strongbox, DenyLaterStrategy::EarlyBootOnly))
@@ -112,7 +111,7 @@
/// Mutex on its internal state.
pub fn get_level_zero_key(db: &mut KeystoreDB) -> Result<ZVec> {
let (km_dev, deny_later_strategy) = get_level_zero_key_km_and_strategy()
- .context("In get_level_zero_key: get preferred KM instance failed")?;
+ .context(ks_err!("get preferred KM instance failed"))?;
log::info!(
"In get_level_zero_key: security_level={:?}, deny_later_strategy={:?}",
km_dev.security_level(),
@@ -156,7 +155,7 @@
true
})
})
- .context("In get_level_zero_key: lookup_or_generate_key failed")?;
+ .context(ks_err!("lookup_or_generate_key failed"))?;
let params = [
KeyParameterValue::MacLength(256).into(),
@@ -172,11 +171,11 @@
None,
b"Create boot level key",
)
- .context("In get_level_zero_key: use_key_in_one_step failed")?;
+ .context(ks_err!("use_key_in_one_step failed"))?;
// TODO: this is rather unsatisfactory, we need a better way to handle
// sensitive binder returns.
- let level_zero_key = ZVec::try_from(level_zero_key)
- .context("In get_level_zero_key: conversion to ZVec failed")?;
+ let level_zero_key =
+ ZVec::try_from(level_zero_key).context(ks_err!("conversion to ZVec failed"))?;
Ok(level_zero_key)
}
@@ -228,7 +227,7 @@
// so this must unwrap.
let highest_key = self.cache.back().unwrap();
let next_key = hkdf_expand(Self::HKDF_KEY_SIZE, highest_key, Self::HKDF_ADVANCE)
- .context("In BootLevelKeyCache::get_hkdf_key: Advancing key one step")?;
+ .context(ks_err!("Advancing key one step"))?;
self.cache.push_back(next_key);
}
@@ -241,10 +240,7 @@
pub fn advance_boot_level(&mut self, new_boot_level: usize) -> Result<()> {
if !self.level_accessible(new_boot_level) {
log::error!(
- concat!(
- "In BootLevelKeyCache::advance_boot_level: ",
- "Failed to advance boot level to {}, current is {}, cache size {}"
- ),
+ "Failed to advance boot level to {}, current is {}, cache size {}",
new_boot_level,
self.current,
self.cache.len()
@@ -254,8 +250,7 @@
// We `get` the new boot level for the side effect of advancing the cache to a point
// where the new boot level is present.
- self.get_hkdf_key(new_boot_level)
- .context("In BootLevelKeyCache::advance_boot_level: Advancing cache")?;
+ self.get_hkdf_key(new_boot_level).context(ks_err!("Advancing cache"))?;
// Then we split the queue at the index of the new boot level and discard the front,
// keeping only the keys with the current boot level or higher.
@@ -281,16 +276,16 @@
info: &[u8],
) -> Result<Option<ZVec>> {
self.get_hkdf_key(boot_level)
- .context("In BootLevelKeyCache::expand_key: Looking up HKDF key")?
+ .context(ks_err!("Looking up HKDF key"))?
.map(|k| hkdf_expand(out_len, k, info))
.transpose()
- .context("In BootLevelKeyCache::expand_key: Calling hkdf_expand")
+ .context(ks_err!("Calling hkdf_expand"))
}
/// Return the AES-256-GCM key for the current boot level.
pub fn aes_key(&mut self, boot_level: usize) -> Result<Option<ZVec>> {
self.expand_key(boot_level, AES_256_KEY_LENGTH, BootLevelKeyCache::HKDF_AES)
- .context("In BootLevelKeyCache::aes_key: expand_key failed")
+ .context(ks_err!("expand_key failed"))
}
}
diff --git a/keystore2/src/database.rs b/keystore2/src/database.rs
index 0f96d5c..e5a8e4a 100644
--- a/keystore2/src/database.rs
+++ b/keystore2/src/database.rs
@@ -49,6 +49,7 @@
use crate::globals::get_keymint_dev_by_uuid;
use crate::impl_metadata; // This is in db_utils.rs
use crate::key_parameter::{KeyParameter, Tag};
+use crate::ks_err;
use crate::metrics_store::log_rkp_error_stats;
use crate::permission::KeyPermSet;
use crate::utils::{get_current_time_in_milliseconds, watchdog as wd, AID_USER_OFFSET};
@@ -133,12 +134,13 @@
"SELECT tag, data from persistent.keymetadata
WHERE keyentryid = ?;",
)
- .context("In KeyMetaData::load_from_db: prepare statement failed.")?;
+ .context(ks_err!("KeyMetaData::load_from_db: prepare statement failed."))?;
let mut metadata: HashMap<i64, KeyMetaEntry> = Default::default();
- let mut rows =
- stmt.query(params![key_id]).context("In KeyMetaData::load_from_db: query failed.")?;
+ let mut rows = stmt
+ .query(params![key_id])
+ .context(ks_err!("KeyMetaData::load_from_db: query failed."))?;
db_utils::with_rows_extract_all(&mut rows, |row| {
let db_tag: i64 = row.get(0).context("Failed to read tag.")?;
metadata.insert(
@@ -148,7 +150,7 @@
);
Ok(())
})
- .context("In KeyMetaData::load_from_db.")?;
+ .context(ks_err!("KeyMetaData::load_from_db."))?;
Ok(Self { data: metadata })
}
@@ -159,12 +161,12 @@
"INSERT or REPLACE INTO persistent.keymetadata (keyentryid, tag, data)
VALUES (?, ?, ?);",
)
- .context("In KeyMetaData::store_in_db: Failed to prepare statement.")?;
+ .context(ks_err!("KeyMetaData::store_in_db: Failed to prepare statement."))?;
let iter = self.data.iter();
for (tag, entry) in iter {
stmt.insert(params![key_id, tag, entry,]).with_context(|| {
- format!("In KeyMetaData::store_in_db: Failed to insert {:?}", entry)
+ ks_err!("KeyMetaData::store_in_db: Failed to insert {:?}", entry)
})?;
}
Ok(())
@@ -208,12 +210,11 @@
"SELECT tag, data from persistent.blobmetadata
WHERE blobentryid = ?;",
)
- .context("In BlobMetaData::load_from_db: prepare statement failed.")?;
+ .context(ks_err!("BlobMetaData::load_from_db: prepare statement failed."))?;
let mut metadata: HashMap<i64, BlobMetaEntry> = Default::default();
- let mut rows =
- stmt.query(params![blob_id]).context("In BlobMetaData::load_from_db: query failed.")?;
+ let mut rows = stmt.query(params![blob_id]).context(ks_err!("query failed."))?;
db_utils::with_rows_extract_all(&mut rows, |row| {
let db_tag: i64 = row.get(0).context("Failed to read tag.")?;
metadata.insert(
@@ -223,7 +224,7 @@
);
Ok(())
})
- .context("In BlobMetaData::load_from_db.")?;
+ .context(ks_err!("BlobMetaData::load_from_db"))?;
Ok(Self { data: metadata })
}
@@ -234,12 +235,12 @@
"INSERT or REPLACE INTO persistent.blobmetadata (blobentryid, tag, data)
VALUES (?, ?, ?);",
)
- .context("In BlobMetaData::store_in_db: Failed to prepare statement.")?;
+ .context(ks_err!("BlobMetaData::store_in_db: Failed to prepare statement.",))?;
let iter = self.data.iter();
for (tag, entry) in iter {
stmt.insert(params![blob_id, tag, entry,]).with_context(|| {
- format!("In BlobMetaData::store_in_db: Failed to insert {:?}", entry)
+ ks_err!("BlobMetaData::store_in_db: Failed to insert {:?}", entry)
})?;
}
Ok(())
@@ -881,7 +882,7 @@
let mut db = Self { conn, gc, perboot: perboot::PERBOOT_DB.clone() };
db.with_transaction(TransactionBehavior::Immediate, |tx| {
versioning::upgrade_database(tx, Self::CURRENT_DB_VERSION, Self::UPGRADERS)
- .context("In KeystoreDB::new: trying to upgrade database.")?;
+ .context(ks_err!("KeystoreDB::new: trying to upgrade database."))?;
Self::init_tables(tx).context("Trying to initialize tables.").no_gc()
})?;
Ok(db)
@@ -903,7 +904,7 @@
);",
params![KeyLifeCycle::Unreferenced, Tag::MAX_BOOT_LEVEL.0, BlobMetaData::MaxBootLevel],
)
- .context("In from_0_to_1: Failed to delete logical boot level keys.")?;
+ .context(ks_err!("Failed to delete logical boot level keys."))?;
Ok(1)
}
@@ -1064,7 +1065,7 @@
let (total, unused) = self.with_transaction(TransactionBehavior::Deferred, |tx| {
tx.query_row(query, params_from_iter(params), |row| Ok((row.get(0)?, row.get(1)?)))
.with_context(|| {
- format!("get_storage_stat: Error size of storage type {}", storage_type.0)
+ ks_err!("get_storage_stat: Error size of storage type {}", storage_type.0)
})
.no_gc()
})?;
@@ -1239,7 +1240,7 @@
Ok(vec![]).no_gc()
})
- .context("In handle_next_superseded_blobs.")
+ .context(ks_err!())
}
/// This maintenance function should be called only once before the database is used for the
@@ -1261,7 +1262,7 @@
.context("Failed to execute query.")
.need_gc()
})
- .context("In cleanup_leftovers.")
+ .context(ks_err!())
}
/// Checks if a key exists with given key type and key descriptor properties.
@@ -1282,12 +1283,12 @@
Ok(_) => Ok(true),
Err(error) => match error.root_cause().downcast_ref::<KsError>() {
Some(KsError::Rc(ResponseCode::KEY_NOT_FOUND)) => Ok(false),
- _ => Err(error).context("In key_exists: Failed to find if the key exists."),
+ _ => Err(error).context(ks_err!("Failed to find if the key exists.")),
},
}
.no_gc()
})
- .context("In key_exists.")
+ .context(ks_err!())
}
/// Stores a super key in the database.
@@ -1335,7 +1336,7 @@
.context("Trying to load key components.")
.no_gc()
})
- .context("In store_super_key.")
+ .context(ks_err!())
}
/// Loads super key of a given user, if exists
@@ -1357,17 +1358,17 @@
match id {
Ok(id) => {
let key_entry = Self::load_key_components(tx, KeyEntryLoadBits::KM, id)
- .context("In load_super_key. Failed to load key entry.")?;
+ .context(ks_err!("Failed to load key entry."))?;
Ok(Some((KEY_ID_LOCK.get(id), key_entry)))
}
Err(error) => match error.root_cause().downcast_ref::<KsError>() {
Some(KsError::Rc(ResponseCode::KEY_NOT_FOUND)) => Ok(None),
- _ => Err(error).context("In load_super_key."),
+ _ => Err(error).context(ks_err!()),
},
}
.no_gc()
})
- .context("In load_super_key.")
+ .context(ks_err!())
}
/// Atomically loads a key entry and associated metadata or creates it using the
@@ -1399,10 +1400,10 @@
AND alias = ?
AND state = ?;",
)
- .context("In get_or_create_key_with: Failed to select from keyentry table.")?;
+ .context(ks_err!("Failed to select from keyentry table."))?;
let mut rows = stmt
.query(params![KeyType::Super, domain.0, namespace, alias, KeyLifeCycle::Live])
- .context("In get_or_create_key_with: Failed to query from keyentry table.")?;
+ .context(ks_err!("Failed to query from keyentry table."))?;
db_utils::with_rows_extract_one(&mut rows, |row| {
Ok(match row {
@@ -1410,14 +1411,13 @@
None => None,
})
})
- .context("In get_or_create_key_with.")?
+ .context(ks_err!())?
};
let (id, entry) = match id {
Some(id) => (
id,
- Self::load_key_components(tx, KeyEntryLoadBits::KM, id)
- .context("In get_or_create_key_with.")?,
+ Self::load_key_components(tx, KeyEntryLoadBits::KM, id).context(ks_err!())?,
),
None => {
@@ -1437,10 +1437,9 @@
],
)
})
- .context("In get_or_create_key_with.")?;
+ .context(ks_err!())?;
- let (blob, metadata) =
- create_new_key().context("In get_or_create_key_with.")?;
+ let (blob, metadata) = create_new_key().context(ks_err!())?;
Self::set_blob_internal(
tx,
id,
@@ -1448,7 +1447,7 @@
Some(&blob),
Some(&metadata),
)
- .context("In get_or_create_key_with.")?;
+ .context(ks_err!())?;
(
id,
KeyEntry {
@@ -1462,7 +1461,7 @@
};
Ok((KEY_ID_LOCK.get(id), entry)).no_gc()
})
- .context("In get_or_create_key_with.")
+ .context(ks_err!())
}
/// Creates a transaction with the given behavior and executes f with the new transaction.
@@ -1476,10 +1475,10 @@
match self
.conn
.transaction_with_behavior(behavior)
- .context("In with_transaction.")
+ .context(ks_err!())
.and_then(|tx| f(&tx).map(|result| (result, tx)))
.and_then(|(result, tx)| {
- tx.commit().context("In with_transaction: Failed to commit transaction.")?;
+ tx.commit().context(ks_err!("Failed to commit transaction."))?;
Ok(result)
}) {
Ok(result) => break Ok(result),
@@ -1488,7 +1487,7 @@
std::thread::sleep(std::time::Duration::from_micros(500));
continue;
} else {
- return Err(e).context("In with_transaction.");
+ return Err(e).context(ks_err!());
}
}
}
@@ -1529,7 +1528,7 @@
self.with_transaction(TransactionBehavior::Immediate, |tx| {
Self::create_key_entry_internal(tx, domain, namespace, key_type, km_uuid).no_gc()
})
- .context("In create_key_entry.")
+ .context(ks_err!())
}
fn create_key_entry_internal(
@@ -1543,7 +1542,7 @@
Domain::APP | Domain::SELINUX => {}
_ => {
return Err(KsError::sys())
- .context(format!("Domain {:?} must be either App or SELinux.", domain));
+ .context(ks_err!("Domain {:?} must be either App or SELinux.", domain));
}
}
Ok(KEY_ID_LOCK.get(
@@ -1562,7 +1561,7 @@
],
)
})
- .context("In create_key_entry_internal")?,
+ .context(ks_err!())?,
))
}
@@ -1590,7 +1589,7 @@
params![id, KeyType::Attestation, KeyLifeCycle::Live, km_uuid],
)
})
- .context("In create_key_entry")?,
+ .context(ks_err!())?,
);
Self::set_blob_internal(
tx,
@@ -1605,7 +1604,7 @@
metadata.store_in_db(key_id.0, tx)?;
Ok(()).no_gc()
})
- .context("In create_attestation_key_entry")
+ .context(ks_err!())
}
/// Set a new blob and associates it with the given key id. Each blob
@@ -1627,7 +1626,7 @@
self.with_transaction(TransactionBehavior::Immediate, |tx| {
Self::set_blob_internal(tx, key_id.0, sc_type, blob, blob_metadata).need_gc()
})
- .context("In set_blob.")
+ .context(ks_err!())
}
/// Why would we insert a deleted blob? This weird function is for the purpose of legacy
@@ -1647,7 +1646,7 @@
)
.need_gc()
})
- .context("In set_deleted_blob.")
+ .context(ks_err!())
}
fn set_blob_internal(
@@ -1664,16 +1663,16 @@
(subcomponent_type, keyentryid, blob) VALUES (?, ?, ?);",
params![sc_type, key_id, blob],
)
- .context("In set_blob_internal: Failed to insert blob.")?;
+ .context(ks_err!("Failed to insert blob."))?;
if let Some(blob_metadata) = blob_metadata {
let blob_id = tx
.query_row("SELECT MAX(id) FROM persistent.blobentry;", NO_PARAMS, |row| {
row.get(0)
})
- .context("In set_blob_internal: Failed to get new blob id.")?;
+ .context(ks_err!("Failed to get new blob id."))?;
blob_metadata
.store_in_db(blob_id, tx)
- .context("In set_blob_internal: Trying to store blob metadata.")?;
+ .context(ks_err!("Trying to store blob metadata."))?;
}
}
(None, SubComponentType::CERT) | (None, SubComponentType::CERT_CHAIN) => {
@@ -1682,11 +1681,11 @@
WHERE subcomponent_type = ? AND keyentryid = ?;",
params![sc_type, key_id],
)
- .context("In set_blob_internal: Failed to delete blob.")?;
+ .context(ks_err!("Failed to delete blob."))?;
}
(None, _) => {
return Err(KsError::sys())
- .context("In set_blob_internal: Other blobs cannot be deleted in this way.");
+ .context(ks_err!("Other blobs cannot be deleted in this way."));
}
}
Ok(())
@@ -1699,7 +1698,7 @@
self.with_transaction(TransactionBehavior::Immediate, |tx| {
Self::insert_keyparameter_internal(tx, key_id, params).no_gc()
})
- .context("In insert_keyparameter.")
+ .context(ks_err!())
}
fn insert_keyparameter_internal(
@@ -1712,7 +1711,7 @@
"INSERT into persistent.keyparameter (keyentryid, tag, data, security_level)
VALUES (?, ?, ?, ?);",
)
- .context("In insert_keyparameter_internal: Failed to prepare statement.")?;
+ .context(ks_err!("Failed to prepare statement."))?;
for p in params.iter() {
stmt.insert(params![
@@ -1721,9 +1720,7 @@
p.key_parameter_value(),
p.security_level().0
])
- .with_context(|| {
- format!("In insert_keyparameter_internal: Failed to insert {:?}", p)
- })?;
+ .with_context(|| ks_err!("Failed to insert {:?}", p))?;
}
Ok(())
}
@@ -1734,7 +1731,7 @@
self.with_transaction(TransactionBehavior::Immediate, |tx| {
metadata.store_in_db(key_id.0, tx).no_gc()
})
- .context("In insert_key_metadata.")
+ .context(ks_err!())
}
/// Stores a signed certificate chain signed by a remote provisioning server, keyed
@@ -1807,7 +1804,7 @@
.context("Failed to insert cert")?;
Ok(()).no_gc()
})
- .context("In store_signed_attestation_certificate_chain: ")
+ .context(ks_err!())
}
/// Assigns the next unassigned attestation key to a domain/namespace combo that does not
@@ -1823,13 +1820,8 @@
match domain {
Domain::APP | Domain::SELINUX => {}
_ => {
- return Err(KsError::sys()).context(format!(
- concat!(
- "In assign_attestation_key: Domain {:?} ",
- "must be either App or SELinux.",
- ),
- domain
- ));
+ return Err(KsError::sys())
+ .context(ks_err!("Domain {:?} must be either App or SELinux.", domain));
}
}
self.with_transaction(TransactionBehavior::Immediate, |tx| {
@@ -1874,7 +1866,7 @@
}
Ok(()).no_gc()
})
- .context("In assign_attestation_key: ")
+ .context(ks_err!())
}
/// Retrieves num_keys number of attestation keys that have not yet been signed by a remote
@@ -1918,7 +1910,7 @@
.context("Failed to execute statement")?;
Ok(rows).no_gc()
})
- .context("In fetch_unsigned_attestation_keys")
+ .context(ks_err!())
}
/// Removes any keys that have expired as of the current time. Returns the number of keys
@@ -1958,7 +1950,7 @@
}
Ok(num_deleted).do_gc(num_deleted != 0)
})
- .context("In delete_expired_attestation_keys: ")
+ .context(ks_err!())
}
/// Deletes all remotely provisioned attestation keys in the system, regardless of the state
@@ -1987,7 +1979,7 @@
.count() as i64;
Ok(num_deleted).do_gc(num_deleted != 0)
})
- .context("In delete_all_attestation_keys: ")
+ .context(ks_err!())
}
/// Counts the number of keys that will expire by the provided epoch date and the number of
@@ -2054,7 +2046,7 @@
}
Ok(AttestationPoolStatus { expiring, unassigned, attested, total }).no_gc()
})
- .context("In get_attestation_pool_status: ")
+ .context(ks_err!())
}
fn query_kid_for_attestation_key_and_cert_chain(
@@ -2111,24 +2103,24 @@
}
}
- self.delete_expired_attestation_keys().context(
- "In retrieve_attestation_key_and_cert_chain: failed to prune expired attestation keys",
- )?;
- let tx = self.conn.unchecked_transaction().context(
- "In retrieve_attestation_key_and_cert_chain: Failed to initialize transaction.",
- )?;
+ self.delete_expired_attestation_keys()
+ .context(ks_err!("Failed to prune expired attestation keys",))?;
+ let tx = self
+ .conn
+ .unchecked_transaction()
+ .context(ks_err!("Failed to initialize transaction."))?;
let key_id: i64 = match self
.query_kid_for_attestation_key_and_cert_chain(&tx, domain, namespace, km_uuid)?
