1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Permission is hereby granted, free of charge, to any person
5  * obtaining a copy of this software and associated documentation
6  * files (the "Software"), to deal in the Software without
7  * restriction, including without limitation the rights to use, copy,
8  * modify, merge, publish, distribute, sublicense, and/or sell copies
9  * of the Software, and to permit persons to whom the Software is
10  * furnished to do so, subject to the following conditions:
11  *
12  * The above copyright notice and this permission notice shall be
13  * included in all copies or substantial portions of the Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22  * SOFTWARE.
23  */
24 
25 #include <stdio.h>
26 #include <string.h>
27 
28 #include <base/files/file_util.h>
29 #include <gtest/gtest.h>
30 #include <openssl/objects.h>
31 #include <openssl/pem.h>
32 #include <openssl/rsa.h>
33 #include <openssl/sha.h>
34 
35 #include <libavb_atx/libavb_atx.h>
36 
37 #include "avb_unittest_util.h"
38 #include "fake_avb_ops.h"
39 
40 namespace {
41 
42 const char kMetadataPath[] = "test/data/atx_metadata.bin";
43 const char kPermanentAttributesPath[] =
44     "test/data/atx_permanent_attributes.bin";
45 const char kPRKPrivateKeyPath[] = "test/data/testkey_atx_prk.pem";
46 const char kPIKPrivateKeyPath[] = "test/data/testkey_atx_pik.pem";
47 
48 class ScopedRSA {
49  public:
ScopedRSA(const char * pem_key_path)50   ScopedRSA(const char* pem_key_path) {
51     FILE* file = fopen(pem_key_path, "r");
52     rsa_ = PEM_read_RSAPrivateKey(file, nullptr, nullptr, nullptr);
53     fclose(file);
54   }
55 
~ScopedRSA()56   ~ScopedRSA() {
57     if (rsa_) {
58       RSA_free(rsa_);
59     }
60   }
61 
62   // PKCS #1 v1.5 signature using SHA512. Returns true on success.
Sign(const void * data_to_sign,size_t length,uint8_t signature[])63   bool Sign(const void* data_to_sign, size_t length, uint8_t signature[]) {
64     uint8_t digest[AVB_SHA512_DIGEST_SIZE];
65     const unsigned char* data_to_sign_buf =
66         reinterpret_cast<const unsigned char*>(data_to_sign);
67     SHA512(data_to_sign_buf, length, digest);
68     unsigned int signature_length = 0;
69     return (1 == RSA_sign(NID_sha512,
70                           digest,
71                           AVB_SHA512_DIGEST_SIZE,
72                           signature,
73                           &signature_length,
74                           rsa_));
75   }
76 
77  private:
78   RSA* rsa_;
79 };
80 
81 } /* namespace */
82 
83 namespace avb {
84 
85 class AvbAtxValidateTest : public ::testing::Test, public FakeAvbOpsDelegate {
86  public:
~AvbAtxValidateTest()87   ~AvbAtxValidateTest() override {}
88 
SetUp()89   void SetUp() override {
90     ReadDefaultData();
91     ops_.set_delegate(this);
92     ops_.set_permanent_attributes(attributes_);
93     ops_.set_stored_rollback_indexes(
94         {{AVB_ATX_PIK_VERSION_LOCATION, 0}, {AVB_ATX_PSK_VERSION_LOCATION, 0}});
95   }
96 
97   // FakeAvbOpsDelegate methods.
read_from_partition(const char * partition,int64_t offset,size_t num_bytes,void * buffer,size_t * out_num_read)98   AvbIOResult read_from_partition(const char* partition,
99                                   int64_t offset,
100                                   size_t num_bytes,
101                                   void* buffer,
102                                   size_t* out_num_read) override {
103     // Expect method not used.
104     return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
105   }
106 
write_to_partition(const char * partition,int64_t offset,size_t num_bytes,const void * buffer)107   AvbIOResult write_to_partition(const char* partition,
108                                  int64_t offset,
109                                  size_t num_bytes,
110                                  const void* buffer) override {
111     // Expect method not used.
112     return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
113   }
114 
validate_vbmeta_public_key(AvbOps * ops,const uint8_t * public_key_data,size_t public_key_length,const uint8_t * public_key_metadata,size_t public_key_metadata_length,bool * out_key_is_trusted)115   AvbIOResult validate_vbmeta_public_key(AvbOps* ops,
116                                          const uint8_t* public_key_data,
117                                          size_t public_key_length,
118                                          const uint8_t* public_key_metadata,
119                                          size_t public_key_metadata_length,
120                                          bool* out_key_is_trusted) override {
121     // Expect method not used.
122     return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
123   }
124 
read_rollback_index(AvbOps * ops,size_t rollback_index_slot,uint64_t * out_rollback_index)125   AvbIOResult read_rollback_index(AvbOps* ops,
126                                   size_t rollback_index_slot,
127                                   uint64_t* out_rollback_index) override {
128     if ((fail_read_pik_rollback_index_ &&
129          rollback_index_slot == AVB_ATX_PIK_VERSION_LOCATION) ||
130         (fail_read_psk_rollback_index_ &&
131          rollback_index_slot == AVB_ATX_PSK_VERSION_LOCATION)) {
132       return AVB_IO_RESULT_ERROR_IO;
133     }
134     return ops_.read_rollback_index(
135         ops, rollback_index_slot, out_rollback_index);
136   }
137 
write_rollback_index(AvbOps * ops,size_t rollback_index_slot,uint64_t rollback_index)138   AvbIOResult write_rollback_index(AvbOps* ops,
139                                    size_t rollback_index_slot,
140                                    uint64_t rollback_index) override {
141     // Expect method not used.
