1 /*
2  * Copyright (C) 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #pragma once
18 
19 #include <android/hardware/keymaster/4.0/IKeymasterDevice.h>
20 #include <android/hardware/keymaster/4.0/types.h>
21 #include <gtest/gtest.h>
22 #include <hidl/GtestPrinter.h>
23 #include <hidl/ServiceManagement.h>
24 
25 #include <keymasterV4_0/attestation_record.h>
26 #include <keymasterV4_0/authorization_set.h>
27 #include <keymasterV4_0/openssl_utils.h>
28 
29 namespace android {
30 namespace hardware {
31 namespace keymaster {
32 namespace V4_0 {
33 
34 ::std::ostream& operator<<(::std::ostream& os, const AuthorizationSet& set);
35 
36 namespace test {
37 
38 using ::android::sp;
39 using hidl::base::V1_0::DebugInfo;
40 using ::std::string;
41 
42 class HidlBuf : public hidl_vec<uint8_t> {
43     using super = hidl_vec<uint8_t>;
44 
45   public:
HidlBuf()46     HidlBuf() {}
HidlBuf(const super & other)47     HidlBuf(const super& other) : super(other) {}
HidlBuf(super && other)48     HidlBuf(super&& other) : super(std::move(other)) { other = {}; }
HidlBuf(const HidlBuf & other)49     HidlBuf(const HidlBuf& other) : super(other) {}
HidlBuf(HidlBuf && other)50     HidlBuf(HidlBuf&& other) : super(std::move(other)) { other = HidlBuf(); }
HidlBuf(const std::string & other)51     explicit HidlBuf(const std::string& other) : HidlBuf() { *this = other; }
52 
53     HidlBuf& operator=(const super& other) {
54         super::operator=(other);
55         return *this;
56     }
57 
58     HidlBuf& operator=(super&& other) {
59         super::operator=(std::move(other));
60         other = {};
61         return *this;
62     }
63 
64     HidlBuf& operator=(const HidlBuf& other) {
65         super::operator=(other);
66         return *this;
67     }
68 
69     HidlBuf& operator=(HidlBuf&& other) {
70         super::operator=(std::move(other));
71         other.super::operator=({});
72         return *this;
73     }
74 
75     HidlBuf& operator=(const string& other) {
76         resize(other.size());
77         std::copy(other.begin(), other.end(), begin());
78         return *this;
79     }
80 
to_string()81     string to_string() const { return string(reinterpret_cast<const char*>(data()), size()); }
82 };
83 
84 constexpr uint64_t kOpHandleSentinel = 0xFFFFFFFFFFFFFFFF;
85 
86 class KeymasterHidlTest : public ::testing::TestWithParam<std::string> {
87   public:
88     void SetUp() override;
TearDown()89     void TearDown() override {
90         if (key_blob_.size()) {
91             CheckedDeleteKey();
92         }
93         AbortIfNeeded();
94     }
95 
96     void InitializeKeymaster(sp<IKeymasterDevice> keymaster);
keymaster()97     IKeymasterDevice& keymaster() { return *keymaster_; }
os_version()98     uint32_t os_version() { return os_version_; }
os_patch_level()99     uint32_t os_patch_level() { return os_patch_level_; }
100 
101     ErrorCode GenerateKey(const AuthorizationSet& key_desc, HidlBuf* key_blob,
102                           KeyCharacteristics* key_characteristics);
103     ErrorCode GenerateKey(const AuthorizationSet& key_desc);
104 
105     ErrorCode ImportKey(const AuthorizationSet& key_desc, KeyFormat format,
106                         const string& key_material, HidlBuf* key_blob,
107                         KeyCharacteristics* key_characteristics);
108     ErrorCode ImportKey(const AuthorizationSet& key_desc, KeyFormat format,
109                         const string& key_material);
110 
111     ErrorCode ImportWrappedKey(string wrapped_key, string wrapping_key,
112                                const AuthorizationSet& wrapping_key_desc, string masking_key,
113                                const AuthorizationSet& unwrapping_params);
114 
115     ErrorCode ExportKey(KeyFormat format, const HidlBuf& key_blob, const HidlBuf& client_id,
116                         const HidlBuf& app_data, HidlBuf* key_material);
117     ErrorCode ExportKey(KeyFormat format, HidlBuf* key_material);
118 
119     ErrorCode DeleteKey(HidlBuf* key_blob, bool keep_key_blob = false);
120     ErrorCode DeleteKey(bool keep_key_blob = false);
121 
122     ErrorCode DeleteAllKeys();
123 
124     void CheckedDeleteKey(HidlBuf* key_blob, bool keep_key_blob = false);
125     void CheckedDeleteKey();
126 
127     void CheckGetCharacteristics(const HidlBuf& key_blob, const HidlBuf& client_id,
128                                  const HidlBuf& app_data, KeyCharacteristics* key_characteristics);
129     ErrorCode GetCharacteristics(const HidlBuf& key_blob, const HidlBuf& client_id,
130                                  const HidlBuf& app_data, KeyCharacteristics* key_characteristics);
131     ErrorCode GetCharacteristics(const HidlBuf& key_blob, KeyCharacteristics* key_characteristics);
132 
133     ErrorCode GetDebugInfo(DebugInfo* debug_info);
134 
135     ErrorCode Begin(KeyPurpose purpose, const HidlBuf& key_blob, const AuthorizationSet& in_params,
136                     AuthorizationSet* out_params, OperationHandle* op_handle);
137     ErrorCode Begin(KeyPurpose purpose, const AuthorizationSet& in_params,
138                     AuthorizationSet* out_params);
139     ErrorCode Begin(KeyPurpose purpose, const AuthorizationSet& in_params);
140 
141     ErrorCode Update(OperationHandle op_handle, const AuthorizationSet& in_params,
142                      const string& input, AuthorizationSet* out_params, string* output,
143                      size_t* input_consumed);
144     ErrorCode Update(const string& input, string* out, size_t* input_consumed);
145 
146     ErrorCode Finish(OperationHandle op_handle, const AuthorizationSet& in_params,