{
None => return Ok(None),
Some(kid) => kid,
};
- tx.commit()
- .context("In retrieve_attestation_key_and_cert_chain: Failed to commit keyid query")?;
+ tx.commit().context(ks_err!("Failed to commit keyid query"))?;
let key_id_guard = KEY_ID_LOCK.get(key_id);
- let tx = self.conn.unchecked_transaction().context(
- "In retrieve_attestation_key_and_cert_chain: Failed to initialize transaction.",
- )?;
+ let tx = self
+ .conn
+ .unchecked_transaction()
+ .context(ks_err!("Failed to initialize transaction."))?;
let mut stmt = tx.prepare(
"SELECT subcomponent_type, blob
FROM persistent.blobentry
@@ -2193,10 +2185,8 @@
match *domain {
Domain::APP | Domain::SELINUX => {}
_ => {
- return Err(KsError::sys()).context(format!(
- "In rebind_alias: Domain {:?} must be either App or SELinux.",
- domain
- ));
+ return Err(KsError::sys())
+ .context(ks_err!("Domain {:?} must be either App or SELinux.", domain));
}
}
let updated = tx
@@ -2206,7 +2196,7 @@
WHERE alias = ? AND domain = ? AND namespace = ? AND key_type = ?;",
params![KeyLifeCycle::Unreferenced, alias, domain.0 as u32, namespace, key_type],
)
- .context("In rebind_alias: Failed to rebind existing entry.")?;
+ .context(ks_err!("Failed to rebind existing entry."))?;
let result = tx
.execute(
"UPDATE persistent.keyentry
@@ -2222,10 +2212,10 @@
key_type,
],
)
- .context("In rebind_alias: Failed to set alias.")?;
+ .context(ks_err!("Failed to set alias."))?;
if result != 1 {
- return Err(KsError::sys()).context(format!(
- "In rebind_alias: Expected to update a single entry but instead updated {}.",
+ return Err(KsError::sys()).context(ks_err!(
+ "Expected to update a single entry but instead updated {}.",
result
));
}
@@ -2253,14 +2243,13 @@
};
// Security critical: Must return immediately on failure. Do not remove the '?';
- check_permission(&destination)
- .context("In migrate_key_namespace: Trying to check permission.")?;
+ check_permission(&destination).context(ks_err!("Trying to check permission."))?;
let alias = destination
.alias
.as_ref()
.ok_or(KsError::Rc(ResponseCode::INVALID_ARGUMENT))
- .context("In migrate_key_namespace: Alias must be specified.")?;
+ .context(ks_err!("Alias must be specified."))?;
self.with_transaction(TransactionBehavior::Immediate, |tx| {
// Query the destination location. If there is a key, the migration request fails.
@@ -2294,7 +2283,7 @@
}
Ok(()).no_gc()
})
- .context("In migrate_key_namespace:")
+ .context(ks_err!())
}
/// Store a new key in a single transaction.
@@ -2322,7 +2311,7 @@
}
_ => {
return Err(KsError::Rc(ResponseCode::INVALID_ARGUMENT))
- .context("In store_new_key: Need alias and domain must be APP or SELINUX.")
+ .context(ks_err!("Need alias and domain must be APP or SELINUX."));
}
};
self.with_transaction(TransactionBehavior::Immediate, |tx| {
@@ -2379,7 +2368,7 @@
|| need_gc;
Ok(key_id).do_gc(need_gc)
})
- .context("In store_new_key.")
+ .context(ks_err!())
}
/// Store a new certificate
@@ -2400,9 +2389,8 @@
(alias, key.domain, nspace)
}
_ => {
- return Err(KsError::Rc(ResponseCode::INVALID_ARGUMENT)).context(
- "In store_new_certificate: Need alias and domain must be APP or SELINUX.",
- )
+ return Err(KsError::Rc(ResponseCode::INVALID_ARGUMENT))
+ .context(ks_err!("Need alias and domain must be APP or SELINUX."));
}
};
self.with_transaction(TransactionBehavior::Immediate, |tx| {
@@ -2429,7 +2417,7 @@
.context("Trying to rebind alias.")?;
Ok(key_id).do_gc(need_gc)
})
- .context("In store_new_certificate.")
+ .context(ks_err!())
}
// Helper function loading the key_id given the key descriptor
@@ -2460,7 +2448,7 @@
.get(0)
.context("Failed to unpack id.")
})
- .context("In load_key_entry_id.")
+ .context(ks_err!())
}
/// This helper function completes the access tuple of a key, which is required
@@ -2595,10 +2583,9 @@
"SELECT MAX(id), subcomponent_type, blob FROM persistent.blobentry
WHERE keyentryid = ? GROUP BY subcomponent_type;",
)
- .context("In load_blob_components: prepare statement failed.")?;
+ .context(ks_err!("prepare statement failed."))?;
- let mut rows =
- stmt.query(params![key_id]).context("In load_blob_components: query failed.")?;
+ let mut rows = stmt.query(params![key_id]).context(ks_err!("query failed."))?;
let mut key_blob: Option<(i64, Vec<u8>)> = None;
let mut cert_blob: Option<Vec<u8>> = None;
@@ -2630,13 +2617,13 @@
}
Ok(())
})
- .context("In load_blob_components.")?;
+ .context(ks_err!())?;
let blob_info = key_blob.map_or::<Result<_>, _>(Ok(None), |(blob_id, blob)| {
Ok(Some((
blob,
BlobMetaData::load_from_db(blob_id, tx)
- .context("In load_blob_components: Trying to load blob_metadata.")?,
+ .context(ks_err!("Trying to load blob_metadata."))?,
)))
})?;
@@ -2664,7 +2651,7 @@
);
Ok(())
})
- .context("In load_key_parameters.")?;
+ .context(ks_err!())?;
Ok(parameters)
}
@@ -2706,7 +2693,7 @@
_ => Ok(()).no_gc(),
}
})
- .context("In check_and_update_key_usage_count.")
+ .context(ks_err!())
}
/// Load a key entry by the given key descriptor.
@@ -2738,7 +2725,7 @@
std::thread::sleep(std::time::Duration::from_micros(500));
continue;
} else {
- return Err(e).context("In load_key_entry.");
+ return Err(e).context(ks_err!());
}
}
}
@@ -2764,16 +2751,15 @@
let tx = self
.conn
.unchecked_transaction()
- .context("In load_key_entry: Failed to initialize transaction.")?;
+ .context(ks_err!("Failed to initialize transaction."))?;
// Load the key_id and complete the access control tuple.
let (key_id, access_key_descriptor, access_vector) =
- Self::load_access_tuple(&tx, key, key_type, caller_uid)
- .context("In load_key_entry.")?;
+ Self::load_access_tuple(&tx, key, key_type, caller_uid).context(ks_err!())?;
// Perform access control. It is vital that we return here if the permission is denied.
// So do not touch that '?' at the end.
- check_permission(&access_key_descriptor, access_vector).context("In load_key_entry.")?;
+ check_permission(&access_key_descriptor, access_vector).context(ks_err!())?;
// KEY ID LOCK 2/2
// If we did not get a key id lock by now, it was because we got a key descriptor
@@ -2790,7 +2776,7 @@
None => match KEY_ID_LOCK.try_get(key_id) {
None => {
// Roll back the transaction.
- tx.rollback().context("In load_key_entry: Failed to roll back transaction.")?;
+ tx.rollback().context(ks_err!("Failed to roll back transaction."))?;
// Block until we have a key id lock.
let key_id_guard = KEY_ID_LOCK.get(key_id);
@@ -2799,7 +2785,7 @@
let tx = self
.conn
.unchecked_transaction()
- .context("In load_key_entry: Failed to initialize transaction.")?;
+ .context(ks_err!("Failed to initialize transaction."))?;
Self::load_access_tuple(
&tx,
@@ -2813,7 +2799,7 @@
key_type,
caller_uid,
)
- .context("In load_key_entry. (deferred key lock)")?;
+ .context(ks_err!("(deferred key lock)"))?;
(key_id_guard, tx)
}
Some(l) => (l, tx),
@@ -2821,10 +2807,10 @@
Some(key_id_guard) => (key_id_guard, tx),
};
- let key_entry = Self::load_key_components(&tx, load_bits, key_id_guard.id())
- .context("In load_key_entry.")?;
+ let key_entry =
+ Self::load_key_components(&tx, load_bits, key_id_guard.id()).context(ks_err!())?;
- tx.commit().context("In load_key_entry: Failed to commit transaction.")?;
+ tx.commit().context(ks_err!("Failed to commit transaction."))?;
Ok((key_id_guard, key_entry))
}
@@ -2867,7 +2853,7 @@
.map(|need_gc| (need_gc, ()))
.context("Trying to mark the key unreferenced.")
})
- .context("In unbind_key.")
+ .context(ks_err!())
}
fn get_key_km_uuid(tx: &Transaction, key_id: i64) -> Result<Uuid> {
@@ -2876,7 +2862,7 @@
params![key_id],
|row| row.get(0),
)
- .context("In get_key_km_uuid.")
+ .context(ks_err!())
}
/// Delete all artifacts belonging to the namespace given by the domain-namespace tuple.
@@ -2885,8 +2871,7 @@
let _wp = wd::watch_millis("KeystoreDB::unbind_keys_for_namespace", 500);
if !(domain == Domain::APP || domain == Domain::SELINUX) {
- return Err(KsError::Rc(ResponseCode::INVALID_ARGUMENT))
- .context("In unbind_keys_for_namespace.");
+ return Err(KsError::Rc(ResponseCode::INVALID_ARGUMENT)).context(ks_err!());
}
self.with_transaction(TransactionBehavior::Immediate, |tx| {
tx.execute(
@@ -2924,7 +2909,7 @@
.context("Trying to delete keyentry.")?;
Ok(()).need_gc()
})
- .context("In unbind_keys_for_namespace")
+ .context(ks_err!())
}
fn cleanup_unreferenced(tx: &Transaction) -> Result<()> {
@@ -2965,7 +2950,7 @@
.context("Trying to delete keyentry.")?;
Result::<()>::Ok(())
}
- .context("In cleanup_unreferenced")
+ .context(ks_err!())
}
/// Delete the keys created on behalf of the user, denoted by the user id.
@@ -3012,7 +2997,7 @@
user_id,
KeyLifeCycle::Live
])
- .context("In unbind_keys_for_user. Failed to query the keys created by apps.")?;
+ .context(ks_err!("Failed to query the keys created by apps."))?;
let mut key_ids: Vec<i64> = Vec::new();
db_utils::with_rows_extract_all(&mut rows, |row| {
@@ -3020,7 +3005,7 @@
.push(row.get(0).context("Failed to read key id of a key created by an app.")?);
Ok(())
})
- .context("In unbind_keys_for_user.")?;
+ .context(ks_err!())?;
let mut notify_gc = false;
for key_id in key_ids {
@@ -3028,7 +3013,7 @@
// Load metadata and filter out non-super-encrypted keys.
if let (_, Some((_, blob_metadata)), _, _) =
Self::load_blob_components(key_id, KeyEntryLoadBits::KM, tx)
- .context("In unbind_keys_for_user: Trying to load blob info.")?
+ .context(ks_err!("Trying to load blob info."))?
{
if blob_metadata.encrypted_by().is_none() {
continue;
@@ -3041,7 +3026,7 @@
}
Ok(()).do_gc(notify_gc)
})
- .context("In unbind_keys_for_user.")
+ .context(ks_err!())
}
fn load_key_components(
@@ -3093,11 +3078,11 @@
AND state = ?
AND key_type = ?;",
)
- .context("In list: Failed to prepare.")?;
+ .context(ks_err!("Failed to prepare."))?;
let mut rows = stmt
.query(params![domain.0 as u32, namespace, KeyLifeCycle::Live, key_type])
- .context("In list: Failed to query.")?;
+ .context(ks_err!("Failed to query."))?;
let mut descriptors: Vec<KeyDescriptor> = Vec::new();
db_utils::with_rows_extract_all(&mut rows, |row| {
@@ -3109,7 +3094,7 @@
});
Ok(())
})
- .context("In list: Failed to extract rows.")?;
+ .context(ks_err!("Failed to extract rows."))?;
Ok(descriptors).no_gc()
})
}
@@ -3141,8 +3126,7 @@
// But even if we load the access tuple by grant here, the permission
// check denies the attempt to create a grant by grant descriptor.
let (key_id, access_key_descriptor, _) =
- Self::load_access_tuple(tx, key, KeyType::Client, caller_uid)
- .context("In grant")?;
+ Self::load_access_tuple(tx, key, KeyType::Client, caller_uid).context(ks_err!())?;
// Perform access control. It is vital that we return here if the permission
// was denied. So do not touch that '?' at the end of the line.
@@ -3150,7 +3134,7 @@
// for the given key and in addition to all of the permissions
// expressed in `access_vector`.
check_permission(&access_key_descriptor, &access_vector)
- .context("In grant: check_permission failed.")?;
+ .context(ks_err!("check_permission failed"))?;
let grant_id = if let Some(grant_id) = tx
.query_row(
@@ -3160,7 +3144,7 @@
|row| row.get(0),
)
.optional()
- .context("In grant: Failed get optional existing grant id.")?
+ .context(ks_err!("Failed get optional existing grant id."))?
{
tx.execute(
"UPDATE persistent.grant
@@ -3168,7 +3152,7 @@
WHERE id = ?;",
params![i32::from(access_vector), grant_id],
)
- .context("In grant: Failed to update existing grant.")?;
+ .context(ks_err!("Failed to update existing grant."))?;
grant_id
} else {
Self::insert_with_retry(|id| {
@@ -3178,7 +3162,7 @@
params![id, grantee_uid, key_id, i32::from(access_vector)],
)
})
- .context("In grant")?
+ .context(ks_err!())?
};
Ok(KeyDescriptor { domain: Domain::GRANT, nspace: grant_id, alias: None, blob: None })
@@ -3201,13 +3185,12 @@
// Load the key_id and complete the access control tuple.
// We ignore the access vector here because grants cannot be granted.
let (key_id, access_key_descriptor, _) =
- Self::load_access_tuple(tx, key, KeyType::Client, caller_uid)
- .context("In ungrant.")?;
+ Self::load_access_tuple(tx, key, KeyType::Client, caller_uid).context(ks_err!())?;
// Perform access control. We must return here if the permission
// was denied. So do not touch the '?' at the end of this line.
check_permission(&access_key_descriptor)
- .context("In grant: check_permission failed.")?;
+ .context(ks_err!("check_permission failed."))?;
tx.execute(
"DELETE FROM persistent.grant
@@ -3239,7 +3222,7 @@
_,
)) => (),
Err(e) => {
- return Err(e).context("In insert_with_retry: failed to insert into database.")
+ return Err(e).context(ks_err!("failed to insert into database."));
}
_ => return Ok(newid),
}
@@ -3298,7 +3281,7 @@
.context("Trying to load key descriptor")
.no_gc()
})
- .context("In load_key_descriptor.")
+ .context(ks_err!())
}
}
@@ -3366,7 +3349,7 @@
db.with_transaction(TransactionBehavior::Immediate, |tx| {
KeystoreDB::rebind_alias(tx, newid, alias, &domain, &namespace, KeyType::Client).no_gc()
})
- .context("In rebind_alias.")
+ .context(ks_err!())
}
#[test]
diff --git a/keystore2/src/ec_crypto.rs b/keystore2/src/ec_crypto.rs
index 0425d4a..4fb3747 100644
--- a/keystore2/src/ec_crypto.rs
+++ b/keystore2/src/ec_crypto.rs
@@ -14,6 +14,7 @@
//! Implement ECDH-based encryption.
+use crate::ks_err;
use anyhow::{Context, Result};
use keystore2_crypto::{
aes_gcm_decrypt, aes_gcm_encrypt, ec_key_generate_key, ec_key_get0_public_key,
@@ -28,29 +29,23 @@
impl ECDHPrivateKey {
/// Randomly generate a fresh keypair.
pub fn generate() -> Result<ECDHPrivateKey> {
- ec_key_generate_key()
- .map(ECDHPrivateKey)
- .context("In ECDHPrivateKey::generate: generation failed")
+ ec_key_generate_key().map(ECDHPrivateKey).context(ks_err!("generation failed"))
}
/// Deserialize bytes into an ECDH keypair
pub fn from_private_key(buf: &[u8]) -> Result<ECDHPrivateKey> {
- ec_key_parse_private_key(buf)
- .map(ECDHPrivateKey)
- .context("In ECDHPrivateKey::from_private_key: parsing failed")
+ ec_key_parse_private_key(buf).map(ECDHPrivateKey).context(ks_err!("parsing failed"))
}
/// Serialize the ECDH key into bytes
pub fn private_key(&self) -> Result<ZVec> {
- ec_key_marshal_private_key(&self.0)
- .context("In ECDHPrivateKey::private_key: marshalling failed")
+ ec_key_marshal_private_key(&self.0).context(ks_err!("marshalling failed"))
}
/// Generate the serialization of the corresponding public key
pub fn public_key(&self) -> Result<Vec<u8>> {
let point = ec_key_get0_public_key(&self.0);
- ec_point_point_to_oct(point.get_point())
- .context("In ECDHPrivateKey::public_key: marshalling failed")
+ ec_point_point_to_oct(point.get_point()).context(ks_err!("marshalling failed"))
}
/// Use ECDH to agree an AES key with another party whose public key we have.
@@ -64,18 +59,17 @@
recipient_public_key: &[u8],
) -> Result<ZVec> {
let hkdf = hkdf_extract(sender_public_key, salt)
- .context("In ECDHPrivateKey::agree_key: hkdf_extract on sender_public_key failed")?;
+ .context(ks_err!("hkdf_extract on sender_public_key failed"))?;
let hkdf = hkdf_extract(recipient_public_key, &hkdf)
- .context("In ECDHPrivateKey::agree_key: hkdf_extract on recipient_public_key failed")?;
+ .context(ks_err!("hkdf_extract on recipient_public_key failed"))?;
let other_public_key = ec_point_oct_to_point(other_public_key)
- .context("In ECDHPrivateKey::agree_key: ec_point_oct_to_point failed")?;
+ .context(ks_err!("ec_point_oct_to_point failed"))?;
let secret = ecdh_compute_key(other_public_key.get_point(), &self.0)
- .context("In ECDHPrivateKey::agree_key: ecdh_compute_key failed")?;
- let prk = hkdf_extract(&secret, &hkdf)
- .context("In ECDHPrivateKey::agree_key: hkdf_extract on secret failed")?;
+ .context(ks_err!("ecdh_compute_key failed"))?;
+ let prk = hkdf_extract(&secret, &hkdf).context(ks_err!("hkdf_extract on secret failed"))?;
let aes_key = hkdf_expand(AES_256_KEY_LENGTH, &prk, b"AES-256-GCM key")
- .context("In ECDHPrivateKey::agree_key: hkdf_expand failed")?;
+ .context(ks_err!("hkdf_expand failed"))?;
Ok(aes_key)
}
@@ -84,18 +78,14 @@
recipient_public_key: &[u8],
message: &[u8],
) -> Result<(Vec<u8>, Vec<u8>, Vec<u8>, Vec<u8>, Vec<u8>)> {
- let sender_key =
- Self::generate().context("In ECDHPrivateKey::encrypt_message: generate failed")?;
- let sender_public_key = sender_key
- .public_key()
- .context("In ECDHPrivateKey::encrypt_message: public_key failed")?;
- let salt =
- generate_salt().context("In ECDHPrivateKey::encrypt_message: generate_salt failed")?;
+ let sender_key = Self::generate().context(ks_err!("generate failed"))?;
+ let sender_public_key = sender_key.public_key().context(ks_err!("public_key failed"))?;
+ let salt = generate_salt().context(ks_err!("generate_salt failed"))?;
let aes_key = sender_key
.agree_key(&salt, recipient_public_key, &sender_public_key, recipient_public_key)
- .context("In ECDHPrivateKey::encrypt_message: agree_key failed")?;
- let (ciphertext, iv, tag) = aes_gcm_encrypt(message, &aes_key)
- .context("In ECDHPrivateKey::encrypt_message: aes_gcm_encrypt failed")?;
+ .context(ks_err!("agree_key failed"))?;
+ let (ciphertext, iv, tag) =
+ aes_gcm_encrypt(message, &aes_key).context(ks_err!("aes_gcm_encrypt failed"))?;
Ok((sender_public_key, salt, iv, ciphertext, tag))
}
@@ -111,9 +101,8 @@
let recipient_public_key = self.public_key()?;
let aes_key = self
.agree_key(salt, sender_public_key, sender_public_key, &recipient_public_key)
- .context("In ECDHPrivateKey::decrypt_message: agree_key failed")?;
- aes_gcm_decrypt(ciphertext, iv, tag, &aes_key)
- .context("In ECDHPrivateKey::decrypt_message: aes_gcm_decrypt failed")
+ .context(ks_err!("agree_key failed"))?;
+ aes_gcm_decrypt(ciphertext, iv, tag, &aes_key).context(ks_err!("aes_gcm_decrypt failed"))
}
}
diff --git a/keystore2/src/enforcements.rs b/keystore2/src/enforcements.rs
index cb6a266..8d5e985 100644
--- a/keystore2/src/enforcements.rs
+++ b/keystore2/src/enforcements.rs
@@ -14,6 +14,7 @@
//! This is the Keystore 2.0 Enforcements module.
