Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 11:36:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "Adding testing functionality for TAG_ROLLBACK_RESISTANCE"

Browse Source
This commit is contained in:
Treehugger Robot
2019-08-23 12:05:27 +00:00
committed by Gerrit Code Review
parent f71728f04b b1b45ff81c
commit 28a7fed681
1 changed files with 44 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
View File

@@ -4066,75 +4066,61 @@ typedef KeymasterHidlTest KeyDeletionTest;
*
* This test checks that if rollback protection is implemented, DeleteKey invalidates a formerly
* valid key blob.
*
* TODO(swillden): Update to incorporate changes in rollback resistance semantics.
*/
TEST_F(KeyDeletionTest, DeleteKey) {
ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537)
.Digest(Digest::NONE)
.Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED)));
auto error = GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537)
.Digest(Digest::NONE)
.Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED)
.Authorization(TAG_ROLLBACK_RESISTANCE));
ASSERT_TRUE(error == ErrorCode::ROLLBACK_RESISTANCE_UNAVAILABLE || error == ErrorCode::OK);
// Delete must work if rollback protection is implemented
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
bool rollback_protected = hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE);
if (error == ErrorCode::OK) {
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
ASSERT_TRUE(hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE));
if (rollback_protected) {
ASSERT_EQ(ErrorCode::OK, DeleteKey(true /* keep key blob */));
} else {
auto delete_result = DeleteKey(true /* keep key blob */);
ASSERT_TRUE(delete_result == ErrorCode::OK | delete_result == ErrorCode::UNIMPLEMENTED);
}
string message = "12345678901234567890123456789012";
AuthorizationSet begin_out_params;
if (rollback_protected) {
string message = "12345678901234567890123456789012";
AuthorizationSet begin_out_params;
EXPECT_EQ(ErrorCode::INVALID_KEY_BLOB,
Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_));
} else {
EXPECT_EQ(ErrorCode::OK,
Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_));
AbortIfNeeded();
key_blob_ = HidlBuf();
}
AbortIfNeeded();
key_blob_ = HidlBuf();
}
/**
* KeyDeletionTest.DeleteInvalidKey
*
* This test checks that the HAL excepts invalid key blobs.
*
* TODO(swillden): Update to incorporate changes in rollback resistance semantics.
* This test checks that the HAL excepts invalid key blobs..
*/
TEST_F(KeyDeletionTest, DeleteInvalidKey) {
// Generate key just to check if rollback protection is implemented
ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537)
.Digest(Digest::NONE)
.Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED)));
auto error = GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537)
.Digest(Digest::NONE)
.Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED)
.Authorization(TAG_ROLLBACK_RESISTANCE));
ASSERT_TRUE(error == ErrorCode::ROLLBACK_RESISTANCE_UNAVAILABLE || error == ErrorCode::OK);
// Delete must work if rollback protection is implemented
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
bool rollback_protected = hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE);
if (error == ErrorCode::OK) {
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
ASSERT_TRUE(hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE));
// Delete the key we don't care about the result at this point.
DeleteKey();
// Delete the key we don't care about the result at this point.
DeleteKey();
// Now create an invalid key blob and delete it.
key_blob_ = HidlBuf("just some garbage data which is not a valid key blob");
// Now create an invalid key blob and delete it.
key_blob_ = HidlBuf("just some garbage data which is not a valid key blob");
if (rollback_protected) {
ASSERT_EQ(ErrorCode::OK, DeleteKey());
} else {
auto delete_result = DeleteKey();
ASSERT_TRUE(delete_result == ErrorCode::OK | delete_result == ErrorCode::UNIMPLEMENTED);
}
}
@@ -4148,39 +4134,34 @@ TEST_F(KeyDeletionTest, DeleteInvalidKey) {
* device has been wiped manually (e.g., fastboot flashall -w), and new FBE/FDE keys have
* been provisioned. Use this test only on dedicated testing devices that have no valuable
* credentials stored in Keystore/Keymaster.
*
* TODO(swillden): Update to incorporate changes in rollback resistance semantics.
*/
TEST_F(KeyDeletionTest, DeleteAllKeys) {
if (!arm_deleteAllKeys) return;
ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537)
.Digest(Digest::NONE)
.Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED)));
auto error = GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537)
.Digest(Digest::NONE)
.Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED)
.Authorization(TAG_ROLLBACK_RESISTANCE));
ASSERT_TRUE(error == ErrorCode::ROLLBACK_RESISTANCE_UNAVAILABLE || error == ErrorCode::OK);
// Delete must work if rollback protection is implemented
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
bool rollback_protected = hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE);
if (error == ErrorCode::OK) {
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
ASSERT_TRUE(hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE));
ASSERT_EQ(ErrorCode::OK, DeleteAllKeys());
ASSERT_EQ(ErrorCode::OK, DeleteAllKeys());
string message = "12345678901234567890123456789012";
AuthorizationSet begin_out_params;
string message = "12345678901234567890123456789012";
AuthorizationSet begin_out_params;
if (rollback_protected) {
EXPECT_EQ(ErrorCode::INVALID_KEY_BLOB,
Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_));
} else {
EXPECT_EQ(ErrorCode::OK,
Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_));
AbortIfNeeded();
key_blob_ = HidlBuf();
}
AbortIfNeeded();
key_blob_ = HidlBuf();
}
using UpgradeKeyTest = KeymasterHidlTest;