Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 16:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "Adding testing functionality for TAG_ROLLBACK_RESISTANCE"

Browse Source 
am: 28a7fed681

Change-Id: I48327bcf5effe56e5f57fa53092cde6c10c62ecd
This commit is contained in:
Max Bires
2019-08-23 05:28:49 -07:00
committed by android-build-merger
parent caed24ba9b 28a7fed681
commit dddf75c01b
1 changed files with 44 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
View File

@@ -4339,75 +4339,61 @@ typedef KeymasterHidlTest KeyDeletionTest;
* *
* This test checks that if rollback protection is implemented, DeleteKey invalidates a formerly * This test checks that if rollback protection is implemented, DeleteKey invalidates a formerly
* valid key blob. * valid key blob.
*
* TODO(swillden): Update to incorporate changes in rollback resistance semantics.
*/ */
TEST_F(KeyDeletionTest, DeleteKey) { TEST_F(KeyDeletionTest, DeleteKey) {
ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder() auto error = GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537) .RsaSigningKey(2048, 65537)
.Digest(Digest::NONE) .Digest(Digest::NONE)
.Padding(PaddingMode::NONE) .Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED))); .Authorization(TAG_NO_AUTH_REQUIRED)
.Authorization(TAG_ROLLBACK_RESISTANCE));
ASSERT_TRUE(error == ErrorCode::ROLLBACK_RESISTANCE_UNAVAILABLE || error == ErrorCode::OK);
// Delete must work if rollback protection is implemented // Delete must work if rollback protection is implemented
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced); if (error == ErrorCode::OK) {
bool rollback_protected = hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE); AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
ASSERT_TRUE(hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE));
if (rollback_protected) {
ASSERT_EQ(ErrorCode::OK, DeleteKey(true /* keep key blob */)); ASSERT_EQ(ErrorCode::OK, DeleteKey(true /* keep key blob */));
} else {
auto delete_result = DeleteKey(true /* keep key blob */);
ASSERT_TRUE(delete_result == ErrorCode::OK | delete_result == ErrorCode::UNIMPLEMENTED);
}
string message = "12345678901234567890123456789012"; string message = "12345678901234567890123456789012";
AuthorizationSet begin_out_params; AuthorizationSet begin_out_params;
if (rollback_protected) {
EXPECT_EQ(ErrorCode::INVALID_KEY_BLOB, EXPECT_EQ(ErrorCode::INVALID_KEY_BLOB,
Begin(KeyPurpose::SIGN, key_blob_, Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE), AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_)); &begin_out_params, &op_handle_));
} else { AbortIfNeeded();
EXPECT_EQ(ErrorCode::OK, key_blob_ = HidlBuf();
Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_));
} }
AbortIfNeeded();
key_blob_ = HidlBuf();
} }
/** /**
* KeyDeletionTest.DeleteInvalidKey * KeyDeletionTest.DeleteInvalidKey
* *
* This test checks that the HAL excepts invalid key blobs. * This test checks that the HAL excepts invalid key blobs..
*
* TODO(swillden): Update to incorporate changes in rollback resistance semantics.
*/ */
TEST_F(KeyDeletionTest, DeleteInvalidKey) { TEST_F(KeyDeletionTest, DeleteInvalidKey) {
// Generate key just to check if rollback protection is implemented // Generate key just to check if rollback protection is implemented
ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder() auto error = GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537) .RsaSigningKey(2048, 65537)
.Digest(Digest::NONE) .Digest(Digest::NONE)
.Padding(PaddingMode::NONE) .Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED))); .Authorization(TAG_NO_AUTH_REQUIRED)
.Authorization(TAG_ROLLBACK_RESISTANCE));
ASSERT_TRUE(error == ErrorCode::ROLLBACK_RESISTANCE_UNAVAILABLE || error == ErrorCode::OK);
// Delete must work if rollback protection is implemented // Delete must work if rollback protection is implemented
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced); if (error == ErrorCode::OK) {
bool rollback_protected = hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE); AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
ASSERT_TRUE(hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE));
// Delete the key we don't care about the result at this point. // Delete the key we don't care about the result at this point.
DeleteKey(); DeleteKey();
// Now create an invalid key blob and delete it. // Now create an invalid key blob and delete it.
key_blob_ = HidlBuf("just some garbage data which is not a valid key blob"); key_blob_ = HidlBuf("just some garbage data which is not a valid key blob");
if (rollback_protected) {
ASSERT_EQ(ErrorCode::OK, DeleteKey()); ASSERT_EQ(ErrorCode::OK, DeleteKey());
} else {
auto delete_result = DeleteKey();
ASSERT_TRUE(delete_result == ErrorCode::OK | delete_result == ErrorCode::UNIMPLEMENTED);
} }
} }
@@ -4421,39 +4407,34 @@ TEST_F(KeyDeletionTest, DeleteInvalidKey) {
* device has been wiped manually (e.g., fastboot flashall -w), and new FBE/FDE keys have * device has been wiped manually (e.g., fastboot flashall -w), and new FBE/FDE keys have
* been provisioned. Use this test only on dedicated testing devices that have no valuable * been provisioned. Use this test only on dedicated testing devices that have no valuable
* credentials stored in Keystore/Keymaster. * credentials stored in Keystore/Keymaster.
*
* TODO(swillden): Update to incorporate changes in rollback resistance semantics.
*/ */
TEST_F(KeyDeletionTest, DeleteAllKeys) { TEST_F(KeyDeletionTest, DeleteAllKeys) {
if (!arm_deleteAllKeys) return; if (!arm_deleteAllKeys) return;
ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder() auto error = GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(2048, 65537) .RsaSigningKey(2048, 65537)
.Digest(Digest::NONE) .Digest(Digest::NONE)
.Padding(PaddingMode::NONE) .Padding(PaddingMode::NONE)
.Authorization(TAG_NO_AUTH_REQUIRED))); .Authorization(TAG_NO_AUTH_REQUIRED)
.Authorization(TAG_ROLLBACK_RESISTANCE));
ASSERT_TRUE(error == ErrorCode::ROLLBACK_RESISTANCE_UNAVAILABLE || error == ErrorCode::OK);
// Delete must work if rollback protection is implemented // Delete must work if rollback protection is implemented
AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced); if (error == ErrorCode::OK) {
bool rollback_protected = hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE); AuthorizationSet hardwareEnforced(key_characteristics_.hardwareEnforced);
ASSERT_TRUE(hardwareEnforced.Contains(TAG_ROLLBACK_RESISTANCE));
ASSERT_EQ(ErrorCode::OK, DeleteAllKeys()); ASSERT_EQ(ErrorCode::OK, DeleteAllKeys());
string message = "12345678901234567890123456789012"; string message = "12345678901234567890123456789012";
AuthorizationSet begin_out_params; AuthorizationSet begin_out_params;
if (rollback_protected) {
EXPECT_EQ(ErrorCode::INVALID_KEY_BLOB, EXPECT_EQ(ErrorCode::INVALID_KEY_BLOB,
Begin(KeyPurpose::SIGN, key_blob_, Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE), AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_)); &begin_out_params, &op_handle_));
} else { AbortIfNeeded();
EXPECT_EQ(ErrorCode::OK, key_blob_ = HidlBuf();
Begin(KeyPurpose::SIGN, key_blob_,
AuthorizationSetBuilder().Digest(Digest::NONE).Padding(PaddingMode::NONE),
&begin_out_params, &op_handle_));
} }
AbortIfNeeded();
key_blob_ = HidlBuf();
} }
using UpgradeKeyTest = KeymasterHidlTest; using UpgradeKeyTest = KeymasterHidlTest;