// TODO: more description to follow.
+use crate::ks_err;
use crate::error::{map_binder_status, Error, ErrorCode};
use crate::globals::{get_timestamp_service, ASYNC_TASK, DB, ENFORCEMENTS};
use crate::key_parameter::{KeyParameter, KeyParameterValue};
@@ -95,14 +96,14 @@
.unwrap()
.take()
.ok_or(Error::Km(ErrorCode::KEY_USER_NOT_AUTHENTICATED))
- .context("In get_auth_tokens: No operation auth token received.")?;
+ .context(ks_err!("No operation auth token received."))?;
let tst = match &self.state {
AuthRequestState::TimeStampedOpAuth(recv) | AuthRequestState::TimeStamp(recv) => {
let result = recv.recv().context("In get_auth_tokens: Sender disconnected.")?;
- Some(result.context(concat!(
- "In get_auth_tokens: Worker responded with error ",
- "from generating timestamp token."
+ Some(result.context(ks_err!(
+ "Worker responded with error \
+ from generating timestamp token.",
))?)
}
AuthRequestState::OpAuth => None,
@@ -228,10 +229,7 @@
fn timestamp_token_request(challenge: i64, sender: Sender<Result<TimeStampToken, Error>>) {
if let Err(e) = sender.send(get_timestamp_token(challenge)) {
log::info!(
- concat!(
- "In timestamp_token_request: Receiver hung up ",
- "before timestamp token could be delivered. {:?}"
- ),
+ concat!("Receiver hung up ", "before timestamp token could be delivered. {:?}"),
e
);
}
@@ -322,7 +320,7 @@
.check_and_update_key_usage_count(key_id)
.context("Trying to update key usage count.")
})
- .context("In after_finish.")?;
+ .context(ks_err!())?;
}
Ok(())
}
@@ -349,14 +347,14 @@
DeferredAuthState::OpAuthRequired
| DeferredAuthState::TimeStampedOpAuthRequired
| DeferredAuthState::TimeStampRequired(_) => {
- Err(Error::Km(ErrorCode::KEY_USER_NOT_AUTHENTICATED)).context(concat!(
- "In AuthInfo::get_auth_tokens: No operation auth token requested??? ",
- "This should not happen."
+ Err(Error::Km(ErrorCode::KEY_USER_NOT_AUTHENTICATED)).context(ks_err!(
+ "No operation auth token requested??? \
+ This should not happen."
))
}
// This should not be reachable, because it should have been handled above.
DeferredAuthState::Waiting(_) => {
- Err(Error::sys()).context("In AuthInfo::get_auth_tokens: Cannot be reached.")
+ Err(Error::sys()).context(ks_err!("AuthInfo::get_auth_tokens: Cannot be reached.",))
}
}
}
@@ -418,7 +416,7 @@
key_usage_limited: None,
confirmation_token_receiver: None,
},
- ))
+ ));
}
};
@@ -428,7 +426,7 @@
// Rule out WRAP_KEY purpose
KeyPurpose::WRAP_KEY => {
return Err(Error::Km(Ec::INCOMPATIBLE_PURPOSE))
- .context("In authorize_create: WRAP_KEY purpose is not allowed here.");
+ .context(ks_err!("WRAP_KEY purpose is not allowed here.",));
}
// Allow AGREE_KEY for EC keys only.
KeyPurpose::AGREE_KEY => {
@@ -436,9 +434,8 @@
if kp.get_tag() == Tag::ALGORITHM
&& *kp.key_parameter_value() != KeyParameterValue::Algorithm(Algorithm::EC)
{
- return Err(Error::Km(Ec::UNSUPPORTED_PURPOSE)).context(
- "In authorize_create: key agreement is only supported for EC keys.",
- );
+ return Err(Error::Km(Ec::UNSUPPORTED_PURPOSE))
+ .context(ks_err!("key agreement is only supported for EC keys.",));
}
}
}
@@ -449,10 +446,10 @@
match *kp.key_parameter_value() {
KeyParameterValue::Algorithm(Algorithm::RSA)
| KeyParameterValue::Algorithm(Algorithm::EC) => {
- return Err(Error::Km(Ec::UNSUPPORTED_PURPOSE)).context(
- "In authorize_create: public operations on asymmetric keys are not \
- supported.",
- );
+ return Err(Error::Km(Ec::UNSUPPORTED_PURPOSE)).context(ks_err!(
+ "public operations on asymmetric keys are \
+ not supported."
+ ));
}
_ => {}
}
@@ -460,7 +457,7 @@
}
_ => {
return Err(Error::Km(Ec::UNSUPPORTED_PURPOSE))
- .context("In authorize_create: specified purpose is not supported.");
+ .context(ks_err!("authorize_create: specified purpose is not supported."));
}
}
// The following variables are to record information from key parameters to be used in
@@ -505,23 +502,21 @@
KeyParameterValue::ActiveDateTime(a) => {
if !Enforcements::is_given_time_passed(*a, true) {
return Err(Error::Km(Ec::KEY_NOT_YET_VALID))
- .context("In authorize_create: key is not yet active.");
+ .context(ks_err!("key is not yet active."));
}
}
KeyParameterValue::OriginationExpireDateTime(o) => {
if (purpose == KeyPurpose::ENCRYPT || purpose == KeyPurpose::SIGN)
&& Enforcements::is_given_time_passed(*o, false)
{
- return Err(Error::Km(Ec::KEY_EXPIRED))
- .context("In authorize_create: key is expired.");
+ return Err(Error::Km(Ec::KEY_EXPIRED)).context(ks_err!("key is expired."));
}
}
KeyParameterValue::UsageExpireDateTime(u) => {
if (purpose == KeyPurpose::DECRYPT || purpose == KeyPurpose::VERIFY)
&& Enforcements::is_given_time_passed(*u, false)
{
- return Err(Error::Km(Ec::KEY_EXPIRED))
- .context("In authorize_create: key is expired.");
+ return Err(Error::Km(Ec::KEY_EXPIRED)).context(ks_err!("key is expired."));
}
}
KeyParameterValue::UserSecureID(s) => {
@@ -560,24 +555,23 @@
// authorize the purpose
if !key_purpose_authorized {
return Err(Error::Km(Ec::INCOMPATIBLE_PURPOSE))
- .context("In authorize_create: the purpose is not authorized.");
+ .context(ks_err!("the purpose is not authorized."));
}
// if both NO_AUTH_REQUIRED and USER_SECURE_ID tags are present, return error
if !user_secure_ids.is_empty() && no_auth_required {
- return Err(Error::Km(Ec::INVALID_KEY_BLOB)).context(
- "In authorize_create: key has both NO_AUTH_REQUIRED and USER_SECURE_ID tags.",
- );
+ return Err(Error::Km(Ec::INVALID_KEY_BLOB))
+ .context(ks_err!("key has both NO_AUTH_REQUIRED and USER_SECURE_ID tags."));
}
// if either of auth_type or secure_id is present and the other is not present, return error
if (user_auth_type.is_some() && user_secure_ids.is_empty())
|| (user_auth_type.is_none() && !user_secure_ids.is_empty())
{
- return Err(Error::Km(Ec::KEY_USER_NOT_AUTHENTICATED)).context(
- "In authorize_create: Auth required, but either auth type or secure ids \
- are not present.",
- );
+ return Err(Error::Km(Ec::KEY_USER_NOT_AUTHENTICATED)).context(ks_err!(
+ "Auth required, but either auth type or secure ids \
+ are not present."
+ ));
}
// validate caller nonce for origination purposes
@@ -585,24 +579,22 @@
&& !caller_nonce_allowed
&& op_params.iter().any(|kp| kp.tag == Tag::NONCE)
{
- return Err(Error::Km(Ec::CALLER_NONCE_PROHIBITED)).context(
- "In authorize_create, NONCE is present, although CALLER_NONCE is not present",
- );
+ return Err(Error::Km(Ec::CALLER_NONCE_PROHIBITED))
+ .context(ks_err!("NONCE is present, although CALLER_NONCE is not present"));
}
if unlocked_device_required {
// check the device locked status. If locked, operations on the key are not
// allowed.
if self.is_device_locked(user_id) {
- return Err(Error::Km(Ec::DEVICE_LOCKED))
- .context("In authorize_create: device is locked.");
+ return Err(Error::Km(Ec::DEVICE_LOCKED)).context(ks_err!("device is locked."));
}
}
if let Some(level) = max_boot_level {
if !SUPER_KEY.read().unwrap().level_accessible(level) {
return Err(Error::Km(Ec::BOOT_LEVEL_EXCEEDED))
- .context("In authorize_create: boot level is too late.");
+ .context(ks_err!("boot level is too late."));
}
}
@@ -636,7 +628,7 @@
Some(
hat_and_last_off_body
.ok_or(Error::Km(Ec::KEY_USER_NOT_AUTHENTICATED))
- .context("In authorize_create: No suitable auth token found.")?,
+ .context(ks_err!("No suitable auth token found."))?,
)
} else {
None
@@ -649,16 +641,16 @@
let token_age = now
.checked_sub(&hat.time_received())
.ok_or_else(Error::sys)
- .context(concat!(
- "In authorize_create: Overflow while computing Auth token validity. ",
- "Validity cannot be established."
+ .context(ks_err!(
+ "Overflow while computing Auth token validity. \
+ Validity cannot be established."
))?;
let on_body_extended = allow_while_on_body && last_off_body < hat.time_received();
if token_age.seconds() > key_time_out && !on_body_extended {
return Err(Error::Km(Ec::KEY_USER_NOT_AUTHENTICATED))
- .context("In authorize_create: matching auth token is expired.");
+ .context(ks_err!("matching auth token is expired."));
}
Some(hat)
}
@@ -832,20 +824,20 @@
auth_token_entry.take_auth_token()
} else {
return Err(AuthzError::Rc(AuthzResponseCode::NO_AUTH_TOKEN_FOUND))
- .context("In get_auth_tokens: No auth token found.");
+ .context(ks_err!("No auth token found."));
}
} else {
return Err(AuthzError::Rc(AuthzResponseCode::NO_AUTH_TOKEN_FOUND)).context(
- concat!(
- "In get_auth_tokens: No auth token found for ",
- "the given challenge and passed-in auth token max age is zero."
+ ks_err!(
+ "No auth token found for \
+ the given challenge and passed-in auth token max age is zero."
),
);
}
};
// Wait and obtain the timestamp token from secure clock service.
- let tst = get_timestamp_token(challenge)
- .context("In get_auth_tokens. Error in getting timestamp token.")?;
+ let tst =
+ get_timestamp_token(challenge).context(ks_err!("Error in getting timestamp token."))?;
Ok((auth_token, tst))
}
}
diff --git a/keystore2/src/gc.rs b/keystore2/src/gc.rs
index 341aa0a..8d6c569 100644
--- a/keystore2/src/gc.rs
+++ b/keystore2/src/gc.rs
@@ -18,6 +18,7 @@
//! optionally dispose of sensitive key material appropriately, and then delete
//! the key entry from the database.
+use crate::ks_err;
use crate::{
async_task,
database::{BlobMetaData, KeystoreDB, Uuid},
@@ -103,7 +104,7 @@
let blobs = self
.db
.handle_next_superseded_blobs(&self.deleted_blob_ids, 20)
- .context("In process_one_key: Trying to handle superseded blob.")?;
+ .context(ks_err!("Trying to handle superseded blob."))?;
self.deleted_blob_ids = vec![];
self.superseded_blobs = blobs;
}
@@ -124,9 +125,9 @@
.read()
.unwrap()
.unwrap_key_if_required(&blob_metadata, &blob)
- .context("In process_one_key: Trying to unwrap to-be-deleted blob.")?;
+ .context(ks_err!("Trying to unwrap to-be-deleted blob.",))?;
(self.invalidate_key)(uuid, &*blob)
- .context("In process_one_key: Trying to invalidate key.")?;
+ .context(ks_err!("Trying to invalidate key."))?;
}
}
Ok(())
diff --git a/keystore2/src/globals.rs b/keystore2/src/globals.rs
index edbe6ce..c617240 100644
--- a/keystore2/src/globals.rs
+++ b/keystore2/src/globals.rs
@@ -16,6 +16,7 @@
//! database connections and connections to services that Keystore needs
//! to talk to.
+use crate::ks_err;
use crate::gc::Gc;
use crate::legacy_blob::LegacyBlobLoader;
use crate::legacy_importer::LegacyImporter;
@@ -187,7 +188,7 @@
let km_dev = get_keymint_dev_by_uuid(uuid).map(|(dev, _)| dev)?;
let _wp = wd::watch_millis("In invalidate key closure: calling deleteKey", 500);
map_km_error(km_dev.deleteKey(blob))
- .context("In invalidate key closure: Trying to invalidate key blob.")
+ .context(ks_err!("Trying to invalidate key blob."))
}),
KeystoreDB::new(&DB_PATH.read().expect("Could not get the database directory."), None)
.expect("Failed to open database."),
@@ -224,9 +225,10 @@
}
}
_ => {
- return Err(Error::Km(ErrorCode::HARDWARE_TYPE_UNAVAILABLE)).context(format!(
- "In keymint_service_name_by_version: Trying to find keymint V{} for security level: {:?}",
- version, security_level
+ return Err(Error::Km(ErrorCode::HARDWARE_TYPE_UNAVAILABLE)).context(ks_err!(
+ "Trying to find keymint V{} for security level: {:?}",
+ version,
+ security_level
));
}
};
@@ -251,12 +253,12 @@
Ok(sl)
}
})
- .context("In connect_keymint.")?;
+ .context(ks_err!())?;
let (keymint, hal_version) = if let Some((version, service_name)) = service_name {
let km: Strong<dyn IKeyMintDevice> =
map_binder_status_code(binder::get_interface(&service_name))
- .context("In connect_keymint: Trying to connect to genuine KeyMint service.")?;
+ .context(ks_err!("Trying to connect to genuine KeyMint service."))?;
// Map the HAL version code for KeyMint to be <AIDL version> * 100, so
// - V1 is 100
// - V2 is 200
@@ -268,7 +270,7 @@
let keystore_compat_service: Strong<dyn IKeystoreCompatService> =
map_binder_status_code(binder::get_interface("android.security.compat"))
- .context("In connect_keymint: Trying to connect to compat service.")?;
+ .context(ks_err!("Trying to connect to compat service."))?;
(
map_binder_status(keystore_compat_service.getKeyMintDevice(*security_level))
.map_err(|e| match e {
@@ -277,7 +279,7 @@
}
e => e,
})
- .context("In connect_keymint: Trying to get Legacy wrapper.")?,
+ .context(ks_err!("Trying to get Legacy wrapper."))?,
None,
)
};
@@ -302,7 +304,7 @@
security_level
);
BacklevelKeyMintWrapper::wrap(KeyMintV1::new(*security_level), keymint)
- .context("In connect_keymint: Trying to create V1 compatibility wrapper.")?
+ .context(ks_err!("Trying to create V1 compatibility wrapper."))?
}
None => {
// Compatibility wrapper around a KeyMaster device: this roughly
@@ -312,21 +314,21 @@
"Add emulation wrapper around Keymaster device for security level: {:?}",
security_level
);
- BacklevelKeyMintWrapper::wrap(KeyMintV1::new(*security_level), keymint).context(
- "In connect_keymint: Trying to create km_compat V1 compatibility wrapper .",
- )?
+ BacklevelKeyMintWrapper::wrap(KeyMintV1::new(*security_level), keymint)
+ .context(ks_err!("Trying to create km_compat V1 compatibility wrapper ."))?
}
_ => {
- return Err(Error::Km(ErrorCode::HARDWARE_TYPE_UNAVAILABLE)).context(format!(
- "In connect_keymint: unexpected hal_version {:?} for security level: {:?}",
- hal_version, security_level
- ))
+ return Err(Error::Km(ErrorCode::HARDWARE_TYPE_UNAVAILABLE)).context(ks_err!(
+ "unexpected hal_version {:?} for security level: {:?}",
+ hal_version,
+ security_level
+ ));
}
};
let wp = wd::watch_millis("In connect_keymint: calling getHardwareInfo()", 500);
- let mut hw_info = map_km_error(keymint.getHardwareInfo())
- .context("In connect_keymint: Failed to get hardware info.")?;
+ let mut hw_info =
+ map_km_error(keymint.getHardwareInfo()).context(ks_err!("Failed to get hardware info."))?;
drop(wp);
// The legacy wrapper sets hw_info.versionNumber to the underlying HAL version like so:
@@ -356,7 +358,7 @@
if let Some((dev, hw_info, uuid)) = devices_map.dev_by_sec_level(security_level) {
Ok((dev, hw_info, uuid))
} else {
- let (dev, hw_info) = connect_keymint(security_level).context("In get_keymint_device.")?;
+ let (dev, hw_info) = connect_keymint(security_level).context(ks_err!())?;
devices_map.insert(*security_level, dev, hw_info);
// Unwrap must succeed because we just inserted it.
Ok(devices_map.dev_by_sec_level(security_level).unwrap())
@@ -374,7 +376,7 @@
if let Some((dev, hw_info, _)) = devices_map.dev_by_uuid(uuid) {
Ok((dev, hw_info))
} else {
- Err(Error::sys()).context("In get_keymint_dev_by_uuid: No KeyMint instance found.")
+ Err(Error::sys()).context(ks_err!("No KeyMint instance found."))
}
}
@@ -399,14 +401,14 @@
let secureclock = if secure_clock_available {
map_binder_status_code(binder::get_interface(&default_time_stamp_service_name))
- .context("In connect_secureclock: Trying to connect to genuine secure clock service.")
+ .context(ks_err!("Trying to connect to genuine secure clock service."))
} else {
// This is a no-op if it was called before.
keystore2_km_compat::add_keymint_device_service();
let keystore_compat_service: Strong<dyn IKeystoreCompatService> =
map_binder_status_code(binder::get_interface("android.security.compat"))
- .context("In connect_secureclock: Trying to connect to compat service.")?;
+ .context(ks_err!("Trying to connect to compat service."))?;
// Legacy secure clock services were only implemented by TEE.
map_binder_status(keystore_compat_service.getSecureClock())
@@ -416,7 +418,7 @@
}
e => e,
})
- .context("In connect_secureclock: Trying to get Legacy wrapper.")
+ .context(ks_err!("Trying to get Legacy wrapper."))
}?;
Ok(secureclock)
@@ -429,7 +431,7 @@
if let Some(dev) = &*ts_device {
Ok(dev.clone())
} else {
- let dev = connect_secureclock().context("In get_timestamp_service.")?;
+ let dev = connect_secureclock().context(ks_err!())?;
*ts_device = Some(dev.clone());
Ok(dev)
}
@@ -462,13 +464,11 @@
_ => None,
}
.ok_or(Error::Km(ErrorCode::HARDWARE_TYPE_UNAVAILABLE))
- .context("In connect_remotely_provisioned_component.")?;
+ .context(ks_err!())?;
let rem_prov_hal: Strong<dyn IRemotelyProvisionedComponent> =
- map_binder_status_code(binder::get_interface(&service_name)).context(concat!(
- "In connect_remotely_provisioned_component: Trying to connect to",
- " RemotelyProvisionedComponent service."
- ))?;
+ map_binder_status_code(binder::get_interface(&service_name))
+ .context(ks_err!("Trying to connect to RemotelyProvisionedComponent service."))?;
Ok(rem_prov_hal)
}
@@ -481,8 +481,7 @@
if let Some(dev) = devices_map.dev_by_sec_level(security_level) {
Ok(dev)
} else {
- let dev = connect_remotely_provisioned_component(security_level)
- .context("In get_remotely_provisioned_component.")?;
+ let dev = connect_remotely_provisioned_component(security_level).context(ks_err!())?;
devices_map.insert(*security_level, dev);
// Unwrap must succeed because we just inserted it.
