Implement keystore2 logging of key creation events.
This CL implements logging of key creation events via statsd.
Bug: 172013262
Test: enable keystore2 on cuttlfish, run cts tests for key generation,
run the test drive script provided by statsd and observe the logs
created.
Change-Id: Ib60ed356ce809d27f7625ab0743a9300c454f1c8
diff --git a/keystore2/src/error.rs b/keystore2/src/error.rs
index 388487c..465dcfa 100644
--- a/keystore2/src/error.rs
+++ b/keystore2/src/error.rs
@@ -196,28 +196,33 @@
result.map_or_else(
|e| {
let e = map_err(e);
- let root_cause = e.root_cause();
- let rc = match root_cause.downcast_ref::<Error>() {
- Some(Error::Rc(rcode)) => rcode.0,
- Some(Error::Km(ec)) => ec.0,
- Some(Error::Rp(_)) => ResponseCode::SYSTEM_ERROR.0,
- // If an Error::Binder reaches this stage we report a system error.
- // The exception code and possible service specific error will be
- // printed in the error log above.
- Some(Error::Binder(_, _)) | Some(Error::BinderTransaction(_)) => {
- ResponseCode::SYSTEM_ERROR.0
- }
- None => match root_cause.downcast_ref::<selinux::Error>() {
- Some(selinux::Error::PermissionDenied) => ResponseCode::PERMISSION_DENIED.0,
- _ => ResponseCode::SYSTEM_ERROR.0,
- },
- };
+ let rc = get_error_code(&e);
Err(BinderStatus::new_service_specific_error(rc, None))
},
handle_ok,
)
}
+/// Returns the error code given a reference to the error
+pub fn get_error_code(e: &anyhow::Error) -> i32 {
+ let root_cause = e.root_cause();
+ match root_cause.downcast_ref::<Error>() {
+ Some(Error::Rc(rcode)) => rcode.0,
+ Some(Error::Km(ec)) => ec.0,
+ Some(Error::Rp(_)) => ResponseCode::SYSTEM_ERROR.0,
+ // If an Error::Binder reaches this stage we report a system error.
+ // The exception code and possible service specific error will be
+ // printed in the error log above.
+ Some(Error::Binder(_, _)) | Some(Error::BinderTransaction(_)) => {
+ ResponseCode::SYSTEM_ERROR.0
+ }
+ None => match root_cause.downcast_ref::<selinux::Error>() {
+ Some(selinux::Error::PermissionDenied) => ResponseCode::PERMISSION_DENIED.0,
+ _ => ResponseCode::SYSTEM_ERROR.0,
+ },
+ }
+}
+
#[cfg(test)]
pub mod tests {
diff --git a/keystore2/src/lib.rs b/keystore2/src/lib.rs
index cb47e3e..7ece6fa 100644
--- a/keystore2/src/lib.rs
+++ b/keystore2/src/lib.rs
@@ -28,6 +28,7 @@
pub mod legacy_blob;
pub mod legacy_migrator;
pub mod maintenance;
+pub mod metrics;
pub mod operation;
pub mod permission;
pub mod remote_provisioning;
diff --git a/keystore2/src/metrics.rs b/keystore2/src/metrics.rs
new file mode 100644
index 0000000..04ad893
--- /dev/null
+++ b/keystore2/src/metrics.rs
@@ -0,0 +1,323 @@
+// Copyright 2021, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! This module provides convenience functions for keystore2 logging.
+use crate::error::get_error_code;
+use crate::key_parameter::KeyParameterValue as KsKeyParamValue;
+use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
+ Algorithm::Algorithm, BlockMode::BlockMode, Digest::Digest, EcCurve::EcCurve,
+ HardwareAuthenticatorType::HardwareAuthenticatorType, KeyOrigin::KeyOrigin,
+ KeyParameter::KeyParameter, KeyPurpose::KeyPurpose, PaddingMode::PaddingMode,
+};
+use statslog_rust::keystore2_key_creation_event_reported::{
+ Algorithm as StatsdAlgorithm, EcCurve as StatsdEcCurve, KeyOrigin as StatsdKeyOrigin,
+ Keystore2KeyCreationEventReported, UserAuthType as StatsdUserAuthType,
+};
+
+fn create_default_key_creation_atom() -> Keystore2KeyCreationEventReported {
+ // If a value is not present, fields represented by bitmaps and i32 fields
+ // will take 0, except error_code which defaults to 1 indicating NO_ERROR and key_size,
+ // and auth_time_out which default to -1.