147                      const string& input, const string& signature, AuthorizationSet* out_params,
148                      string* output);
149     ErrorCode Finish(const string& message, string* output);
150     ErrorCode Finish(const string& message, const string& signature, string* output);
Finish(string * output)151     ErrorCode Finish(string* output) { return Finish(string(), output); }
152 
153     ErrorCode Abort(OperationHandle op_handle);
154 
155     void AbortIfNeeded();
156 
157     ErrorCode AttestKey(const HidlBuf& key_blob, const AuthorizationSet& attest_params,
158                         hidl_vec<hidl_vec<uint8_t>>* cert_chain);
159     ErrorCode AttestKey(const AuthorizationSet& attest_params,
160                         hidl_vec<hidl_vec<uint8_t>>* cert_chain);
161 
162     string ProcessMessage(const HidlBuf& key_blob, KeyPurpose operation, const string& message,
163                           const AuthorizationSet& in_params, AuthorizationSet* out_params);
164 
165     string SignMessage(const HidlBuf& key_blob, const string& message,
166                        const AuthorizationSet& params);
167     string SignMessage(const string& message, const AuthorizationSet& params);
168 
169     string MacMessage(const string& message, Digest digest, size_t mac_length);
170 
171     void CheckAesIncrementalEncryptOperation(BlockMode block_mode, int message_size);
172 
173     void CheckHmacTestVector(const string& key, const string& message, Digest digest,
174                              const string& expected_mac);
175 
176     void CheckAesCtrTestVector(const string& key, const string& nonce, const string& message,
177                                const string& expected_ciphertext);
178 
179     void CheckTripleDesTestVector(KeyPurpose purpose, BlockMode block_mode,
180                                   PaddingMode padding_mode, const string& key, const string& iv,
181                                   const string& input, const string& expected_output);
182 
183     void VerifyMessage(const HidlBuf& key_blob, const string& message, const string& signature,
184                        const AuthorizationSet& params);
185     void VerifyMessage(const string& message, const string& signature,
186                        const AuthorizationSet& params);
187 
188     string EncryptMessage(const HidlBuf& key_blob, const string& message,
189                           const AuthorizationSet& in_params, AuthorizationSet* out_params);
190     string EncryptMessage(const string& message, const AuthorizationSet& params,
191                           AuthorizationSet* out_params);
192     string EncryptMessage(const string& message, const AuthorizationSet& params);
193     string EncryptMessage(const string& message, BlockMode block_mode, PaddingMode padding);
194     string EncryptMessage(const string& message, BlockMode block_mode, PaddingMode padding,
195                           HidlBuf* iv_out);
196     string EncryptMessage(const string& message, BlockMode block_mode, PaddingMode padding,
197                           const HidlBuf& iv_in);
198     string EncryptMessage(const string& message, BlockMode block_mode, PaddingMode padding,
199                           uint8_t mac_length_bits, const HidlBuf& iv_in);
200 
201     string DecryptMessage(const HidlBuf& key_blob, const string& ciphertext,
202                           const AuthorizationSet& params);
203     string DecryptMessage(const string& ciphertext, const AuthorizationSet& params);
204     string DecryptMessage(const string& ciphertext, BlockMode block_mode, PaddingMode padding_mode,
205                           const HidlBuf& iv);
206 
207     std::pair<ErrorCode, HidlBuf> UpgradeKey(const HidlBuf& key_blob);
208 
IsSecure()209     bool IsSecure() { return securityLevel_ != SecurityLevel::SOFTWARE; }
SecLevel()210     SecurityLevel SecLevel() { return securityLevel_; }
211 
212     std::vector<uint32_t> ValidKeySizes(Algorithm algorithm);
213     std::vector<uint32_t> InvalidKeySizes(Algorithm algorithm);
214 
215     std::vector<EcCurve> ValidCurves();
216     std::vector<EcCurve> InvalidCurves();
217 
218     std::vector<Digest> ValidDigests(bool withNone, bool withMD5);
219     std::vector<Digest> InvalidDigests();
220 
221     HidlBuf key_blob_;
222     KeyCharacteristics key_characteristics_;
223     OperationHandle op_handle_ = kOpHandleSentinel;
224 
build_params()225     static std::vector<std::string> build_params() {
226         auto params = android::hardware::getAllHalInstanceNames(IKeymasterDevice::descriptor);
227         return params;
228     }
229 
230   private:
231     sp<IKeymasterDevice> keymaster_;
232     uint32_t os_version_;
233     uint32_t os_patch_level_;
234 
235     SecurityLevel securityLevel_;
236     hidl_string name_;
237     hidl_string author_;
238 };
239 
240 #define INSTANTIATE_KEYMASTER_HIDL_TEST(name)                                      \
241     GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(name);                           \
242     INSTANTIATE_TEST_SUITE_P(PerInstance, name,                                    \
243                              testing::ValuesIn(KeymasterHidlTest::build_params()), \
244                              android::hardware::PrintInstanceNameToString)
245 
246 X509* parse_cert_blob(const hidl_vec<uint8_t>& blob);
247 // Extract attestation record from cert. Returned object is still part of cert; don't free it
248 // separately.
249 ASN1_OCTET_STRING* get_attestation_record(X509* certificate);
250 
251 }  // namespace test
252 }  // namespace V4_0
253 }  // namespace keymaster
254 }  // namespace hardware
255 }  // namespace android
256