Ok(devices_map.dev_by_sec_level(security_level).unwrap())
diff --git a/keystore2/src/id_rotation.rs b/keystore2/src/id_rotation.rs
index e3992d8..460caa7 100644
--- a/keystore2/src/id_rotation.rs
+++ b/keystore2/src/id_rotation.rs
@@ -20,6 +20,8 @@
//! It is assumed that the timestamp file does not exist after a factory reset. So the creation
//! time of the timestamp file provides a lower bound for the time since factory reset.
+use crate::ks_err;
+
use anyhow::{Context, Result};
use std::fs;
use std::io::ErrorKind;
@@ -66,7 +68,7 @@
_ => Err(e).context("Failed to open timestamp file."),
},
}
- .context("In had_factory_reset_since_id_rotation:")
+ .context(ks_err!())
}
}
diff --git a/keystore2/src/keystore2_main.rs b/keystore2/src/keystore2_main.rs
index 55f5d15..c54753c 100644
--- a/keystore2/src/keystore2_main.rs
+++ b/keystore2/src/keystore2_main.rs
@@ -47,7 +47,16 @@
android_logger::Config::default()
.with_tag("keystore2")
.with_min_level(log::Level::Debug)
- .with_log_id(android_logger::LogId::System),
+ .with_log_id(android_logger::LogId::System)
+ .format(|buf, record| {
+ writeln!(
+ buf,
+ "{}:{} - {}",
+ record.file().unwrap_or("unknown"),
+ record.line().unwrap_or(0),
+ record.args()
+ )
+ }),
);
// Redirect panic messages to logcat.
panic::set_hook(Box::new(|panic_info| {
diff --git a/keystore2/src/km_compat.rs b/keystore2/src/km_compat.rs
index 788beef..035edd9 100644
--- a/keystore2/src/km_compat.rs
+++ b/keystore2/src/km_compat.rs
@@ -15,6 +15,7 @@
//! Provide a wrapper around a KeyMint device that allows up-level features to
//! be emulated on back-level devices.
+use crate::ks_err;
use crate::error::{map_binder_status, map_binder_status_code, map_or_log_err, Error, ErrorCode};
use android_hardware_security_keymint::binder::{BinderFeatures, StatusCode, Strong};
use android_hardware_security_secureclock::aidl::android::hardware::security::secureclock::TimeStampToken::TimeStampToken;
@@ -81,7 +82,7 @@
result.extend_from_slice(KEYBLOB_PREFIX);
result.extend_from_slice(keyblob);
let tag = hmac_sha256(KEYBLOB_HMAC_KEY, keyblob)
- .context("In wrap_keyblob, failed to calculate HMAC-SHA256")?;
+ .context(ks_err!("failed to calculate HMAC-SHA256"))?;
result.extend_from_slice(&tag);
Ok(result)
}
@@ -138,10 +139,9 @@
// This is a no-op if it was called before.
keystore2_km_compat::add_keymint_device_service();
- let keystore_compat_service: Strong<dyn IKeystoreCompatService> = map_binder_status_code(
- binder::get_interface("android.security.compat"),
- )
- .context("In BacklevelKeyMintWrapper::wrap: Trying to connect to compat service.")?;
+ let keystore_compat_service: Strong<dyn IKeystoreCompatService> =
+ map_binder_status_code(binder::get_interface("android.security.compat"))
+ .context(ks_err!("Trying to connect to compat service."))?;
let soft =
map_binder_status(keystore_compat_service.getKeyMintDevice(SecurityLevel::SOFTWARE))
.map_err(|e| match e {
@@ -150,7 +150,7 @@
}
e => e,
})
- .context("In BacklevelKeyMintWrapper::wrap: Trying to get software device.")?;
+ .context(ks_err!("Trying to get software device."))?;
Ok(BnKeyMintDevice::new_binder(
Self { real, soft, emu },
diff --git a/keystore2/src/ks_err.rs b/keystore2/src/ks_err.rs
new file mode 100644
index 0000000..c9c38c0
--- /dev/null
+++ b/keystore2/src/ks_err.rs
@@ -0,0 +1,35 @@
+// Copyright 2020, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! A ks_err macro that expands error messages to include the file and line number
+
+///
+/// # Examples
+///
+/// ```
+/// use crate::ks_err;
+///
+/// ks_err!("Key is expired.");
+/// Result:
+/// "src/lib.rs:7 Key is expired."
+/// ```
+#[macro_export]
+macro_rules! ks_err {
+ { $($arg:tt)+ } => {
+ format!("{}:{}: {}", file!(), line!(), format_args!($($arg)+))
+ };
+ {} => {
+ format!("{}:{}", file!(), line!())
+ };
+}
diff --git a/keystore2/src/legacy_blob.rs b/keystore2/src/legacy_blob.rs
index 1c43a04..7cf1819 100644
--- a/keystore2/src/legacy_blob.rs
+++ b/keystore2/src/legacy_blob.rs
@@ -14,6 +14,7 @@
//! This module implements methods to load legacy keystore key blob files.
+use crate::ks_err;
use crate::{
error::{Error as KsError, ResponseCode},
key_parameter::{KeyParameter, KeyParameterValue},
@@ -348,24 +349,23 @@
None
}
_ => {
- return Err(Error::BadEncoding)
- .context("In decode_alias: could not decode filename.")
+ return Err(Error::BadEncoding).context(ks_err!("could not decode filename."));
}
};
}
if multi.is_some() {
- return Err(Error::BadEncoding).context("In decode_alias: could not decode filename.");
+ return Err(Error::BadEncoding).context(ks_err!("could not decode filename."));
}
- String::from_utf8(s).context("In decode_alias: encoded alias was not valid UTF-8.")
+ String::from_utf8(s).context(ks_err!("encoded alias was not valid UTF-8."))
}
fn new_from_stream(stream: &mut dyn Read) -> Result<Blob> {
let mut buffer = Vec::new();
- stream.read_to_end(&mut buffer).context("In new_from_stream.")?;
+ stream.read_to_end(&mut buffer).context(ks_err!())?;
if buffer.len() < Self::COMMON_HEADER_SIZE {
- return Err(Error::BadLen).context("In new_from_stream.")?;
+ return Err(Error::BadLen).context(ks_err!())?;
}
let version: u8 = buffer[Self::VERSION_OFFSET];
@@ -380,15 +380,15 @@
if version != SUPPORTED_LEGACY_BLOB_VERSION {
return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
- .context(format!("In new_from_stream: Unknown blob version: {}.", version));
+ .context(ks_err!("Unknown blob version: {}.", version));
}
let length = u32::from_be_bytes(
buffer[Self::LENGTH_OFFSET..Self::LENGTH_OFFSET + 4].try_into().unwrap(),
) as usize;
if buffer.len() < Self::COMMON_HEADER_SIZE + length {
- return Err(Error::BadLen).context(format!(
- "In new_from_stream. Expected: {} got: {}.",
+ return Err(Error::BadLen).context(ks_err!(
+ "Expected: {} got: {}.",
Self::COMMON_HEADER_SIZE + length,
buffer.len()
));
@@ -457,11 +457,12 @@
}),
(blob_types::SUPER_KEY, _, None) | (blob_types::SUPER_KEY_AES256, _, None) => {
Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
- .context("In new_from_stream: Super key without salt for key derivation.")
+ .context(ks_err!("Super key without salt for key derivation."))
}
- _ => Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED)).context(format!(
- "In new_from_stream: Unknown blob type. {} {}",
- blob_type, is_encrypted
+ _ => Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED)).context(ks_err!(
+ "Unknown blob type. {} {}",
+ blob_type,
+ is_encrypted
)),
}
}
@@ -482,30 +483,23 @@
where
F: FnOnce(&[u8], &[u8], &[u8], Option<&[u8]>, Option<usize>) -> Result<ZVec>,
{
- let blob =
- Self::new_from_stream(&mut stream).context("In new_from_stream_decrypt_with.")?;
+ let blob = Self::new_from_stream(&mut stream).context(ks_err!())?;
match blob.value() {
BlobValue::Encrypted { iv, tag, data } => Ok(Blob {
flags: blob.flags,
- value: BlobValue::Decrypted(
- decrypt(data, iv, tag, None, None)
- .context("In new_from_stream_decrypt_with.")?,
- ),
+ value: BlobValue::Decrypted(decrypt(data, iv, tag, None, None).context(ks_err!())?),
}),
BlobValue::PwEncrypted { iv, tag, data, salt, key_size } => Ok(Blob {
flags: blob.flags,
value: BlobValue::Decrypted(
- decrypt(data, iv, tag, Some(salt), Some(*key_size))
- .context("In new_from_stream_decrypt_with.")?,
+ decrypt(data, iv, tag, Some(salt), Some(*key_size)).context(ks_err!())?,
),
}),
BlobValue::EncryptedGeneric { iv, tag, data } => Ok(Blob {
flags: blob.flags,
value: BlobValue::Generic(
- decrypt(data, iv, tag, None, None)
- .context("In new_from_stream_decrypt_with.")?[..]
- .to_vec(),
+ decrypt(data, iv, tag, None, None).context(ks_err!())?[..].to_vec(),
),
}),
@@ -548,33 +542,30 @@
/// | 32 bit indirect_offset | Offset from the beginning of the indirect section.
/// +------------------------+
pub fn read_key_parameters(stream: &mut &[u8]) -> Result<Vec<KeyParameterValue>> {
- let indirect_size =
- read_ne_u32(stream).context("In read_key_parameters: While reading indirect size.")?;
+ let indirect_size = read_ne_u32(stream).context(ks_err!("While reading indirect size."))?;
let indirect_buffer = stream
.get(0..indirect_size as usize)
.ok_or(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
- .context("In read_key_parameters: While reading indirect buffer.")?;
+ .context(ks_err!("While reading indirect buffer."))?;
// update the stream position.
*stream = &stream[indirect_size as usize..];
- let element_count =
- read_ne_u32(stream).context("In read_key_parameters: While reading element count.")?;
- let element_size =
- read_ne_u32(stream).context("In read_key_parameters: While reading element size.")?;
+ let element_count = read_ne_u32(stream).context(ks_err!("While reading element count."))?;
+ let element_size = read_ne_u32(stream).context(ks_err!("While reading element size."))?;
let mut element_stream = stream
.get(0..element_size as usize)
.ok_or(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
- .context("In read_key_parameters: While reading elements buffer.")?;
+ .context(ks_err!("While reading elements buffer."))?;
// update the stream position.
*stream = &stream[element_size as usize..];
let mut params: Vec<KeyParameterValue> = Vec::new();
for _ in 0..element_count {
- let tag = Tag(read_ne_i32(&mut element_stream).context("In read_key_parameters.")?);
+ let tag = Tag(read_ne_i32(&mut element_stream).context(ks_err!())?);
let param = match Self::tag_type(tag) {
TagType::ENUM | TagType::ENUM_REP | TagType::UINT | TagType::UINT_REP => {
KeyParameterValue::new_from_tag_primitive_pair(
@@ -617,7 +608,7 @@
TagType::INVALID => Err(anyhow::anyhow!("Invalid.")),
_ => {
return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
- .context("In read_key_parameters: Encountered bogus tag type.");
+ .context(ks_err!("Encountered bogus tag type."));
}
};
if let Ok(p) = param {
@@ -647,9 +638,11 @@
{
Ok(Blob {
value: BlobValue::Characteristics(
- super_key.as_ref().unwrap().decrypt(&data, &iv, &tag).context(
- "In decrypt_if_required: Failed to decrypt EncryptedCharacteristics",
- )?[..]
+ super_key
+ .as_ref()
+ .unwrap()
+ .decrypt(&data, &iv, &tag)
+ .context(ks_err!("Failed to decrypt EncryptedCharacteristics"))?[..]
.to_vec(),
),
flags,
@@ -664,7 +657,7 @@
.as_ref()
.unwrap()
.decrypt(&data, &iv, &tag)
- .context("In decrypt_if_required: Failed to decrypt Encrypted")?,
+ .context(ks_err!("Failed to decrypt Encrypted"))?,
),
flags,
})
@@ -678,7 +671,7 @@
.as_ref()
.unwrap()
.decrypt(&data, &iv, &tag)
- .context("In decrypt_if_required: Failed to decrypt Encrypted")?[..]
+ .context(ks_err!("Failed to decrypt Encrypted"))?[..]
.to_vec(),
),
flags,
@@ -687,7 +680,7 @@
// This arm catches all encrypted cases where super key is not present or cannot
// decrypt the blob, the latter being BlobValue::PwEncrypted.
_ => Err(Error::LockedComponent)
- .context("In decrypt_if_required: Encountered encrypted blob without super key."),
+ .context(ks_err!("Encountered encrypted blob without super key.")),
}
}
@@ -700,7 +693,7 @@
super_key: &Option<Arc<dyn AesGcm>>,
) -> Result<LegacyKeyCharacteristics> {
let blob = Self::read_generic_blob(&self.make_chr_filename(uid, alias, prefix))
- .context("In read_characteristics_file")?;
+ .context(ks_err!())?;
let blob = match blob {
None => return Ok(LegacyKeyCharacteristics::Cache(Vec::new())),
@@ -708,16 +701,14 @@
};
let blob = Self::decrypt_if_required(super_key, blob)
- .context("In read_characteristics_file: Trying to decrypt blob.")?;
+ .context(ks_err!("Trying to decrypt blob."))?;
let (mut stream, is_cache) = match blob.value() {
BlobValue::Characteristics(data) => (&data[..], false),
BlobValue::CharacteristicsCache(data) => (&data[..], true),
_ => {
- return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED)).context(concat!(
- "In read_characteristics_file: ",
- "Characteristics file does not hold key characteristics."
- ))
+ return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
+ .context(ks_err!("Characteristics file does not hold key characteristics."));
}
};
@@ -726,7 +717,7 @@
// the hardware enforced list.
BlobValue::CharacteristicsCache(_) => Some(
Self::read_key_parameters(&mut stream)
- .context("In read_characteristics_file.")?
+ .context(ks_err!())?
.into_iter()
.map(|value| KeyParameter::new(value, hw_sec_level)),
),
@@ -734,7 +725,7 @@
};
let sw_list = Self::read_key_parameters(&mut stream)
- .context("In read_characteristics_file.")?
+ .context(ks_err!())?
.into_iter()
.map(|value| KeyParameter::new(value, SecurityLevel::KEYSTORE));
@@ -786,11 +777,11 @@
Ok(file) => file,
Err(e) => match e.kind() {
ErrorKind::NotFound => return Ok(None),
- _ => return Err(e).context("In read_generic_blob."),
+ _ => return Err(e).context(ks_err!()),
},
};
- Ok(Some(Self::new_from_stream(&mut file).context("In read_generic_blob.")?))
+ Ok(Some(Self::new_from_stream(&mut file).context(ks_err!())?))
}
fn read_generic_blob_decrypt_with<F>(path: &Path, decrypt: F) -> Result<Option<Blob>>
@@ -801,14 +792,11 @@
Ok(file) => file,
Err(e) => match e.kind() {
ErrorKind::NotFound => return Ok(None),
- _ => return Err(e).context("In read_generic_blob_decrypt_with."),
+ _ => return Err(e).context(ks_err!()),
},
};
- Ok(Some(
- Self::new_from_stream_decrypt_with(&mut file, decrypt)
- .context("In read_generic_blob_decrypt_with.")?,
- ))
+ Ok(Some(Self::new_from_stream_decrypt_with(&mut file, decrypt).context(ks_err!())?))
}
/// Read a legacy keystore entry blob.
@@ -827,7 +815,7 @@
};
let blob = Self::read_generic_blob_decrypt_with(&path, decrypt)
- .context("In read_legacy_keystore_entry: Failed to read blob.")?;
+ .context(ks_err!("Failed to read blob."))?;
Ok(blob.and_then(|blob| match blob.value {
BlobValue::Generic(blob) => Some(blob),
@@ -848,13 +836,13 @@
if let Err(e) = Self::with_retry_interrupted(|| fs::remove_file(path.as_path())) {
match e.kind() {
ErrorKind::NotFound => return Ok(false),
- _ => return Err(e).context("In remove_legacy_keystore_entry."),
+ _ => return Err(e).context(ks_err!()),
}
}
let user_id = uid_to_android_user(uid);
self.remove_user_dir_if_empty(user_id)
- .context("In remove_legacy_keystore_entry: Trying to remove empty user dir.")?;
+ .context(ks_err!("Trying to remove empty user dir."))?;
Ok(true)
}
@@ -869,27 +857,21 @@
Err(e) => match e.kind() {
ErrorKind::NotFound => return Ok(Default::default()),
_ => {
- return Err(e).context(format!(
- concat!(
- "In list_legacy_keystore_entries_for_uid: ,",
- "Failed to open legacy blob database: {:?}"
- ),
- path
- ))
+ return Err(e)
+ .context(ks_err!("Failed to open legacy blob database: {:?}", path));
}
},
};
let mut result: Vec<String> = Vec::new();
for entry in dir {
- let file_name = entry
- .context("In list_legacy_keystore_entries_for_uid: Trying to access dir entry")?
- .file_name();
+ let file_name = entry.context(ks_err!("Trying to access dir entry"))?.file_name();
if let Some(f) = file_name.to_str() {
let encoded_alias = &f[uid_str.len() + 1..];
if f.starts_with(&uid_str) && !Self::is_keystore_alias(encoded_alias) {
- result.push(Self::decode_alias(encoded_alias).context(
- "In list_legacy_keystore_entries_for_uid: Trying to decode alias.",
- )?)
+ result.push(
+ Self::decode_alias(encoded_alias)
+ .context(ks_err!("Trying to decode alias."))?,
+ )
}
}
}
@@ -911,9 +893,7 @@
&self,
user_id: u32,
) -> Result<HashMap<u32, HashSet<String>>> {
- let user_entries = self
- .list_user(user_id)
- .context("In list_legacy_keystore_entries_for_user: Trying to list user.")?;
+ let user_entries = self.list_user(user_id).context(ks_err!("Trying to list user."))?;
let result =
user_entries.into_iter().fold(HashMap::<u32, HashSet<String>>::new(), |mut acc, v| {
@@ -986,9 +966,9 @@
/// in the database dir.
pub fn is_empty(&self) -> Result<bool> {
let dir = Self::with_retry_interrupted(|| fs::read_dir(self.path.as_path()))
- .context("In is_empty: Failed to open legacy blob database.")?;
+ .context(ks_err!("Failed to open legacy blob database."))?;
for entry in dir {
- if (*entry.context("In is_empty: Trying to access dir entry")?.file_name())
+ if (*entry.context(ks_err!("Trying to access dir entry"))?.file_name())
.to_str()
.map_or(false, |f| f.starts_with("user_"))
{
@@ -1007,7 +987,7 @@
return Ok(true);
}
Ok(Self::with_retry_interrupted(|| user_path.read_dir())
- .context("In is_empty_user: Failed to open legacy user dir.")?
+ .context(ks_err!("Failed to open legacy user dir."))?