+ // The boolean fields are set to false by default.
+ // Some keymint enums do have 0 as an enum variant value. In such cases, the corresponding
+ // enum variant value in atoms.proto is incremented by 1, in order to have 0 as the reserved
+ // value for unspecified fields.
+ Keystore2KeyCreationEventReported {
+ algorithm: StatsdAlgorithm::AlgorithmUnspecified,
+ key_size: -1,
+ key_origin: StatsdKeyOrigin::OriginUnspecified,
+ user_auth_type: StatsdUserAuthType::AuthTypeUnspecified,
+ user_auth_key_timeout_seconds: -1,
+ padding_mode_bitmap: 0,
+ digest_bitmap: 0,
+ block_mode_bitmap: 0,
+ purpose_bitmap: 0,
+ ec_curve: StatsdEcCurve::EcCurveUnspecified,
+ // as per keystore2/ResponseCode.aidl, 1 is reserved for NO_ERROR
+ error_code: 1,
+ attestation_requested: false,
+ }
+}
+
+/// Log key events via statsd API.
+pub fn log_key_creation_event_stats<U>(key_params: &[KeyParameter], result: &anyhow::Result<U>) {
+ let key_creation_event_stats = construct_key_creation_event_stats(key_params, result);
+
+ let logging_result = key_creation_event_stats.stats_write();
+
+ if let Err(e) = logging_result {
+ log::error!("In log_key_event_stats. Error in logging key event. {:?}", e);
+ }
+}
+
+// Given key parameters, event_type and result, populate the information in Keystore2KeyEventAtom.
+fn construct_key_creation_event_stats<U>(
+ key_params: &[KeyParameter],
+ result: &anyhow::Result<U>,
+) -> Keystore2KeyCreationEventReported {
+ let mut key_creation_event_atom = create_default_key_creation_atom();
+
+ if let Err(ref e) = result {
+ key_creation_event_atom.error_code = get_error_code(e);
+ }
+
+ for key_param in key_params.iter().map(KsKeyParamValue::from) {
+ match key_param {
+ KsKeyParamValue::Algorithm(a) => {
+ key_creation_event_atom.algorithm = match a {
+ Algorithm::RSA => StatsdAlgorithm::Rsa,
+ Algorithm::EC => StatsdAlgorithm::Ec,
+ Algorithm::AES => StatsdAlgorithm::Aes,
+ Algorithm::TRIPLE_DES => StatsdAlgorithm::TripleDes,
+ Algorithm::HMAC => StatsdAlgorithm::Hmac,
+ _ => StatsdAlgorithm::AlgorithmUnspecified,
+ }
+ }
+ KsKeyParamValue::KeySize(s) => {
+ key_creation_event_atom.key_size = s;
+ }
+ KsKeyParamValue::KeyOrigin(o) => {
+ key_creation_event_atom.key_origin = match o {
+ KeyOrigin::GENERATED => StatsdKeyOrigin::Generated,
+ KeyOrigin::DERIVED => StatsdKeyOrigin::Derived,
+ KeyOrigin::IMPORTED => StatsdKeyOrigin::Imported,
+ KeyOrigin::RESERVED => StatsdKeyOrigin::Reserved,
+ KeyOrigin::SECURELY_IMPORTED => StatsdKeyOrigin::SecurelyImported,
+ _ => StatsdKeyOrigin::OriginUnspecified,
+ }
+ }
+ KsKeyParamValue::HardwareAuthenticatorType(a) => {
+ key_creation_event_atom.user_auth_type = match a {
+ HardwareAuthenticatorType::NONE => StatsdUserAuthType::None,
+ HardwareAuthenticatorType::PASSWORD => StatsdUserAuthType::Password,
+ HardwareAuthenticatorType::FINGERPRINT => StatsdUserAuthType::Fingerprint,
+ HardwareAuthenticatorType::ANY => StatsdUserAuthType::Any,
+ _ => StatsdUserAuthType::AuthTypeUnspecified,
+ }
+ }
+ KsKeyParamValue::AuthTimeout(t) => {
+ key_creation_event_atom.user_auth_key_timeout_seconds = t;
+ }
+ KsKeyParamValue::PaddingMode(p) => {
+ key_creation_event_atom.padding_mode_bitmap =
+ compute_padding_mode_bitmap(&key_creation_event_atom.padding_mode_bitmap, p);
+ }
+ KsKeyParamValue::Digest(d) => {
+ key_creation_event_atom.digest_bitmap =
+ compute_digest_bitmap(&key_creation_event_atom.digest_bitmap, d);
+ }
+ KsKeyParamValue::BlockMode(b) => {
+ key_creation_event_atom.block_mode_bitmap =
+ compute_block_mode_bitmap(&key_creation_event_atom.block_mode_bitmap, b);
+ }
+ KsKeyParamValue::KeyPurpose(k) => {
+ key_creation_event_atom.purpose_bitmap =
+ compute_purpose_bitmap(&key_creation_event_atom.purpose_bitmap, k);
+ }
+ KsKeyParamValue::EcCurve(e) => {
+ key_creation_event_atom.ec_curve = match e {
+ EcCurve::P_224 => StatsdEcCurve::P224,
+ EcCurve::P_256 => StatsdEcCurve::P256,
+ EcCurve::P_384 => StatsdEcCurve::P384,
+ EcCurve::P_521 => StatsdEcCurve::P521,
+ _ => StatsdEcCurve::EcCurveUnspecified,
+ }
+ }
+ KsKeyParamValue::AttestationChallenge(_) => {
+ key_creation_event_atom.attestation_requested = true;
+ }
+ _ => {}
+ }
+ }
+ key_creation_event_atom
+}
+
+fn compute_purpose_bitmap(purpose_bitmap: &i32, purpose: KeyPurpose) -> i32 {
+ let mut bitmap = *purpose_bitmap;
+ match purpose {
+ KeyPurpose::ENCRYPT => {
+ bitmap |= 1 << KeyPurposeBitPosition::ENCRYPT_BIT_POS as i32;
+ }
+ KeyPurpose::DECRYPT => {
+ bitmap |= 1 << KeyPurposeBitPosition::DECRYPT_BIT_POS as i32;
+ }
+ KeyPurpose::SIGN => {
+ bitmap |= 1 << KeyPurposeBitPosition::SIGN_BIT_POS as i32;
+ }
+ KeyPurpose::VERIFY => {
+ bitmap |= 1 << KeyPurposeBitPosition::VERIFY_BIT_POS as i32;
+ }
+ KeyPurpose::WRAP_KEY => {
+ bitmap |= 1 << KeyPurposeBitPosition::WRAP_KEY_BIT_POS as i32;
+ }
+ KeyPurpose::AGREE_KEY => {
+ bitmap |= 1 << KeyPurposeBitPosition::AGREE_KEY_BIT_POS as i32;
+ }
+ KeyPurpose::ATTEST_KEY => {
+ bitmap |= 1 << KeyPurposeBitPosition::ATTEST_KEY_BIT_POS as i32;
+ }
+ _ => {}
+ }
+ bitmap
+}
+
+fn compute_padding_mode_bitmap(padding_mode_bitmap: &i32, padding_mode: PaddingMode) -> i32 {
+ let mut bitmap = *padding_mode_bitmap;
+ match padding_mode {
+ PaddingMode::NONE => {
+ bitmap |= 1 << PaddingModeBitPosition::NONE_BIT_POSITION as i32;
+ }
+ PaddingMode::RSA_OAEP => {
+ bitmap |= 1 << PaddingModeBitPosition::RSA_OAEP_BIT_POS as i32;
+ }
+ PaddingMode::RSA_PSS => {
+ bitmap |= 1 << PaddingModeBitPosition::RSA_PSS_BIT_POS as i32;
+ }
+ PaddingMode::RSA_PKCS1_1_5_ENCRYPT => {
+ bitmap |= 1 << PaddingModeBitPosition::RSA_PKCS1_1_5_ENCRYPT_BIT_POS as i32;
+ }
+ PaddingMode::RSA_PKCS1_1_5_SIGN => {