.next()
.is_none())
}
@@ -1032,16 +1012,14 @@
Err(e) => match e.kind() {
ErrorKind::NotFound => return Ok(Default::default()),
_ => {
- return Err(e).context(format!(
- "In list_user: Failed to open legacy blob database. {:?}",
- path
- ))
+ return Err(e)
+ .context(ks_err!("Failed to open legacy blob database. {:?}", path));
}
},
};
let mut result: Vec<String> = Vec::new();
for entry in dir {
- let file_name = entry.context("In list_user: Trying to access dir entry")?.file_name();
+ let file_name = entry.context(ks_err!("Trying to access dir entry"))?.file_name();
if let Some(f) = file_name.to_str() {
result.push(f.to_string())
}
@@ -1055,9 +1033,7 @@
&self,
user_id: u32,
) -> Result<HashMap<u32, HashSet<String>>> {
- let user_entries = self
- .list_user(user_id)
- .context("In list_keystore_entries_for_user: Trying to list user.")?;
+ let user_entries = self.list_user(user_id).context(ks_err!("Trying to list user."))?;
let result =
user_entries.into_iter().fold(HashMap::<u32, HashSet<String>>::new(), |mut acc, v| {
@@ -1078,9 +1054,7 @@
pub fn list_keystore_entries_for_uid(&self, uid: u32) -> Result<Vec<String>> {
let user_id = uid_to_android_user(uid);
- let user_entries = self
- .list_user(user_id)
- .context("In list_keystore_entries_for_uid: Trying to list user.")?;
+ let user_entries = self.list_user(user_id).context(ks_err!("Trying to list user."))?;
let uid_str = format!("{}_", uid);
@@ -1163,7 +1137,7 @@
if something_was_deleted {
let user_id = uid_to_android_user(uid);
self.remove_user_dir_if_empty(user_id)
- .context("In remove_keystore_entry: Trying to remove empty user dir.")?;
+ .context(ks_err!("Trying to remove empty user dir."))?;
}
Ok(something_was_deleted)
@@ -1188,7 +1162,7 @@
let dest_path = make_filename(dest_uid, dest_alias, prefix);
match Self::with_retry_interrupted(|| fs::rename(&src_path, &dest_path)) {
Err(e) if e.kind() == ErrorKind::NotFound => Ok(()),
- r => r.context("In move_keystore_file_if_exists: Trying to rename."),
+ r => r.context(ks_err!("Trying to rename.")),
}
}
@@ -1207,7 +1181,7 @@
}
if uid_to_android_user(src_uid) != uid_to_android_user(dest_uid) {
- return Err(Error::AndroidUserMismatch).context("In move_keystore_entry.");
+ return Err(Error::AndroidUserMismatch).context(ks_err!());
}
let prefixes = ["USRPKEY", "USRSKEY", "USRCERT", "CACERT"];
@@ -1220,12 +1194,7 @@
prefix,
|uid, alias, prefix| self.make_blob_filename(uid, alias, prefix),
)
- .with_context(|| {
- format!(
- "In move_keystore_entry: Trying to move blob file with prefix: \"{}\"",
- prefix
- )
- })?;
+ .with_context(|| ks_err!("Trying to move blob file with prefix: \"{}\"", prefix))?;
}
let prefixes = ["USRPKEY", "USRSKEY"];
@@ -1240,8 +1209,8 @@
|uid, alias, prefix| self.make_chr_filename(uid, alias, prefix),
)
.with_context(|| {
- format!(
- "In move_keystore_entry: Trying to move characteristics file with \
+ ks_err!(
+ "Trying to move characteristics file with \
prefix: \"{}\"",
prefix
)
@@ -1252,10 +1221,7 @@
}
fn remove_user_dir_if_empty(&self, user_id: u32) -> Result<()> {
- if self
- .is_empty_user(user_id)
- .context("In remove_user_dir_if_empty: Trying to check for empty user dir.")?
- {
+ if self.is_empty_user(user_id).context(ks_err!("Trying to check for empty user dir."))? {
let user_path = self.make_user_path_name(user_id);
Self::with_retry_interrupted(|| fs::remove_dir(user_path.as_path())).ok();
}
@@ -1273,14 +1239,14 @@
let km_blob = match km_blob {
Some((km_blob, prefix)) => {
- let km_blob =
- match km_blob {
- Blob { flags: _, value: BlobValue::Decrypted(_) }
- | Blob { flags: _, value: BlobValue::Encrypted { .. } } => km_blob,
- _ => return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED)).context(
- "In load_by_uid_alias: Found wrong blob type in legacy key blob file.",
- ),
- };
+ let km_blob = match km_blob {
+ Blob { flags: _, value: BlobValue::Decrypted(_) }
+ | Blob { flags: _, value: BlobValue::Encrypted { .. } } => km_blob,
+ _ => {
+ return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
+ .context(ks_err!("Found wrong blob type in legacy key blob file."))
+ }
+ };
let hw_sec_level = match km_blob.is_strongbox() {
true => SecurityLevel::STRONGBOX,
@@ -1288,7 +1254,7 @@
};
let key_parameters = self
.read_characteristics_file(uid, &prefix, alias, hw_sec_level, super_key)
- .context("In load_by_uid_alias.")?;
+ .context(ks_err!())?;
Some((km_blob, key_parameters))
}
None => None,
@@ -1296,34 +1262,34 @@
let user_cert_blob =
Self::read_generic_blob(&self.make_blob_filename(uid, alias, "USRCERT"))
- .context("In load_by_uid_alias: While loading user cert.")?;
+ .context(ks_err!("While loading user cert."))?;
let user_cert = if let Some(blob) = user_cert_blob {
let blob = Self::decrypt_if_required(super_key, blob)
- .context("In load_by_uid_alias: While decrypting user cert.")?;
+ .context(ks_err!("While decrypting user cert."))?;
if let Blob { value: BlobValue::Generic(data), .. } = blob {
Some(data)
} else {
return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
- .context("In load_by_uid_alias: Found unexpected blob type in USRCERT file");
+ .context(ks_err!("Found unexpected blob type in USRCERT file"));
}
} else {
None
};
let ca_cert_blob = Self::read_generic_blob(&self.make_blob_filename(uid, alias, "CACERT"))
- .context("In load_by_uid_alias: While loading ca cert.")?;
+ .context(ks_err!("While loading ca cert."))?;
let ca_cert = if let Some(blob) = ca_cert_blob {
let blob = Self::decrypt_if_required(super_key, blob)
- .context("In load_by_uid_alias: While decrypting ca cert.")?;
+ .context(ks_err!("While decrypting ca cert."))?;
if let Blob { value: BlobValue::Generic(data), .. } = blob {
Some(data)
} else {
return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
- .context("In load_by_uid_alias: Found unexpected blob type in CACERT file");
+ .context(ks_err!("Found unexpected blob type in CACERT file"));
}
} else {
None
@@ -1340,8 +1306,7 @@
/// Load and decrypt legacy super key blob.
pub fn load_super_key(&self, user_id: u32, pw: &Password) -> Result<Option<ZVec>> {
let path = self.make_super_key_filename(user_id);
- let blob = Self::read_generic_blob(&path)
- .context("In load_super_key: While loading super key.")?;
+ let blob = Self::read_generic_blob(&path).context(ks_err!("While loading super key."))?;
let blob = match blob {
Some(blob) => match blob {
@@ -1349,23 +1314,18 @@
if (flags & flags::ENCRYPTED) != 0 {
let key = pw
.derive_key(&salt, key_size)
- .context("In load_super_key: Failed to derive key from password.")?;
- let blob = aes_gcm_decrypt(&data, &iv, &tag, &key).context(
- "In load_super_key: while trying to decrypt legacy super key blob.",
- )?;
+ .context(ks_err!("Failed to derive key from password."))?;
+ let blob = aes_gcm_decrypt(&data, &iv, &tag, &key)
+ .context(ks_err!("while trying to decrypt legacy super key blob."))?;
Some(blob)
} else {
// In 2019 we had some unencrypted super keys due to b/141955555.
- Some(
- data.try_into()
- .context("In load_super_key: Trying to convert key into ZVec")?,
- )
+ Some(data.try_into().context(ks_err!("Trying to convert key into ZVec"))?)
}
}
_ => {
- return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED)).context(
- "In load_super_key: Found wrong blob type in legacy super key blob file.",
- )
+ return Err(KsError::Rc(ResponseCode::VALUE_CORRUPTED))
+ .context(ks_err!("Found wrong blob type in legacy super key blob file."));
}
},
None => None,
diff --git a/keystore2/src/legacy_importer.rs b/keystore2/src/legacy_importer.rs
index 93e1735..be90d09 100644
--- a/keystore2/src/legacy_importer.rs
+++ b/keystore2/src/legacy_importer.rs
@@ -20,6 +20,7 @@
};
use crate::error::{map_km_error, Error};
use crate::key_parameter::{KeyParameter, KeyParameterValue};
+use crate::ks_err;
use crate::legacy_blob::{self, Blob, BlobValue, LegacyKeyCharacteristics};
use crate::super_key::USER_SUPER_KEY;
use crate::utils::{
@@ -185,9 +186,8 @@
}
(Self::STATE_UNINITIALIZED, false) => {
// Okay, tough luck. The legacy loader was really completely uninitialized.
- return Err(Error::sys()).context(
- "In check_state: Legacy loader should not be called uninitialized.",
- );
+ return Err(Error::sys())
+ .context(ks_err!("Legacy loader should not be called uninitialized."));
}
(Self::STATE_READY, _) => return Ok(Self::STATE_READY),
(s, _) => panic!("Unknown legacy importer state. {} ", s),
@@ -227,7 +227,7 @@
F: FnOnce(&mut LegacyImporterState) -> Result<T> + Send + 'static,
{
// Short circuit if the database is empty or not initialized (error case).
- match self.check_state().context("In do_serialized: Checking state.") {
+ match self.check_state().context(ks_err!("Checking state.")) {
Ok(LegacyImporter::STATE_EMPTY) => return None,
Ok(LegacyImporter::STATE_READY) => {}
Err(e) => return Some(Err(e)),
@@ -266,7 +266,7 @@
let (new_state, result) = match receiver.recv() {
Err(e) => {
- return Some(Err(e).context("In do_serialized. Failed to receive from the sender."))
+ return Some(Err(e).context(ks_err!("Failed to receive from the sender.")));
}
Ok(r) => r,
};
@@ -357,7 +357,7 @@
Ok(None) => {}
Err(e) => return Err(e),
}
- let pw = pw.try_clone().context("In with_try_import_super_key: Cloning password.")?;
+ let pw = pw.try_clone().context(ks_err!("Cloning password."))?;
let result = self.do_serialized(move |importer_state| {
importer_state.check_and_import_super_key(user_id, &pw)
});
@@ -424,7 +424,7 @@
};
self.sec_level_to_km_uuid.get(&sec_level).copied().ok_or_else(|| {
- anyhow::anyhow!(Error::sys()).context("In get_km_uuid: No KM instance for blob.")
+ anyhow::anyhow!(Error::sys()).context(ks_err!("No KM instance for blob."))
})
}
@@ -446,7 +446,7 @@
match self
.db
.load_super_key(&USER_SUPER_KEY, user_id)
- .context("In get_super_key_id_check_unlockable_or_delete: Failed to load super key")?
+ .context(ks_err!("Failed to load super key"))?
{
Some((_, entry)) => Ok(entry.id()),
None => {
@@ -460,17 +460,14 @@
// key and return NotFound, because the key will never
// be unlocked again.
if self.legacy_loader.has_super_key(user_id) {
- Err(Error::Rc(ResponseCode::LOCKED)).context(
- "In get_super_key_id_check_unlockable_or_delete: \
- Cannot import super key of this key while user is locked.",
- )
+ Err(Error::Rc(ResponseCode::LOCKED)).context(ks_err!(
+ "Cannot import super key of this key while user is locked."
+ ))
} else {
- self.legacy_loader.remove_keystore_entry(uid, alias).context(
- "In get_super_key_id_check_unlockable_or_delete: \
- Trying to remove obsolete key.",
- )?;
- Err(Error::Rc(ResponseCode::KEY_NOT_FOUND))
- .context("In get_super_key_id_check_unlockable_or_delete: Obsolete key.")
+ self.legacy_loader
+ .remove_keystore_entry(uid, alias)
+ .context(ks_err!("Trying to remove obsolete key."))?;
+ Err(Error::Rc(ResponseCode::KEY_NOT_FOUND)).context(ks_err!("Obsolete key."))
}
}
}
@@ -487,99 +484,91 @@
let (km_blob, params) = match km_blob_params {
Some((km_blob, LegacyKeyCharacteristics::File(params))) => (km_blob, params),
Some((km_blob, LegacyKeyCharacteristics::Cache(params))) => {
- return Ok((Some((km_blob, params)), None))
+ return Ok((Some((km_blob, params)), None));
}
None => return Ok((None, None)),
};
- let km_uuid = self
- .get_km_uuid(km_blob.is_strongbox())
- .context("In characteristics_file_to_cache: Trying to get KM UUID")?;
+ let km_uuid =
+ self.get_km_uuid(km_blob.is_strongbox()).context(ks_err!("Trying to get KM UUID"))?;
let blob = match (&km_blob.value(), super_key.as_ref()) {
(BlobValue::Encrypted { iv, tag, data }, Some(super_key)) => {
- let blob = super_key
- .decrypt(data, iv, tag)
- .context("In characteristics_file_to_cache: Decryption failed.")?;
+ let blob =
+ super_key.decrypt(data, iv, tag).context(ks_err!("Decryption failed."))?;
LegacyBlob::ZVec(blob)
}
(BlobValue::Encrypted { .. }, None) => {
- return Err(Error::Rc(ResponseCode::LOCKED)).context(
- "In characteristics_file_to_cache: Oh uh, so close. \
- This ancient key cannot be imported unless the user is unlocked.",
- );
+ return Err(Error::Rc(ResponseCode::LOCKED)).context(ks_err!(
+ "Oh uh, so close. \
+ This ancient key cannot be imported unless the user is unlocked."
+ ));
}
(BlobValue::Decrypted(data), _) => LegacyBlob::Ref(data),
_ => {
- return Err(Error::sys())
- .context("In characteristics_file_to_cache: Unexpected blob type.")
+ return Err(Error::sys()).context(ks_err!("Unexpected blob type."));
}
};
let (km_params, upgraded_blob) = get_key_characteristics_without_app_data(&km_uuid, &*blob)
- .context(
- "In characteristics_file_to_cache: Failed to get key characteristics from device.",
- )?;
+ .context(ks_err!("Failed to get key characteristics from device.",))?;
let flags = km_blob.get_flags();
- let (current_blob, superseded_blob) = if let Some(upgraded_blob) = upgraded_blob {
- match (km_blob.take_value(), super_key.as_ref()) {
- (BlobValue::Encrypted { iv, tag, data }, Some(super_key)) => {
- let super_key_id =
- self.get_super_key_id_check_unlockable_or_delete(uid, alias).context(
- "In characteristics_file_to_cache: \
- How is there a super key but no super key id?",
- )?;
+ let (current_blob, superseded_blob) =
+ if let Some(upgraded_blob) = upgraded_blob {
+ match (km_blob.take_value(), super_key.as_ref()) {
+ (BlobValue::Encrypted { iv, tag, data }, Some(super_key)) => {
+ let super_key_id = self
+ .get_super_key_id_check_unlockable_or_delete(uid, alias)
+ .context(ks_err!("How is there a super key but no super key id?"))?;
- let mut superseded_metadata = BlobMetaData::new();
- superseded_metadata.add(BlobMetaEntry::Iv(iv.to_vec()));
- superseded_metadata.add(BlobMetaEntry::AeadTag(tag.to_vec()));
- superseded_metadata
- .add(BlobMetaEntry::EncryptedBy(EncryptedBy::KeyId(super_key_id)));
- superseded_metadata.add(BlobMetaEntry::KmUuid(km_uuid));
- let superseded_blob = (LegacyBlob::Vec(data), superseded_metadata);
+ let mut superseded_metadata = BlobMetaData::new();
+ superseded_metadata.add(BlobMetaEntry::Iv(iv.to_vec()));
+ superseded_metadata.add(BlobMetaEntry::AeadTag(tag.to_vec()));
+ superseded_metadata
+ .add(BlobMetaEntry::EncryptedBy(EncryptedBy::KeyId(super_key_id)));
+ superseded_metadata.add(BlobMetaEntry::KmUuid(km_uuid));
+ let superseded_blob = (LegacyBlob::Vec(data), superseded_metadata);
- let (data, iv, tag) = super_key.encrypt(&upgraded_blob).context(
- "In characteristics_file_to_cache: \
- Failed to encrypt upgraded key blob.",
- )?;
- (
- Blob::new(flags, BlobValue::Encrypted { data, iv, tag }),
- Some(superseded_blob),
- )
+ let (data, iv, tag) = super_key
+ .encrypt(&upgraded_blob)
+ .context(ks_err!("Failed to encrypt upgraded key blob."))?;
+ (
+ Blob::new(flags, BlobValue::Encrypted { data, iv, tag }),
+ Some(superseded_blob),
+ )
+ }
+ (BlobValue::Encrypted { .. }, None) => {
+ return Err(Error::sys()).context(ks_err!(
+ "This should not be reachable. \
+ The blob could not have been decrypted above."
+ ));
+ }
+ (BlobValue::Decrypted(data), _) => {
+ let mut superseded_metadata = BlobMetaData::new();
+ superseded_metadata.add(BlobMetaEntry::KmUuid(km_uuid));
+ let superseded_blob = (LegacyBlob::ZVec(data), superseded_metadata);
+ (
+ Blob::new(
+ flags,
+ BlobValue::Decrypted(upgraded_blob.try_into().context(ks_err!(
+ "Failed to convert upgraded blob to ZVec."
+ ))?),
+ ),
+ Some(superseded_blob),
+ )
+ }
+ _ => {
+ return Err(Error::sys()).context(ks_err!(
+ "This should not be reachable. \
+ Any other variant should have resulted in a different error."
+ ));
+ }
}
- (BlobValue::Encrypted { .. }, None) => {
- return Err(Error::sys()).context(
- "In characteristics_file_to_cache: This should not be reachable. \
- The blob could not have been decrypted above.",
- );
- }
- (BlobValue::Decrypted(data), _) => {
- let mut superseded_metadata = BlobMetaData::new();
- superseded_metadata.add(BlobMetaEntry::KmUuid(km_uuid));
- let superseded_blob = (LegacyBlob::ZVec(data), superseded_metadata);
- (
- Blob::new(
- flags,
- BlobValue::Decrypted(upgraded_blob.try_into().context(
- "In characteristics_file_to_cache: \
- Failed to convert upgraded blob to ZVec.",
- )?),
- ),
- Some(superseded_blob),
- )
- }
- _ => {
- return Err(Error::sys()).context(
- "In characteristics_file_to_cache: This should not be reachable. \
- Any other variant should have resulted in a different error.",
- )
- }
- }
- } else {
- (km_blob, None)
- };
+ } else {
+ (km_blob, None)
+ };
let params =
augment_legacy_characteristics_file_with_key_characteristics(km_params, params);
@@ -595,10 +584,10 @@
super_key: Option<Arc<dyn AesGcm>>,
) -> Result<()> {
let alias = key.alias.clone().ok_or_else(|| {
- anyhow::anyhow!(Error::sys()).context(
- "In check_and_import: Must be Some because \
- our caller must not have called us otherwise.",
- )
+ anyhow::anyhow!(Error::sys()).context(ks_err!(
+ "Must be Some because \
+ our caller must not have called us otherwise."
+ ))
})?;
if self.recently_imported.contains(&RecentImport::new(uid, alias.clone())) {
@@ -632,11 +621,11 @@
e
}
})
- .context("In check_and_import: Trying to load legacy blob.")?;
+ .context(ks_err!("Trying to load legacy blob."))?;
let (km_blob_params, superseded_blob) = self
.characteristics_file_to_cache(km_blob_params, &super_key, uid, &alias)
- .context("In check_and_import: Trying to update legacy charateristics.")?;
+ .context(ks_err!("Trying to update legacy characteristics."))?;
let result = match km_blob_params {
Some((km_blob, params)) => {
@@ -647,7 +636,7 @@
// Get super key id for user id.
let super_key_id = self
.get_super_key_id_check_unlockable_or_delete(uid, &alias)
- .context("In check_and_import: Failed to get super key id.")?;
+ .context(ks_err!("Failed to get super key id."))?;
let mut blob_metadata = BlobMetaData::new();
blob_metadata.add(BlobMetaEntry::Iv(iv.to_vec()));
@@ -659,18 +648,17 @@
BlobValue::Decrypted(data) => (LegacyBlob::ZVec(data), BlobMetaData::new()),
_ => {
return Err(Error::Rc(ResponseCode::KEY_NOT_FOUND))
- .context("In check_and_import: Legacy key has unexpected type.")
+ .context(ks_err!("Legacy key has unexpected type."));
}
};
- let km_uuid = self
- .get_km_uuid(is_strongbox)
- .context("In check_and_import: Trying to get KM UUID")?;
+ let km_uuid =
+ self.get_km_uuid(is_strongbox).context(ks_err!("Trying to get KM UUID"))?;
blob_metadata.add(BlobMetaEntry::KmUuid(km_uuid));
let mut metadata = KeyMetaData::new();
- let creation_date = DateTime::now()
- .context("In check_and_import: Trying to make creation time.")?;
+ let creation_date =
+ DateTime::now().context(ks_err!("Trying to make creation time."))?;
metadata.add(KeyMetaEntry::CreationDate(creation_date));
let blob_info = BlobInfo::new_with_superseded(
@@ -689,18 +677,18 @@
&metadata,
&km_uuid,
)
- .context("In check_and_import.")?;
+ .context(ks_err!())?;
Ok(())
}
None => {
if let Some(ca_cert) = ca_cert {
self.db
.store_new_certificate(&key, KeyType::Client, &ca_cert, &KEYSTORE_UUID)
- .context("In check_and_import: Failed to insert new certificate.")?;
+ .context(ks_err!("Failed to insert new certificate."))?;
Ok(())
} else {
Err(Error::Rc(ResponseCode::KEY_NOT_FOUND))
- .context("In check_and_import: Legacy key not found.")