+ bitmap |= 1 << PaddingModeBitPosition::RSA_PKCS1_1_5_SIGN_BIT_POS as i32;
+ }
+ PaddingMode::PKCS7 => {
+ bitmap |= 1 << PaddingModeBitPosition::PKCS7_BIT_POS as i32;
+ }
+ _ => {}
+ }
+ bitmap
+}
+
+fn compute_digest_bitmap(digest_bitmap: &i32, digest: Digest) -> i32 {
+ let mut bitmap = *digest_bitmap;
+ match digest {
+ Digest::NONE => {
+ bitmap |= 1 << DigestBitPosition::NONE_BIT_POSITION as i32;
+ }
+ Digest::MD5 => {
+ bitmap |= 1 << DigestBitPosition::MD5_BIT_POS as i32;
+ }
+ Digest::SHA1 => {
+ bitmap |= 1 << DigestBitPosition::SHA_1_BIT_POS as i32;
+ }
+ Digest::SHA_2_224 => {
+ bitmap |= 1 << DigestBitPosition::SHA_2_224_BIT_POS as i32;
+ }
+ Digest::SHA_2_256 => {
+ bitmap |= 1 << DigestBitPosition::SHA_2_256_BIT_POS as i32;
+ }
+ Digest::SHA_2_384 => {
+ bitmap |= 1 << DigestBitPosition::SHA_2_384_BIT_POS as i32;
+ }
+ Digest::SHA_2_512 => {
+ bitmap |= 1 << DigestBitPosition::SHA_2_512_BIT_POS as i32;
+ }
+ _ => {}
+ }
+ bitmap
+}
+
+fn compute_block_mode_bitmap(block_mode_bitmap: &i32, block_mode: BlockMode) -> i32 {
+ let mut bitmap = *block_mode_bitmap;
+ match block_mode {
+ BlockMode::ECB => {
+ bitmap |= 1 << BlockModeBitPosition::ECB_BIT_POS as i32;
+ }
+ BlockMode::CBC => {
+ bitmap |= 1 << BlockModeBitPosition::CBC_BIT_POS as i32;
+ }
+ BlockMode::CTR => {
+ bitmap |= 1 << BlockModeBitPosition::CTR_BIT_POS as i32;
+ }
+ BlockMode::GCM => {
+ bitmap |= 1 << BlockModeBitPosition::GCM_BIT_POS as i32;
+ }
+ _ => {}
+ }
+ bitmap
+}
+/// Enum defining the bit position for each padding mode. Since padding mode can be repeatable, it
+/// is represented using a bitmap.
+#[allow(non_camel_case_types)]
+#[repr(i32)]
+pub enum PaddingModeBitPosition {
+ ///Bit position in the PaddingMode bitmap for NONE.
+ NONE_BIT_POSITION = 0,
+ ///Bit position in the PaddingMode bitmap for RSA_OAEP.
+ RSA_OAEP_BIT_POS = 1,
+ ///Bit position in the PaddingMode bitmap for RSA_PSS.
+ RSA_PSS_BIT_POS = 2,
+ ///Bit position in the PaddingMode bitmap for RSA_PKCS1_1_5_ENCRYPT.
+ RSA_PKCS1_1_5_ENCRYPT_BIT_POS = 3,
+ ///Bit position in the PaddingMode bitmap for RSA_PKCS1_1_5_SIGN.
+ RSA_PKCS1_1_5_SIGN_BIT_POS = 4,
+ ///Bit position in the PaddingMode bitmap for RSA_PKCS7.
+ PKCS7_BIT_POS = 5,
+}
+
+/// Enum defining the bit position for each digest type. Since digest can be repeatable in
+/// key parameters, it is represented using a bitmap.
+#[allow(non_camel_case_types)]
+#[repr(i32)]
+pub enum DigestBitPosition {
+ ///Bit position in the Digest bitmap for NONE.
+ NONE_BIT_POSITION = 0,
+ ///Bit position in the Digest bitmap for MD5.
+ MD5_BIT_POS = 1,
+ ///Bit position in the Digest bitmap for SHA1.
+ SHA_1_BIT_POS = 2,
+ ///Bit position in the Digest bitmap for SHA_2_224.
+ SHA_2_224_BIT_POS = 3,
+ ///Bit position in the Digest bitmap for SHA_2_256.