+ .context(ks_err!("Legacy key not found."))
}
}
};
@@ -712,7 +700,7 @@
// Delete legacy key from the file system
self.legacy_loader
.remove_keystore_entry(uid, &alias)
- .context("In check_and_import: Trying to remove imported key.")?;
+ .context(ks_err!("Trying to remove imported key."))?;
Ok(())
}
Err(e) => Err(e),
@@ -727,11 +715,11 @@
if let Some(super_key) = self
.legacy_loader
.load_super_key(user_id, pw)
- .context("In check_and_import_super_key: Trying to load legacy super key.")?
+ .context(ks_err!("Trying to load legacy super key."))?
{
let (blob, blob_metadata) =
crate::super_key::SuperKeyManager::encrypt_with_password(&super_key, pw)
- .context("In check_and_import_super_key: Trying to encrypt super key.")?;
+ .context(ks_err!("Trying to encrypt super key."))?;
self.db
.store_super_key(
@@ -741,16 +729,12 @@
&blob_metadata,
&KeyMetaData::new(),
)
- .context(concat!(
- "In check_and_import_super_key: ",
- "Trying to insert legacy super_key into the database."
- ))?;
+ .context(ks_err!("Trying to insert legacy super_key into the database."))?;
self.legacy_loader.remove_super_key(user_id);
self.recently_imported_super_key.insert(user_id);
Ok(())
} else {
- Err(Error::Rc(ResponseCode::KEY_NOT_FOUND))
- .context("In check_and_import_super_key: No key found do import.")
+ Err(Error::Rc(ResponseCode::KEY_NOT_FOUND)).context(ks_err!("No key found do import."))
}
}
@@ -765,7 +749,7 @@
BulkDeleteRequest::Uid(uid) => (
self.legacy_loader
.list_keystore_entries_for_uid(uid)
- .context("In bulk_delete: Trying to get aliases for uid.")
+ .context(ks_err!("Trying to get aliases for uid."))
.map(|aliases| {
let mut h = HashMap::<u32, HashSet<String>>::new();
h.insert(uid, aliases.into_iter().collect());
@@ -776,7 +760,7 @@
BulkDeleteRequest::User(user_id) => (
self.legacy_loader
.list_keystore_entries_for_user(user_id)
- .context("In bulk_delete: Trying to get aliases for user_id.")?,
+ .context(ks_err!("Trying to get aliases for user_id."))?,
user_id,
),
};
@@ -784,7 +768,7 @@
let super_key_id = self
.db
.load_super_key(&USER_SUPER_KEY, user_id)
- .context("In bulk_delete: Failed to load super key")?
+ .context(ks_err!("Failed to load super key"))?
.map(|(_, entry)| entry.id());
for (uid, alias) in aliases
@@ -794,7 +778,7 @@
let (km_blob_params, _, _) = self
.legacy_loader
.load_by_uid_alias(uid, &alias, &None)
- .context("In bulk_delete: Trying to load legacy blob.")?;
+ .context(ks_err!("Trying to load legacy blob."))?;
// Determine if the key needs special handling to be deleted.
let (need_gc, is_super_encrypted) = km_blob_params
@@ -848,16 +832,16 @@
};
if let Some((blob, blob_metadata)) = mark_deleted {
- self.db.set_deleted_blob(&blob, &blob_metadata).context(concat!(
- "In bulk_delete: Trying to insert deleted ",
- "blob into the database for garbage collection."
+ self.db.set_deleted_blob(&blob, &blob_metadata).context(ks_err!(
+ "Trying to insert deleted \
+ blob into the database for garbage collection."
))?;
}
}
self.legacy_loader
.remove_keystore_entry(uid, &alias)
- .context("In bulk_delete: Trying to remove imported key.")?;
+ .context(ks_err!("Trying to remove imported key."))?;
}
Ok(())
}
@@ -926,18 +910,18 @@
blob: &[u8],
) -> Result<(Vec<KeyParameter>, Option<Vec<u8>>)> {
let (km_dev, _) = crate::globals::get_keymint_dev_by_uuid(uuid)
- .with_context(|| format!("In foo: Trying to get km device for id {:?}", uuid))?;
+ .with_context(|| ks_err!("Trying to get km device for id {:?}", uuid))?;
let (characteristics, upgraded_blob) = upgrade_keyblob_if_required_with(
&*km_dev,
blob,
&[],
|blob| {
- let _wd = wd::watch_millis("In foo: Calling GetKeyCharacteristics.", 500);
+ let _wd = wd::watch_millis("Calling GetKeyCharacteristics.", 500);
map_km_error(km_dev.getKeyCharacteristics(blob, &[], &[]))
},
|_| Ok(()),
)
- .context("In foo.")?;
+ .context(ks_err!())?;
Ok((key_characteristics_to_internal(characteristics), upgraded_blob))
}
diff --git a/keystore2/src/lib.rs b/keystore2/src/lib.rs
index 4a23843..0b830be 100644
--- a/keystore2/src/lib.rs
+++ b/keystore2/src/lib.rs
@@ -28,6 +28,7 @@
pub mod id_rotation;
/// Internal Representation of Key Parameter and convenience functions.
pub mod key_parameter;
+pub mod ks_err;
pub mod legacy_blob;
pub mod legacy_importer;
pub mod maintenance;
diff --git a/keystore2/src/maintenance.rs b/keystore2/src/maintenance.rs
index 1fca5d9..5efb798 100644
--- a/keystore2/src/maintenance.rs
+++ b/keystore2/src/maintenance.rs
@@ -20,6 +20,7 @@
use crate::error::Error;
use crate::globals::get_keymint_device;
use crate::globals::{DB, LEGACY_IMPORTER, SUPER_KEY};
+use crate::ks_err;
use crate::permission::{KeyPerm, KeystorePerm};
use crate::super_key::{SuperKeyManager, UserState};
use crate::utils::{
@@ -71,8 +72,7 @@
fn on_user_password_changed(user_id: i32, password: Option<Password>) -> Result<()> {
// Check permission. Function should return if this failed. Therefore having '?' at the end
// is very important.
- check_keystore_permission(KeystorePerm::ChangePassword)
- .context("In on_user_password_changed.")?;
+ check_keystore_permission(KeystorePerm::ChangePassword).context(ks_err!())?;
let mut skm = SUPER_KEY.write().unwrap();
@@ -80,7 +80,7 @@
DB.with(|db| {
skm.unlock_screen_lock_bound_key(&mut db.borrow_mut(), user_id as u32, pw)
})
- .context("In on_user_password_changed: unlock_screen_lock_bound_key failed")?;
+ .context(ks_err!("unlock_screen_lock_bound_key failed"))?;
}
match DB
@@ -92,12 +92,11 @@
password.as_ref(),
)
})
- .context("In on_user_password_changed.")?
+ .context(ks_err!())?
{
UserState::LskfLocked => {
// Error - password can not be changed when the device is locked
- Err(Error::Rc(ResponseCode::LOCKED))
- .context("In on_user_password_changed. Device is locked.")
+ Err(Error::Rc(ResponseCode::LOCKED)).context(ks_err!("Device is locked."))
}
_ => {
// LskfLocked is the only error case for password change
@@ -109,7 +108,7 @@
fn add_or_remove_user(&self, user_id: i32) -> Result<()> {
// Check permission. Function should return if this failed. Therefore having '?' at the end
// is very important.
- check_keystore_permission(KeystorePerm::ChangeUser).context("In add_or_remove_user.")?;
+ check_keystore_permission(KeystorePerm::ChangeUser).context(ks_err!())?;
DB.with(|db| {
SUPER_KEY.write().unwrap().reset_user(
@@ -119,10 +118,10 @@
false,
)
})
- .context("In add_or_remove_user: Trying to delete keys from db.")?;
+ .context(ks_err!("Trying to delete keys from db."))?;
self.delete_listener
.delete_user(user_id as u32)
- .context("In add_or_remove_user: While invoking the delete listener.")
+ .context(ks_err!("While invoking the delete listener."))
}
fn clear_namespace(&self, domain: Domain, nspace: i64) -> Result<()> {
@@ -131,12 +130,12 @@
LEGACY_IMPORTER
.bulk_delete_uid(domain, nspace)
- .context("In clear_namespace: Trying to delete legacy keys.")?;
+ .context(ks_err!("Trying to delete legacy keys."))?;
DB.with(|db| db.borrow_mut().unbind_keys_for_namespace(domain, nspace))
- .context("In clear_namespace: Trying to delete keys from db.")?;
+ .context(ks_err!("Trying to delete keys from db."))?;
self.delete_listener
.delete_namespace(domain, nspace)
- .context("In clear_namespace: While invoking the delete listener.")
+ .context(ks_err!("While invoking the delete listener."))
}
fn get_state(user_id: i32) -> Result<AidlUserState> {
@@ -151,7 +150,7 @@
user_id as u32,
)
})
- .context("In get_state. Trying to get UserState.")?;
+ .context(ks_err!("Trying to get UserState."))?;
match state {
UserState::Uninitialized => Ok(AidlUserState::UNINITIALIZED),
@@ -164,13 +163,13 @@
where
F: Fn(Strong<dyn IKeyMintDevice>) -> binder::Result<()>,
{
- let (km_dev, _, _) = get_keymint_device(&sec_level)
- .context("In call_with_watchdog: getting keymint device")?;
+ let (km_dev, _, _) =
+ get_keymint_device(&sec_level).context(ks_err!("getting keymint device"))?;
let _wp = wd::watch_millis_with("In call_with_watchdog", 500, move || {
format!("Seclevel: {:?} Op: {}", sec_level, name)
});
- map_km_error(op(km_dev)).with_context(|| format!("In keymint device: calling {}", name))?;
+ map_km_error(op(km_dev)).with_context(|| ks_err!("calling {}", name))?;
Ok(())
}
@@ -203,7 +202,7 @@
fn early_boot_ended() -> Result<()> {
check_keystore_permission(KeystorePerm::EarlyBootEnded)
- .context("In early_boot_ended. Checking permission")?;
+ .context(ks_err!("Checking permission"))?;
log::info!("In early_boot_ended.");
if let Err(e) =
@@ -216,7 +215,7 @@
fn on_device_off_body() -> Result<()> {
// Security critical permission check. This statement must return on fail.
- check_keystore_permission(KeystorePerm::ReportOffBody).context("In on_device_off_body.")?;
+ check_keystore_permission(KeystorePerm::ReportOffBody).context(ks_err!())?;
DB.with(|db| db.borrow_mut().update_last_off_body(MonotonicRawTime::now()));
Ok(())
@@ -228,20 +227,16 @@
match source.domain {
Domain::SELINUX | Domain::KEY_ID | Domain::APP => (),
_ => {
- return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT)).context(
- "In migrate_key_namespace: \
- Source domain must be one of APP, SELINUX, or KEY_ID.",
- )
+ return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT))
+ .context(ks_err!("Source domain must be one of APP, SELINUX, or KEY_ID."));
}
};
match destination.domain {
Domain::SELINUX | Domain::APP => (),
_ => {
- return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT)).context(
- "In migrate_key_namespace: \
- Destination domain must be one of APP or SELINUX.",
- )
+ return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT))
+ .context(ks_err!("Destination domain must be one of APP or SELINUX."));
}
};
@@ -264,7 +259,7 @@
},
)
})
- .context("In migrate_key_namespace: Failed to load key blob.")?;
+ .context(ks_err!("Failed to load key blob."))?;
{
db.borrow_mut().migrate_key_namespace(key_id_guard, destination, calling_uid, |k| {
check_key_permission(KeyPerm::Rebind, k, &None)
@@ -276,7 +271,7 @@
fn delete_all_keys() -> Result<()> {
// Security critical permission check. This statement must return on fail.
check_keystore_permission(KeystorePerm::DeleteAllKeys)
- .context("In delete_all_keys. Checking permission")?;
+ .context(ks_err!("Checking permission"))?;
log::info!("In delete_all_keys.");
Maintenance::call_on_all_security_levels("deleteAllKeys", |dev| dev.deleteAllKeys())
diff --git a/keystore2/src/metrics.rs b/keystore2/src/metrics.rs
index 3d8d6d3..cd1cd75 100644
--- a/keystore2/src/metrics.rs
+++ b/keystore2/src/metrics.rs
@@ -15,6 +15,7 @@
//! This module implements the IKeystoreMetrics AIDL interface, which exposes the API method for the
//! proxy in the system server to pull the aggregated metrics in keystore.
use crate::error::map_or_log_err;
+use crate::ks_err;
use crate::metrics_store::METRICS_STORE;
use crate::permission::KeystorePerm;
use crate::utils::{check_keystore_permission, watchdog as wd};
@@ -41,7 +42,7 @@
fn pull_metrics(&self, atom_id: AtomID) -> Result<Vec<KeystoreAtom>> {
// Check permission. Function should return if this failed. Therefore having '?' at the end
// is very important.
- check_keystore_permission(KeystorePerm::PullMetrics).context("In pull_metrics.")?;
+ check_keystore_permission(KeystorePerm::PullMetrics).context(ks_err!())?;
METRICS_STORE.get_atoms(atom_id)
}
}
diff --git a/keystore2/src/metrics_store.rs b/keystore2/src/metrics_store.rs
index 5e88052..6043612 100644
--- a/keystore2/src/metrics_store.rs
+++ b/keystore2/src/metrics_store.rs
@@ -20,6 +20,7 @@
use crate::error::{get_error_code, Error};
use crate::globals::DB;
use crate::key_parameter::KeyParameterValue as KsKeyParamValue;
+use crate::ks_err;
use crate::operation::Outcome;
use crate::remote_provisioning::get_pool_status;
use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
@@ -566,9 +567,9 @@
let expired_by = SystemTime::now()
.checked_add(Duration::from_secs(60 * 60 * 24 * 3))
.ok_or(Error::Rc(ResponseCode::SYSTEM_ERROR))
- .context("In pull_attestation_pool_stats: Failed to compute expired by system time.")?
+ .context(ks_err!("Failed to compute expired by system time."))?
.duration_since(UNIX_EPOCH)
- .context("In pull_attestation_pool_stats: Failed to compute expired by duration.")?
+ .context(ks_err!("Failed to compute expired by duration."))?
.as_millis() as i64;
let result = get_pool_status(expired_by, *sec_level);
@@ -651,8 +652,8 @@
/// Read the system property: keystore.crash_count.
pub fn read_keystore_crash_count() -> Result<i32> {
rustutils::system_properties::read("keystore.crash_count")
- .context("In read_keystore_crash_count: Failed read property.")?
- .context("In read_keystore_crash_count: Property not set.")?
+ .context(ks_err!("Failed read property."))?
+ .context(ks_err!("Property not set."))?
.parse::<i32>()
.map_err(std::convert::Into::into)
}
diff --git a/keystore2/src/operation.rs b/keystore2/src/operation.rs
index 4f33ba6..58f3985 100644
--- a/keystore2/src/operation.rs
+++ b/keystore2/src/operation.rs
@@ -127,6 +127,7 @@
use crate::enforcements::AuthInfo;
use crate::error::{map_err_with, map_km_error, map_or_log_err, Error, ErrorCode, ResponseCode};
+use crate::ks_err;
use crate::metrics_store::log_key_operation_event_stats;
use crate::utils::watchdog as wd;
use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
@@ -320,10 +321,8 @@
let guard = self.outcome.lock().expect("In check_active.");
match *guard {
Outcome::Unknown => Ok(guard),
- _ => Err(Error::Km(ErrorCode::INVALID_OPERATION_HANDLE)).context(format!(
- "In check_active: Call on finalized operation with outcome: {:?}.",
- *guard
- )),
+ _ => Err(Error::Km(ErrorCode::INVALID_OPERATION_HANDLE))
+ .context(ks_err!("Call on finalized operation with outcome: {:?}.", *guard)),
}
}
@@ -358,13 +357,13 @@
.lock()
.unwrap()
.before_update()
- .context("In update_aad: Trying to get auth tokens.")?;
+ .context(ks_err!("Trying to get auth tokens."))?;
self.update_outcome(&mut *outcome, {
let _wp = wd::watch_millis("Operation::update_aad: calling updateAad", 500);
map_km_error(self.km_op.updateAad(aad_input, hat.as_ref(), tst.as_ref()))
})
- .context("In update_aad: KeyMint::update failed.")?;
+ .context(ks_err!("Update failed."))?;
Ok(())
}
@@ -381,14 +380,14 @@
.lock()
.unwrap()
.before_update()
- .context("In update: Trying to get auth tokens.")?;
+ .context(ks_err!("Trying to get auth tokens."))?;
let output = self
.update_outcome(&mut *outcome, {
let _wp = wd::watch_millis("Operation::update: calling update", 500);
map_km_error(self.km_op.update(input, hat.as_ref(), tst.as_ref()))
})
- .context("In update: KeyMint::update failed.")?;
+ .context(ks_err!("Update failed."))?;
if output.is_empty() {
Ok(None)
@@ -411,7 +410,7 @@
.lock()
.unwrap()
.before_finish()
- .context("In finish: Trying to get auth tokens.")?;
+ .context(ks_err!("Trying to get auth tokens."))?;
let output = self
.update_outcome(&mut *outcome, {
@@ -424,7 +423,7 @@
confirmation_token.as_deref(),
))
})
- .context("In finish: KeyMint::finish failed.")?;
+ .context(ks_err!("Finish failed."))?;
self.auth_info.lock().unwrap().after_finish().context("In finish.")?;
@@ -447,7 +446,7 @@
{
let _wp = wd::watch_millis("Operation::abort: calling abort", 500);
- map_km_error(self.km_op.abort()).context("In abort: KeyMint::abort failed.")
+ map_km_error(self.km_op.abort()).context(ks_err!("KeyMint::abort failed."))
}
}
}
@@ -798,7 +797,7 @@
result
}
None => Err(Error::Km(ErrorCode::INVALID_OPERATION_HANDLE))
- .context("In KeystoreOperation::with_locked_operation"),
+ .context(ks_err!("KeystoreOperation::with_locked_operation")),
};
if delete_op {
@@ -811,7 +810,7 @@
result
}
Err(_) => Err(Error::Rc(ResponseCode::OPERATION_BUSY))
- .context("In KeystoreOperation::with_locked_operation"),
+ .context(ks_err!("KeystoreOperation::with_locked_operation")),
}
}
}
@@ -823,7 +822,7 @@
let _wp = wd::watch_millis("IKeystoreOperation::updateAad", 500);
map_or_log_err(
self.with_locked_operation(
- |op| op.update_aad(aad_input).context("In KeystoreOperation::updateAad"),
+ |op| op.update_aad(aad_input).context(ks_err!("KeystoreOperation::updateAad")),
false,
),
Ok,
@@ -834,7 +833,7 @@
let _wp = wd::watch_millis("IKeystoreOperation::update", 500);
map_or_log_err(
self.with_locked_operation(
- |op| op.update(input).context("In KeystoreOperation::update"),
+ |op| op.update(input).context(ks_err!("KeystoreOperation::update")),
false,
),
Ok,
@@ -848,7 +847,7 @@
let _wp = wd::watch_millis("IKeystoreOperation::finish", 500);
map_or_log_err(
self.with_locked_operation(
- |op| op.finish(input, signature).context("In KeystoreOperation::finish"),
+ |op| op.finish(input, signature).context(ks_err!("KeystoreOperation::finish")),
true,
),
Ok,
@@ -859,7 +858,7 @@
let _wp = wd::watch_millis("IKeystoreOperation::abort", 500);
map_err_with(
self.with_locked_operation(
- |op| op.abort(Outcome::Abort).context("In KeystoreOperation::abort"),
+ |op| op.abort(Outcome::Abort).context(ks_err!("KeystoreOperation::abort")),
true,
),
|e| {
diff --git a/keystore2/src/permission.rs b/keystore2/src/permission.rs
index f012c1b..d9bdf79 100644
--- a/keystore2/src/permission.rs
+++ b/keystore2/src/permission.rs
@@ -20,6 +20,7 @@
use crate::error::Error as KsError;
use crate::error::ResponseCode;
+use crate::ks_err;
use android_system_keystore2::aidl::android::system::keystore2::{
Domain::Domain, KeyDescriptor::KeyDescriptor, KeyPermission::KeyPermission,
};
@@ -302,8 +303,8 @@
}
for p in access_vec.into_iter() {
- selinux::check_permission(caller_ctx, &target_context, p).context(format!(
- "check_grant_permission: check_permission failed. \
+ selinux::check_permission(caller_ctx, &target_context, p).context(ks_err!(
+ "check_permission failed. \
The caller may have tried to grant a permission that they don't possess. {:?}",
p
))?
@@ -357,10 +358,10 @@
return Err(selinux::Error::perm())
.context("Trying to access key without ownership.");
}
- getcon().context("check_key_permission: getcon failed.")?
+ getcon().context(ks_err!("getcon failed."))?
}
Domain::SELINUX => lookup_keystore2_key_context(key.nspace)
- .context("check_key_permission: Domain::SELINUX: Failed to lookup namespace.")?,
+ .context(ks_err!("Domain::SELINUX: Failed to lookup namespace."))?,
Domain::GRANT => {
match access_vector {
Some(_) => {
@@ -369,9 +370,9 @@
}
None => {
// If DOMAIN_GRANT was selected an access vector must be supplied.
- return Err(KsError::sys()).context(
+ return Err(KsError::sys()).context(ks_err!(
"Cannot check permission for Domain::GRANT without access vector.",
- );
+ ));
}
}
}
@@ -379,11 +380,12 @@
// We should never be called with `Domain::KEY_ID. The database
// lookup should have converted this into one of `Domain::APP`
// or `Domain::SELINUX`.
- return Err(KsError::sys()).context("Cannot check permission for Domain::KEY_ID.");
+ return Err(KsError::sys())
+ .context(ks_err!("Cannot check permission for Domain::KEY_ID.",));
}
Domain::BLOB => {
let tctx = lookup_keystore2_key_context(key.nspace)
- .context("Domain::BLOB: Failed to lookup namespace.")?;
+ .context(ks_err!("Domain::BLOB: Failed to lookup namespace."))?;
// If DOMAIN_KEY_BLOB was specified, we check for the "manage_blob"
// permission in addition to the requested permission.
selinux::check_permission(caller_ctx, &tctx, KeyPerm::ManageBlob)?;
diff --git a/keystore2/src/raw_device.rs b/keystore2/src/raw_device.rs
index 4ce9dce..fe044ee 100644
--- a/keystore2/src/raw_device.rs
+++ b/keystore2/src/raw_device.rs
@@ -22,6 +22,7 @@
},
error::{map_km_error, Error, ErrorCode},
globals::get_keymint_device,
+ ks_err,
super_key::KeyBlob,
utils::{key_characteristics_to_internal, watchdog as wd, AID_KEYSTORE},
};
@@ -152,7 +153,7 @@
key_type: KeyType,
) -> Result<(KeyIdGuard, KeyEntry)> {
db.load_key_entry(key_desc, key_type, KeyEntryLoadBits::KM, AID_KEYSTORE, |_, _| Ok(()))
- .context("In lookup_from_desc: load_key_entry failed.")
+ .context(ks_err!("load_key_entry failed."))
}
/// Look up the key in the database, and return None if it is absent.
@@ -187,7 +188,7 @@
// - because it avoids holding database locks during slow
// KeyMint operations
let lookup = Self::not_found_is_none(Self::lookup_from_desc(db, key_desc, key_type))
- .context("In lookup_or_generate_key: first lookup failed")?;
+ .context(ks_err!("first lookup failed"))?;
if let Some((key_id_guard, mut key_entry)) = lookup {
// If the key is associated with a different km instance
@@ -220,7 +221,7 @@
})
},
)
- .context("In lookup_or_generate_key: calling getKeyCharacteristics")?;
+ .context(ks_err!("calling getKeyCharacteristics"))?;
if validate_characteristics(&key_characteristics) {
return Ok((key_id_guard, key_blob));
@@ -234,7 +235,7 @@
self.create_and_store_key(db, key_desc, key_type, |km_dev| {
km_dev.generateKey(params, None)
})
- .context("In lookup_or_generate_key: generate_and_store_key failed")?;
+ .context(ks_err!("generate_and_store_key failed"))?;
Self::lookup_from_desc(db, key_desc, key_type)
.and_then(|(key_id_guard, mut key_entry)| {
Ok((
@@ -246,7 +247,7 @@
.context("Missing key blob info.")?,
))
})
- .context("In lookup_or_generate_key: second lookup failed")
+ .context(ks_err!("second lookup failed"))
}
/// Call the passed closure; if it returns `KEY_REQUIRES_UPGRADE`, call upgradeKey, and
@@ -270,7 +271,7 @@
);
self.km_dev.upgradeKey(&key_blob, &[])
})
- .context("In upgrade_keyblob_if_required_with: Upgrade failed")?;
+ .context(ks_err!("Upgrade failed"))?;
let mut new_blob_metadata = BlobMetaData::new();
new_blob_metadata.add(BlobMetaEntry::KmUuid(self.km_uuid));
@@ -281,22 +282,14 @@
Some(&upgraded_blob),
Some(&new_blob_metadata),
)
- .context(concat!(
- "In upgrade_keyblob_if_required_with: ",
- "Failed to insert upgraded blob into the database"
- ))?;
+ .context(ks_err!("Failed to insert upgraded blob into the database"))?;
Ok((
- f(&upgraded_blob).context(
- "In upgrade_keyblob_if_required_with: Closure failed after upgrade",
- )?,
+ f(&upgraded_blob).context(ks_err!("Closure failed after upgrade"))?,
KeyBlob::NonSensitive(upgraded_blob),
))
}
- result => Ok((
- result.context("In upgrade_keyblob_if_required_with: Closure failed")?,
- key_blob,
- )),
+ result => Ok((result.context(ks_err!("Closure failed"))?, key_blob)),
}
}
@@ -322,15 +315,13 @@
self.km_dev.begin(purpose, blob, operation_parameters, auth_token)
})
})
- .context("In use_key_in_one_step: Failed to begin operation.")?;
- let operation: Strong<dyn IKeyMintOperation> = begin_result
- .operation
- .ok_or_else(Error::sys)
- .context("In use_key_in_one_step: Operation missing")?;
+ .context(ks_err!("Failed to begin operation."))?;
+ let operation: Strong<dyn IKeyMintOperation> =
+ begin_result.operation.ok_or_else(Error::sys).context(ks_err!("Operation missing"))?;
map_km_error({
let _wp = wd::watch_millis("In use_key_in_one_step: calling: finish", 500);
operation.finish(Some(input), None, None, None, None)
})
- .context("In use_key_in_one_step: Failed to finish operation.")
+ .context(ks_err!("Failed to finish operation."))
}
}
diff --git a/keystore2/src/remote_provisioning.rs b/keystore2/src/remote_provisioning.rs
index 8ed2be4..0331295 100644
--- a/keystore2/src/remote_provisioning.rs
+++ b/keystore2/src/remote_provisioning.rs
@@ -48,6 +48,7 @@
use crate::database::{CertificateChain, KeyIdGuard, KeystoreDB, Uuid};
use crate::error::{self, map_or_log_err, map_rem_prov_error, Error};
use crate::globals::{get_keymint_device, get_remotely_provisioned_component, DB};
+use crate::ks_err;
use crate::metrics_store::log_rkp_error_stats;
use crate::permission::KeystorePerm;
use crate::utils::{check_keystore_permission, watchdog as wd};
@@ -174,10 +175,7 @@
issuerSubjectName: parse_subject_from_certificate(
&cert_chain.batch_cert,
)
- .context(concat!(
- "In get_remote_provisioning_key_and_certs: Failed to ",
- "parse subject."
- ))?,
+ .context(ks_err!("Failed to parse subject."))?,
},
Certificate { encodedCertificate: cert_chain.cert_chain },
))),
@@ -202,9 +200,9 @@
if let Some(dev) = self.device_by_sec_level.get(sec_level) {
Ok(dev.as_ref())
} else {
- Err(error::Error::sys()).context(concat!(
- "In get_dev_by_sec_level: Remote instance for requested security level",
- " not found."
+ Err(error::Error::sys()).context(ks_err!(
+ "Remote instance for requested security level \
+ not found.",
))
}
}
@@ -213,11 +211,11 @@
pub fn new_native_binder() -> Result<Strong<dyn IRemoteProvisioning>> {
let mut result: Self = Default::default();
let dev = get_remotely_provisioned_component(&SecurityLevel::TRUSTED_ENVIRONMENT)
- .context("In new_native_binder: Failed to get TEE Remote Provisioner instance.")?;
+ .context(ks_err!("Failed to get TEE Remote Provisioner instance."))?;
result.curve_by_sec_level.insert(
SecurityLevel::TRUSTED_ENVIRONMENT,
dev.getHardwareInfo()
- .context("In new_native_binder: Failed to get hardware info for the TEE.")?
+ .context(ks_err!("Failed to get hardware info for the TEE."))?
.supportedEekCurve,
);
result.device_by_sec_level.insert(SecurityLevel::TRUSTED_ENVIRONMENT, dev);
@@ -225,7 +223,7 @@
result.curve_by_sec_level.insert(
SecurityLevel::STRONGBOX,
dev.getHardwareInfo()
- .context("In new_native_binder: Failed to get hardware info for StrongBox.")?
+ .context(ks_err!("Failed to get hardware info for StrongBox."))?
.supportedEekCurve,
);
result.device_by_sec_level.insert(SecurityLevel::STRONGBOX, dev);
@@ -234,23 +232,24 @@
}
fn extract_payload_from_cose_mac(data: &[u8]) -> Result<Value> {
- let cose_mac0: Vec<Value> = serde_cbor::from_slice(data).context(
- "In extract_payload_from_cose_mac: COSE_Mac0 returned from IRPC cannot be parsed",
- )?;
+ let cose_mac0: Vec<Value> = serde_cbor::from_slice(data)
+ .context(ks_err!("COSE_Mac0 returned from IRPC cannot be parsed"))?;
if cose_mac0.len() != COSE_MAC0_LEN {
- return Err(error::Error::sys()).context(format!(
- "In extract_payload_from_cose_mac: COSE_Mac0 has improper length. \
+ return Err(error::Error::sys()).context(ks_err!(
+ "COSE_Mac0 has improper length. \
Expected: {}, Actual: {}",
COSE_MAC0_LEN,
cose_mac0.len(),
));
}
match &cose_mac0[COSE_MAC0_PAYLOAD] {
- Value::Bytes(key) => Ok(serde_cbor::from_slice(key)
- .context("In extract_payload_from_cose_mac: COSE_Mac0 payload is malformed.")?),
- _ => Err(error::Error::sys()).context(
- "In extract_payload_from_cose_mac: COSE_Mac0 payload is the wrong type.",
- )?,
+ Value::Bytes(key) => {
+ Ok(serde_cbor::from_slice(key)
+ .context(ks_err!("COSE_Mac0 payload is malformed."))?)
+ }
+ _ => {
+ Err(error::Error::sys()).context(ks_err!("COSE_Mac0 payload is the wrong type."))?
+ }
}
}
@@ -291,17 +290,17 @@
device_info,
protected_data,
))
- .context("In generate_csr: Failed to generate csr")?;
+ .context(ks_err!("Failed to generate csr"))?;
let mut mac_and_keys: Vec<Value> = vec![Value::from(mac)];
for maced_public_key in keys_to_sign {
mac_and_keys.push(
Self::extract_payload_from_cose_mac(&maced_public_key.macedKey)
- .context("In generate_csr: Failed to get the payload from the COSE_Mac0")?,
+ .context(ks_err!("Failed to get the payload from the COSE_Mac0"))?,
)
}
let cbor_array: Value = Value::Array(mac_and_keys);
serde_cbor::to_vec(&cbor_array)
- .context("In generate_csr: Failed to serialize the mac and keys array")
+ .context(ks_err!("Failed to serialize the mac and keys array"))
}
/// Provisions a certificate chain for a key whose CSR was included in generate_csr. The
@@ -329,28 +328,27 @@
}
fn parse_cose_mac0_for_coords(data: &[u8]) -> Result<Vec<u8>> {
- let cose_mac0: Vec<Value> = serde_cbor::from_slice(data).context(
- "In parse_cose_mac0_for_coords: COSE_Mac0 returned from IRPC cannot be parsed",
- )?;
+ let cose_mac0: Vec<Value> = serde_cbor::from_slice(data)
+ .context(ks_err!("COSE_Mac0 returned from IRPC cannot be parsed"))?;
if cose_mac0.len() != COSE_MAC0_LEN {
- return Err(error::Error::sys()).context(format!(
- "In parse_cose_mac0_for_coords: COSE_Mac0 has improper length. \
+ return Err(error::Error::sys()).context(ks_err!(
+ "COSE_Mac0 has improper length. \
Expected: {}, Actual: {}",
COSE_MAC0_LEN,
cose_mac0.len(),
));
}
let cose_key: BTreeMap<Value, Value> = match &cose_mac0[COSE_MAC0_PAYLOAD] {
- Value::Bytes(key) => serde_cbor::from_slice(key)
- .context("In parse_cose_mac0_for_coords: COSE_Key is malformed.")?,
- _ => Err(error::Error::sys())
- .context("In parse_cose_mac0_for_coords: COSE_Mac0 payload is the wrong type.")?,
+ Value::Bytes(key) => {
+ serde_cbor::from_slice(key).context(ks_err!("COSE_Key is malformed."))?
+ }
+ _ => {
+ Err(error::Error::sys()).context(ks_err!("COSE_Mac0 payload is the wrong type."))?
+ }
};
if !cose_key.contains_key(&COSE_KEY_XCOORD) || !cose_key.contains_key(&COSE_KEY_YCOORD) {
- return Err(error::Error::sys()).context(
- "In parse_cose_mac0_for_coords: \
- COSE_Key returned from IRPC is lacking required fields",
- );
+ return Err(error::Error::sys())
+ .context(ks_err!("COSE_Key returned from IRPC is lacking required fields"));
}
let mut raw_key: Vec<u8> = vec![0; 64];
match &cose_key[&COSE_KEY_XCOORD] {
@@ -358,15 +356,15 @@
raw_key[0..32].clone_from_slice(x_coord)
}
Value::Bytes(x_coord) => {
- return Err(error::Error::sys()).context(format!(
- "In parse_cose_mac0_for_coords: COSE_Key X-coordinate is not the right length. \
+ return Err(error::Error::sys()).context(ks_err!(
+ "COSE_Key X-coordinate is not the right length. \
Expected: 32; Actual: {}",
x_coord.len()
- ))
+ ));
}
_ => {
return Err(error::Error::sys())
- .context("In parse_cose_mac0_for_coords: COSE_Key X-coordinate is not a bstr")
+ .context(ks_err!("COSE_Key X-coordinate is not a bstr"));
}
}
match &cose_key[&COSE_KEY_YCOORD] {
@@ -374,15 +372,15 @@
raw_key[32..64].clone_from_slice(y_coord)
}
Value::Bytes(y_coord) => {
- return Err(error::Error::sys()).context(format!(
- "In parse_cose_mac0_for_coords: COSE_Key Y-coordinate is not the right length. \
+ return Err(error::Error::sys()).context(ks_err!(
+ "COSE_Key Y-coordinate is not the right length. \
Expected: 32; Actual: {}",
y_coord.len()
- ))
+ ));
}
_ => {
return Err(error::Error::sys())
- .context("In parse_cose_mac0_for_coords: COSE_Key Y-coordinate is not a bstr")
+ .context(ks_err!("COSE_Key Y-coordinate is not a bstr"));
}
}
Ok(raw_key)
@@ -399,18 +397,17 @@
sec_level: SecurityLevel,
) -> Result<()> {
let (_, _, uuid) = get_keymint_device(&sec_level)?;
- let dev = self.get_dev_by_sec_level(&sec_level).context(format!(
- "In generate_key_pair: Failed to get device for security level {:?}",
- sec_level
- ))?;
+ let dev = self
+ .get_dev_by_sec_level(&sec_level)
+ .context(ks_err!("Failed to get device for security level {:?}", sec_level))?;
let mut maced_key = MacedPublicKey { macedKey: Vec::new() };
let priv_key =
map_rem_prov_error(dev.generateEcdsaP256KeyPair(is_test_mode, &mut maced_key))
- .context("In generate_key_pair: Failed to generated ECDSA keypair.")?;
+ .context(ks_err!("Failed to generated ECDSA keypair."))?;
let raw_key = Self::parse_cose_mac0_for_coords(&maced_key.macedKey)
- .context("In generate_key_pair: Failed to parse raw key")?;
+ .context(ks_err!("Failed to parse raw key"))?;
db.create_attestation_key_entry(&maced_key.macedKey, &raw_key, &priv_key, &uuid)
- .context("In generate_key_pair: Failed to insert attestation key entry")
+ .context(ks_err!("Failed to insert attestation key entry"))
}
/// Checks the security level of each available IRemotelyProvisionedComponent hal and returns
@@ -472,15 +469,15 @@
|| get_rem_prov_attest_key_helper(domain, caller_uid, db, km_uuid),
|v| Ok(Some(v)),
)
- .context(concat!(
- "In get_rem_prov_attest_key: Failed to get a key after",
- "attempting to assign one."
+ .context(ks_err!(
+ "Failed to get a key after \
+ attempting to assign one.",
))?
.map_or_else(
|| {
- Err(Error::sys()).context(concat!(
- "In get_rem_prov_attest_key: Attempted to assign a ",
- "key and failed silently. Something is very wrong."
+ Err(Error::sys()).context(ks_err!(
+ "Attempted to assign a \
+ key and failed silently. Something is very wrong.",
))
},
|(guard, cert_chain)| Ok(Some((guard, cert_chain))),
@@ -499,7 +496,7 @@
) -> Result<Option<(KeyIdGuard, CertificateChain)>> {
let guard_and_chain = db
.retrieve_attestation_key_and_cert_chain(domain, caller_uid as i64, km_uuid)
- .context("In get_rem_prov_attest_key_helper: Failed to retrieve a key + cert chain")?;
+ .context(ks_err!("Failed to retrieve a key + cert chain"))?;
match guard_and_chain {
Some((guard, cert_chain)) => Ok(Some((guard, cert_chain))),
// Either this app needs to be assigned a key, or the pool is empty. An error will
@@ -507,7 +504,7 @@
// should be nudged to provision more keys so keystore can retry.
None => {
db.assign_attestation_key(domain, caller_uid as i64, km_uuid)
- .context("In get_rem_prov_attest_key_helper: Failed to assign a key")?;
+ .context(ks_err!("Failed to assign a key"))?;
Ok(None)
}
}
@@ -625,7 +622,7 @@
let guard_and_cert_chain =
get_rem_prov_attest_key(Domain::APP, caller_uid as u32, db, &km_uuid)
- .context("In get_attestation_key")?;
+ .context(ks_err!())?;
match guard_and_cert_chain {
Some((_, chain)) => Ok(RemotelyProvisionedKey {
keyBlob: chain.private_key.to_vec(),
@@ -634,7 +631,7 @@
// It should be impossible to get `None`, but handle it just in case as a
// precaution against future behavioral changes in `get_rem_prov_attest_key`.
None => Err(error::Error::Rc(ResponseCode::OUT_OF_KEYS))
- .context("In get_attestation_key: No available attestation keys"),
+ .context(ks_err!("No available attestation keys")),
}
}
@@ -644,7 +641,7 @@
let mut result: Self = Default::default();
let dev = get_remotely_provisioned_component(&SecurityLevel::TRUSTED_ENVIRONMENT)
- .context("In new_native_binder: Failed to get TEE Remote Provisioner instance.")?;
+ .context(ks_err!("Failed to get TEE Remote Provisioner instance."))?;
if let Some(id) = dev.getHardwareInfo()?.uniqueId {
result.unique_id_to_sec_level.insert(id, SecurityLevel::TRUSTED_ENVIRONMENT);
}
diff --git a/keystore2/src/security_level.rs b/keystore2/src/security_level.rs
index 28de1ec..ae49bc8 100644
--- a/keystore2/src/security_level.rs
+++ b/keystore2/src/security_level.rs
@@ -23,6 +23,7 @@
use crate::globals::{DB, ENFORCEMENTS, LEGACY_IMPORTER, SUPER_KEY};
use crate::key_parameter::KeyParameter as KsKeyParam;
use crate::key_parameter::KeyParameterValue as KsKeyParamValue;
+use crate::ks_err;
use crate::metrics_store::log_key_creation_event_stats;
use crate::remote_provisioning::RemProvState;
use crate::super_key::{KeyBlob, SuperKeyManager};
@@ -89,7 +90,7 @@
id_rotation_state: IdRotationState,
) -> Result<(Strong<dyn IKeystoreSecurityLevel>, Uuid)> {
let (dev, hw_info, km_uuid) = get_keymint_device(&security_level)
- .context("In KeystoreSecurityLevel::new_native_binder.")?;
+ .context(ks_err!("KeystoreSecurityLevel::new_native_binder."))?;
let result = BnKeystoreSecurityLevel::new_binder(
Self {
security_level,
@@ -171,7 +172,7 @@
user_id,
&key_blob,
)
- .context("In store_new_key. Failed to handle super encryption.")?;
+ .context(ks_err!("Failed to handle super encryption."))?;
let mut key_metadata = KeyMetaData::new();
key_metadata.add(KeyMetaEntry::CreationDate(creation_date));
@@ -187,14 +188,14 @@
&key_metadata,
&self.km_uuid,
)
- .context("In store_new_key.")?;
+ .context(ks_err!())?;
Ok(KeyDescriptor {
domain: Domain::KEY_ID,
nspace: key_id.id(),
..Default::default()
})
})
- .context("In store_new_key.")?,
+ .context(ks_err!())?,
};
Ok(KeyMetadata {
@@ -221,20 +222,19 @@
let (km_blob, key_properties, key_id_guard, blob_metadata) = match key.domain {
Domain::BLOB => {
check_key_permission(KeyPerm::Use, key, &None)
- .context("In create_operation: checking use permission for Domain::BLOB.")?;
+ .context(ks_err!("checking use permission for Domain::BLOB."))?;
if forced {
- check_key_permission(KeyPerm::ReqForcedOp, key, &None).context(
- "In create_operation: checking forced permission for Domain::BLOB.",
- )?;
+ check_key_permission(KeyPerm::ReqForcedOp, key, &None)
+ .context(ks_err!("checking forced permission for Domain::BLOB."))?;
}
(
match &key.blob {
Some(blob) => blob,
None => {
- return Err(Error::sys()).context(concat!(
- "In create_operation: Key blob must be specified when",
- " using Domain::BLOB."