+ SHA_2_256_BIT_POS = 4,
+ ///Bit position in the Digest bitmap for SHA_2_384.
+ SHA_2_384_BIT_POS = 5,
+ ///Bit position in the Digest bitmap for SHA_2_512.
+ SHA_2_512_BIT_POS = 6,
+}
+
+/// Enum defining the bit position for each block mode type. Since block mode can be repeatable in
+/// key parameters, it is represented using a bitmap.
+#[allow(non_camel_case_types)]
+#[repr(i32)]
+enum BlockModeBitPosition {
+ ///Bit position in the BlockMode bitmap for ECB.
+ ECB_BIT_POS = 1,
+ ///Bit position in the BlockMode bitmap for CBC.
+ CBC_BIT_POS = 2,
+ ///Bit position in the BlockMode bitmap for CTR.
+ CTR_BIT_POS = 3,
+ ///Bit position in the BlockMode bitmap for GCM.
+ GCM_BIT_POS = 4,
+}
+
+/// Enum defining the bit position for each key purpose. Since key purpose can be repeatable in
+/// key parameters, it is represented using a bitmap.
+#[allow(non_camel_case_types)]
+#[repr(i32)]
+enum KeyPurposeBitPosition {
+ ///Bit position in the KeyPurpose bitmap for Encrypt.
+ ENCRYPT_BIT_POS = 1,
+ ///Bit position in the KeyPurpose bitmap for Decrypt.
+ DECRYPT_BIT_POS = 2,
+ ///Bit position in the KeyPurpose bitmap for Sign.
+ SIGN_BIT_POS = 3,
+ ///Bit position in the KeyPurpose bitmap for Verify.
+ VERIFY_BIT_POS = 4,
+ ///Bit position in the KeyPurpose bitmap for Wrap Key.
+ WRAP_KEY_BIT_POS = 5,
+ ///Bit position in the KeyPurpose bitmap for Agree Key.
+ AGREE_KEY_BIT_POS = 6,
+ ///Bit position in the KeyPurpose bitmap for Attest Key.
+ ATTEST_KEY_BIT_POS = 7,
+}
diff --git a/keystore2/src/security_level.rs b/keystore2/src/security_level.rs
index e50155b..1de39e6 100644
--- a/keystore2/src/security_level.rs
+++ b/keystore2/src/security_level.rs
@@ -37,6 +37,7 @@
use crate::globals::{DB, ENFORCEMENTS, LEGACY_MIGRATOR, SUPER_KEY};
use crate::key_parameter::KeyParameter as KsKeyParam;
use crate::key_parameter::KeyParameterValue as KsKeyParamValue;
+use crate::metrics::log_key_creation_event_stats;
use crate::remote_provisioning::RemProvState;
use crate::super_key::{KeyBlob, SuperKeyManager};
use crate::utils::{
@@ -797,7 +798,9 @@
flags: i32,
entropy: &[u8],
) -> binder::public_api::Result<KeyMetadata> {
- map_or_log_err(self.generate_key(key, attestation_key, params, flags, entropy), Ok)
+ let result = self.generate_key(key, attestation_key, params, flags, entropy);
+ log_key_creation_event_stats(params, &result);
+ map_or_log_err(result, Ok)
}
fn importKey(
&self,
@@ -807,7 +810,9 @@
flags: i32,
key_data: &[u8],
) -> binder::public_api::Result<KeyMetadata> {
- map_or_log_err(self.import_key(key, attestation_key, params, flags, key_data), Ok)
+ let result = self.import_key(key, attestation_key, params, flags, key_data);
+ log_key_creation_event_stats(params, &result);
+ map_or_log_err(result, Ok)
}
fn importWrappedKey(
&self,
@@ -817,10 +822,10 @@
params: &[KeyParameter],
authenticators: &[AuthenticatorSpec],
) -> binder::public_api::Result<KeyMetadata> {
- map_or_log_err(
- self.import_wrapped_key(key, wrapping_key, masking_key, params, authenticators),
- Ok,
- )
+ let result =
+ self.import_wrapped_key(key, wrapping_key, masking_key, params, authenticators);
+ log_key_creation_event_stats(params, &result);
+ map_or_log_err(result, Ok)
}
fn convertStorageKeyToEphemeral(
&self,