- ))
+ return Err(Error::sys()).context(ks_err!(
+ "Key blob must be specified when \
+ using Domain::BLOB."
+ ));
}
},
None,
@@ -265,12 +265,12 @@
)
})
})
- .context("In create_operation: Failed to load key blob.")?;
+ .context(ks_err!("Failed to load key blob."))?;
let (blob, blob_metadata) =
- key_entry.take_key_blob_info().ok_or_else(Error::sys).context(concat!(
- "In create_operation: Successfully loaded key entry, ",
- "but KM blob was missing."
+ key_entry.take_key_blob_info().ok_or_else(Error::sys).context(ks_err!(
+ "Successfully loaded key entry, \
+ but KM blob was missing."
))?;
scoping_blob = blob;
@@ -285,11 +285,11 @@
let purpose = operation_parameters.iter().find(|p| p.tag == Tag::PURPOSE).map_or(
Err(Error::Km(ErrorCode::INVALID_ARGUMENT))
- .context("In create_operation: No operation purpose specified."),
+ .context(ks_err!("No operation purpose specified.")),
|kp| match kp.value {
KeyParameterValue::KeyPurpose(p) => Ok(p),
_ => Err(Error::Km(ErrorCode::INVALID_ARGUMENT))
- .context("In create_operation: Malformed KeyParameter."),
+ .context(ks_err!("Malformed KeyParameter.")),
},
)?;
@@ -306,13 +306,13 @@
operation_parameters.as_ref(),
self.hw_info.timestampTokenRequired,
)
- .context("In create_operation.")?;
+ .context(ks_err!())?;
let km_blob = SUPER_KEY
.read()
.unwrap()
.unwrap_key_if_required(&blob_metadata, km_blob)
- .context("In create_operation. Failed to handle super encryption.")?;
+ .context(ks_err!("Failed to handle super encryption."))?;
let (begin_result, upgraded_blob) = self
.upgrade_keyblob_if_required_with(
@@ -354,7 +354,7 @@
}
},
)
- .context("In create_operation: Failed to begin operation.")?;
+ .context(ks_err!("Failed to begin operation."))?;
let operation_challenge = auth_info.finalize_create_authorization(begin_result.challenge);
@@ -369,10 +369,10 @@
LoggingInfo::new(self.security_level, purpose, op_params, upgraded_blob.is_some()),
),
None => {
- return Err(Error::sys()).context(concat!(
- "In create_operation: Begin operation returned successfully, ",
- "but did not return a valid operation."
- ))
+ return Err(Error::sys()).context(ks_err!(
+ "Begin operation returned successfully, \
+ but did not return a valid operation."
+ ));
}
};
@@ -380,7 +380,7 @@
KeystoreOperation::new_native_binder(operation)
.as_binder()
.into_interface()
- .context("In create_operation: Failed to create IKeystoreOperation.")?;
+ .context(ks_err!("Failed to create IKeystoreOperation."))?;
Ok(CreateOperationResponse {
iOperation: Some(op_binder),
@@ -407,10 +407,10 @@
// Unconditionally add the CREATION_DATETIME tag and prevent callers from
// specifying it.
if params.iter().any(|kp| kp.tag == Tag::CREATION_DATETIME) {
- return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT)).context(
- "In KeystoreSecurityLevel::add_required_parameters: \
- Specifying Tag::CREATION_DATETIME is not allowed.",
- );
+ return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT)).context(ks_err!(
+ "KeystoreSecurityLevel::add_required_parameters: \
+ Specifying Tag::CREATION_DATETIME is not allowed."
+ ));
}
// Add CREATION_DATETIME only if the backend version Keymint V1 (100) or newer.
@@ -420,16 +420,16 @@
value: KeyParameterValue::DateTime(
SystemTime::now()
.duration_since(SystemTime::UNIX_EPOCH)
- .context(
- "In KeystoreSecurityLevel::add_required_parameters: \
- Failed to get epoch time.",
- )?
+ .context(ks_err!(
+ "KeystoreSecurityLevel::add_required_parameters: \
+ Failed to get epoch time."
+ ))?
.as_millis()
.try_into()
- .context(
- "In KeystoreSecurityLevel::add_required_parameters: \
- Failed to convert epoch time.",
- )?,
+ .context(ks_err!(
+ "KeystoreSecurityLevel::add_required_parameters: \
+ Failed to convert epoch time."
+ ))?,
),
});
}
@@ -441,9 +441,8 @@
"In KeystoreSecurityLevel::add_required_parameters calling: get_aaid",
500,
);
- keystore2_aaid::get_aaid(uid).map_err(|e| {
- anyhow!(format!("In add_required_parameters: get_aaid returned status {}.", e))
- })
+ keystore2_aaid::get_aaid(uid)
+ .map_err(|e| anyhow!(ks_err!("get_aaid returned status {}.", e)))
}?;
result.push(KeyParameter {
@@ -456,14 +455,15 @@
if check_key_permission(KeyPerm::GenUniqueId, key, &None).is_err()
&& check_unique_id_attestation_permissions().is_err()
{
- return Err(Error::perm()).context(
- "In add_required_parameters: \
- Caller does not have the permission to generate a unique ID",
- );
+ return Err(Error::perm()).context(ks_err!(
+ "Caller does not have the permission to generate a unique ID"
+ ));
}
- if self.id_rotation_state.had_factory_reset_since_id_rotation().context(
- "In add_required_parameters: Call to had_factory_reset_since_id_rotation failed.",
- )? {
+ if self
+ .id_rotation_state
+ .had_factory_reset_since_id_rotation()
+ .context(ks_err!("Call to had_factory_reset_since_id_rotation failed."))?
+ {
result.push(KeyParameter {
tag: Tag::RESET_SINCE_ID_ROTATION,
value: KeyParameterValue::BoolValue(true),
@@ -474,8 +474,7 @@
// If the caller requests any device identifier attestation tag, check that they hold the
// correct Android permission.
if params.iter().any(|kp| is_device_id_attestation_tag(kp.tag)) {
- check_device_attestation_permissions().context(concat!(
- "In add_required_parameters: ",
+ check_device_attestation_permissions().context(ks_err!(
"Caller does not have the permission to attest device identifiers."
))?;
}
@@ -513,7 +512,7 @@
) -> Result<KeyMetadata> {
if key.domain != Domain::BLOB && key.alias.is_none() {
return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
- .context("In generate_key: Alias must be specified");
+ .context(ks_err!("Alias must be specified"));
}
let caller_uid = ThreadState::get_calling_uid();
@@ -529,7 +528,7 @@
// generate_key requires the rebind permission.
// Must return on error for security reasons.
- check_key_permission(KeyPerm::Rebind, &key, &None).context("In generate_key.")?;
+ check_key_permission(KeyPerm::Rebind, &key, &None).context(ks_err!())?;
let attestation_key_info = match (key.domain, attest_key_descriptor) {
(Domain::BLOB, _) => None,
@@ -544,11 +543,11 @@
&mut db.borrow_mut(),
)
})
- .context("In generate_key: Trying to get an attestation key")?,
+ .context(ks_err!("Trying to get an attestation key"))?,
};
let params = self
.add_required_parameters(caller_uid, params, &key)
- .context("In generate_key: Trying to get aaid.")?;
+ .context(ks_err!("Trying to get aaid."))?;
let creation_result = match attestation_key_info {
Some(AttestationKeyInfo::UserGenerated {
@@ -581,7 +580,7 @@
})
},
)
- .context("In generate_key: Using user generated attestation key.")
+ .context(ks_err!("Using user generated attestation key."))
.map(|(result, _)| result),
Some(AttestationKeyInfo::RemoteProvisioned {
key_id_guard,
@@ -629,10 +628,10 @@
})
.context("While generating Key without explicit attestation key."),
}
- .context("In generate_key.")?;
+ .context(ks_err!())?;
let user_id = uid_to_android_user(caller_uid);
- self.store_new_key(key, creation_result, user_id, Some(flags)).context("In generate_key.")
+ self.store_new_key(key, creation_result, user_id, Some(flags)).context(ks_err!())
}
fn import_key(
@@ -645,7 +644,7 @@
) -> Result<KeyMetadata> {
if key.domain != Domain::BLOB && key.alias.is_none() {
return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
- .context("In import_key: Alias must be specified");
+ .context(ks_err!("Alias must be specified"));
}
let caller_uid = ThreadState::get_calling_uid();
@@ -664,7 +663,7 @@
let params = self
.add_required_parameters(caller_uid, params, &key)
- .context("In import_key: Trying to get aaid.")?;
+ .context(ks_err!("Trying to get aaid."))?;
let format = params
.iter()
@@ -680,7 +679,7 @@
v => Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
.context(format!("Unknown Algorithm {:?}.", v)),
})
- .context("In import_key.")?;
+ .context(ks_err!())?;
let km_dev = &self.keymint;
let creation_result = map_km_error({
@@ -688,10 +687,10 @@
self.watch_millis("In KeystoreSecurityLevel::import_key: calling importKey.", 500);
km_dev.importKey(¶ms, format, key_data, None /* attestKey */)
})
- .context("In import_key: Trying to call importKey")?;
+ .context(ks_err!("Trying to call importKey"))?;
let user_id = uid_to_android_user(caller_uid);
- self.store_new_key(key, creation_result, user_id, Some(flags)).context("In import_key.")
+ self.store_new_key(key, creation_result, user_id, Some(flags)).context(ks_err!())
}
fn import_wrapped_key(
@@ -708,20 +707,16 @@
domain: Domain::SELINUX, blob: Some(ref blob), alias: Some(_), ..
} => blob,
_ => {
- return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT)).context(format!(
- concat!(
- "In import_wrapped_key: Alias and blob must be specified ",
- "and domain must be APP or SELINUX. {:?}"
- ),
+ return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT)).context(ks_err!(
+ "Alias and blob must be specified and domain must be APP or SELINUX. {:?}",
key
- ))
+ ));
}
};
if wrapping_key.domain == Domain::BLOB {
- return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT)).context(
- "In import_wrapped_key: Import wrapped key not supported for self managed blobs.",
- );
+ return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
+ .context(ks_err!("Import wrapped key not supported for self managed blobs."));
}
let caller_uid = ThreadState::get_calling_uid();
@@ -744,7 +739,7 @@
};
// Import_wrapped_key requires the rebind permission for the new key.
- check_key_permission(KeyPerm::Rebind, &key, &None).context("In import_wrapped_key.")?;
+ check_key_permission(KeyPerm::Rebind, &key, &None).context(ks_err!())?;
let super_key = SUPER_KEY.read().unwrap().get_per_boot_key_by_user_id(user_id);
@@ -771,9 +766,7 @@
.read()
.unwrap()
.unwrap_key_if_required(&wrapping_blob_metadata, &wrapping_key_blob)
- .context(
- "In import_wrapped_key. Failed to handle super encryption for wrapping key.",
- )?;
+ .context(ks_err!("Failed to handle super encryption for wrapping key."))?;
// km_dev.importWrappedKey does not return a certificate chain.
// TODO Do we assume that all wrapped keys are symmetric?
@@ -820,10 +813,10 @@
Ok(creation_result)
},
)
- .context("In import_wrapped_key.")?;
+ .context(ks_err!())?;
self.store_new_key(key, creation_result, user_id, None)
- .context("In import_wrapped_key: Trying to store the new key.")
+ .context(ks_err!("Trying to store the new key."))
}
fn store_upgraded_keyblob(
@@ -834,7 +827,7 @@
) -> Result<()> {
let (upgraded_blob_to_be_stored, new_blob_metadata) =
SuperKeyManager::reencrypt_if_required(key_blob, upgraded_blob)
- .context("In store_upgraded_keyblob: Failed to handle super encryption.")?;
+ .context(ks_err!("Failed to handle super encryption."))?;
let mut new_blob_metadata = new_blob_metadata.unwrap_or_default();
if let Some(uuid) = km_uuid {
@@ -850,7 +843,7 @@
Some(&new_blob_metadata),
)
})
- .context("In store_upgraded_keyblob: Failed to insert upgraded blob into the database.")
+ .context(ks_err!("Failed to insert upgraded blob into the database."))
}
fn upgrade_keyblob_if_required_with<T, F>(
@@ -874,25 +867,22 @@
if key_id_guard.is_some() {
// Unwrap cannot panic, because the is_some was true.
let kid = key_id_guard.take().unwrap();
- Self::store_upgraded_keyblob(kid, km_uuid, key_blob, upgraded_blob).context(
- "In upgrade_keyblob_if_required_with: store_upgraded_keyblob failed",
- )
+ Self::store_upgraded_keyblob(kid, km_uuid, key_blob, upgraded_blob)
+ .context(ks_err!("store_upgraded_keyblob failed"))
} else {
Ok(())
}
},
)
- .context("In KeystoreSecurityLevel::upgrade_keyblob_if_required_with.")?;
+ .context(ks_err!())?;
// If no upgrade was needed, use the opportunity to reencrypt the blob if required
// and if the a key_id_guard is held. Note: key_id_guard can only be Some if no
// upgrade was performed above and if one was given in the first place.
if key_blob.force_reencrypt() {
if let Some(kid) = key_id_guard {
- Self::store_upgraded_keyblob(kid, km_uuid, key_blob, key_blob).context(concat!(
- "In upgrade_keyblob_if_required_with: ",
- "store_upgraded_keyblob failed in forced reencrypt"
- ))?;
+ Self::store_upgraded_keyblob(kid, km_uuid, key_blob, key_blob)
+ .context(ks_err!("store_upgraded_keyblob failed in forced reencrypt"))?;
}
}
Ok((v, upgraded_blob))
@@ -903,22 +893,18 @@
storage_key: &KeyDescriptor,
) -> Result<EphemeralStorageKeyResponse> {
if storage_key.domain != Domain::BLOB {
- return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT)).context(concat!(
- "In IKeystoreSecurityLevel convert_storage_key_to_ephemeral: ",
- "Key must be of Domain::BLOB"
- ));
+ return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
+ .context(ks_err!("Key must be of Domain::BLOB"));
}
let key_blob = storage_key
.blob
.as_ref()
.ok_or(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
- .context(
- "In IKeystoreSecurityLevel convert_storage_key_to_ephemeral: No key blob specified",
- )?;
+ .context(ks_err!("No key blob specified"))?;
// convert_storage_key_to_ephemeral requires the associated permission
check_key_permission(KeyPerm::ConvertStorageKeyToEphemeral, storage_key, &None)
- .context("In convert_storage_key_to_ephemeral: Check permission")?;
+ .context(ks_err!("Check permission"))?;
let km_dev = &self.keymint;
match {
@@ -942,7 +928,7 @@
);
map_km_error(km_dev.upgradeKey(key_blob, &[]))
}
- .context("In convert_storage_key_to_ephemeral: Failed to upgrade key blob.")?;
+ .context(ks_err!("Failed to upgrade key blob."))?;
let ephemeral_key = {
let _wp = self.watch_millis(
"In convert_storage_key_to_ephemeral: calling convertStorageKeyToEphemeral (2)",
@@ -950,8 +936,7 @@
);
map_km_error(km_dev.convertStorageKeyToEphemeral(&upgraded_blob))
}
- .context(concat!(
- "In convert_storage_key_to_ephemeral: ",
+ .context(ks_err!(
"Failed to retrieve ephemeral key (after upgrade)."
))?;
Ok(EphemeralStorageKeyResponse {
@@ -959,31 +944,30 @@
upgradedBlob: Some(upgraded_blob),
})
}
- Err(e) => Err(e)
- .context("In convert_storage_key_to_ephemeral: Failed to retrieve ephemeral key."),
+ Err(e) => Err(e).context(ks_err!("Failed to retrieve ephemeral key.")),
}
}
fn delete_key(&self, key: &KeyDescriptor) -> Result<()> {
if key.domain != Domain::BLOB {
return Err(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
- .context("In IKeystoreSecurityLevel delete_key: Key must be of Domain::BLOB");
+ .context(ks_err!("delete_key: Key must be of Domain::BLOB"));
}
let key_blob = key
.blob
.as_ref()
.ok_or(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
- .context("In IKeystoreSecurityLevel delete_key: No key blob specified")?;
+ .context(ks_err!("delete_key: No key blob specified"))?;
check_key_permission(KeyPerm::Delete, key, &None)
- .context("In IKeystoreSecurityLevel delete_key: Checking delete permissions")?;
+ .context(ks_err!("delete_key: Checking delete permissions"))?;
let km_dev = &self.keymint;
{
let _wp =
self.watch_millis("In KeystoreSecuritylevel::delete_key: calling deleteKey", 500);
- map_km_error(km_dev.deleteKey(key_blob)).context("In keymint device deleteKey")
+ map_km_error(km_dev.deleteKey(key_blob)).context(ks_err!("keymint device deleteKey"))
}
}
}
diff --git a/keystore2/src/service.rs b/keystore2/src/service.rs
index 8d2e5ad..a3e0fa5 100644
--- a/keystore2/src/service.rs
+++ b/keystore2/src/service.rs
@@ -18,6 +18,7 @@
use std::collections::HashMap;
use crate::audit_log::log_key_deleted;
+use crate::ks_err;
use crate::permission::{KeyPerm, KeystorePerm};
use crate::security_level::KeystoreSecurityLevel;
use crate::utils::{
@@ -265,10 +266,12 @@
nspace: ThreadState::get_calling_uid() as u64 as i64,
..Default::default()
},
- Domain::SELINUX => KeyDescriptor{domain, nspace: namespace, ..Default::default()},
- _ => return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT)).context(
- "In list_entries: List entries is only supported for Domain::APP and Domain::SELINUX."
- ),
+ Domain::SELINUX => KeyDescriptor { domain, nspace: namespace, ..Default::default() },
+ _ => {
+ return Err(Error::Rc(ResponseCode::INVALID_ARGUMENT)).context(ks_err!(
+ "List entries is only supported for Domain::APP and Domain::SELINUX."
+ ))
+ }
};
// First we check if the caller has the info permission for the selected domain/namespace.
@@ -281,12 +284,12 @@
e.root_cause().downcast_ref::<selinux::Error>()
{
check_keystore_permission(KeystorePerm::List)
- .context("In list_entries: While checking keystore permission.")?;
+ .context(ks_err!("While checking keystore permission."))?;
if namespace != -1 {
k.nspace = namespace;
}
} else {
- return Err(e).context("In list_entries: While checking key permission.")?;
+ return Err(e).context(ks_err!("While checking key permission."))?;
}
}
@@ -305,7 +308,7 @@
})
})
})
- .context("In delete_key: Trying to unbind the key.")?;
+ .context(ks_err!("Trying to unbind the key."))?;
Ok(())
}
@@ -330,7 +333,7 @@
)
})
})
- .context("In KeystoreService::grant.")
+ .context(ks_err!("KeystoreService::grant."))
}
fn ungrant(&self, key: &KeyDescriptor, grantee_uid: i32) -> Result<()> {
@@ -339,7 +342,7 @@
check_key_permission(KeyPerm::Grant, k, &None)
})
})
- .context("In KeystoreService::ungrant.")
+ .context(ks_err!("KeystoreService::ungrant."))
}
}