142     return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
143   }
144 
read_is_device_unlocked(AvbOps * ops,bool * out_is_device_unlocked)145   AvbIOResult read_is_device_unlocked(AvbOps* ops,
146                                       bool* out_is_device_unlocked) override {
147     // Expect method not used.
148     return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
149   }
150 
get_unique_guid_for_partition(AvbOps * ops,const char * partition,char * guid_buf,size_t guid_buf_size)151   AvbIOResult get_unique_guid_for_partition(AvbOps* ops,
152                                             const char* partition,
153                                             char* guid_buf,
154                                             size_t guid_buf_size) override {
155     // Expect method not used.
156     return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
157   }
158 
read_permanent_attributes(AvbAtxPermanentAttributes * attributes)159   AvbIOResult read_permanent_attributes(
160       AvbAtxPermanentAttributes* attributes) override {
161     if (fail_read_permanent_attributes_) {
162       return AVB_IO_RESULT_ERROR_IO;
163     }
164     return ops_.read_permanent_attributes(attributes);
165   }
166 
read_permanent_attributes_hash(uint8_t hash[AVB_SHA256_DIGEST_SIZE])167   AvbIOResult read_permanent_attributes_hash(
168       uint8_t hash[AVB_SHA256_DIGEST_SIZE]) override {
169     if (fail_read_permanent_attributes_hash_) {
170       return AVB_IO_RESULT_ERROR_IO;
171     }
172     return ops_.read_permanent_attributes_hash(hash);
173   }
174 
175  protected:
Validate(bool * is_trusted)176   virtual AvbIOResult Validate(bool* is_trusted) {
177     return avb_atx_validate_vbmeta_public_key(
178         ops_.avb_ops(),
179         metadata_.product_signing_key_certificate.signed_data.public_key,
180         AVB_ATX_PUBLIC_KEY_SIZE,
181         reinterpret_cast<const uint8_t*>(&metadata_),
182         sizeof(metadata_),
183         is_trusted);
184   }
185 
SignPIKCertificate()186   void SignPIKCertificate() {
187     memset(metadata_.product_intermediate_key_certificate.signature,
188            0,
189            AVB_RSA4096_NUM_BYTES);
190     ScopedRSA key(kPRKPrivateKeyPath);
191     ASSERT_TRUE(
192         key.Sign(&metadata_.product_intermediate_key_certificate.signed_data,
193                  sizeof(AvbAtxCertificateSignedData),
194                  metadata_.product_intermediate_key_certificate.signature));
195   }
196 
SignPSKCertificate()197   void SignPSKCertificate() {
198     memset(metadata_.product_signing_key_certificate.signature,
199            0,
200            AVB_RSA4096_NUM_BYTES);
201     ScopedRSA key(kPIKPrivateKeyPath);
202     ASSERT_TRUE(key.Sign(&metadata_.product_signing_key_certificate.signed_data,
203                          sizeof(AvbAtxCertificateSignedData),
204                          metadata_.product_signing_key_certificate.signature));
205   }
206 
207   FakeAvbOps ops_;
208   AvbAtxPermanentAttributes attributes_;
209   AvbAtxPublicKeyMetadata metadata_;
210   bool fail_read_permanent_attributes_{false};
211   bool fail_read_permanent_attributes_hash_{false};
212   bool fail_read_pik_rollback_index_{false};
213   bool fail_read_psk_rollback_index_{false};
214 
215  private:
ReadDefaultData()216   void ReadDefaultData() {
217     std::string tmp;
218     ASSERT_TRUE(base::ReadFileToString(base::FilePath(kMetadataPath), &tmp));
219     ASSERT_EQ(tmp.size(), sizeof(AvbAtxPublicKeyMetadata));
220     memcpy(&metadata_, tmp.data(), tmp.size());
221     ASSERT_TRUE(
222         base::ReadFileToString(base::FilePath(kPermanentAttributesPath), &tmp));
223     ASSERT_EQ(tmp.size(), sizeof(AvbAtxPermanentAttributes));
224     memcpy(&attributes_, tmp.data(), tmp.size());
225   }
226 };
227 
TEST_F(AvbAtxValidateTest,Success)228 TEST_F(AvbAtxValidateTest, Success) {
229   bool is_trusted = false;
230   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
231   EXPECT_TRUE(is_trusted);
232 }
233 
TEST_F(AvbAtxValidateTest,SuccessAfterNewSign)234 TEST_F(AvbAtxValidateTest, SuccessAfterNewSign) {
235   std::string old_pik_sig(
236       reinterpret_cast<char*>(
237           metadata_.product_intermediate_key_certificate.signature),
238       AVB_RSA4096_NUM_BYTES);
239   std::string old_psk_sig(
240       reinterpret_cast<char*>(
241           metadata_.product_signing_key_certificate.signature),
242       AVB_RSA4096_NUM_BYTES);
243   SignPIKCertificate();
244   SignPSKCertificate();
245   std::string new_pik_sig(
246       reinterpret_cast<char*>(
247           metadata_.product_intermediate_key_certificate.signature),
248       AVB_RSA4096_NUM_BYTES);
249   std::string new_psk_sig(
250       reinterpret_cast<char*>(
251           metadata_.product_signing_key_certificate.signature),
252       AVB_RSA4096_NUM_BYTES);
253   EXPECT_EQ(old_pik_sig, new_pik_sig);
254   EXPECT_EQ(old_psk_sig, new_psk_sig);
255   bool is_trusted = false;
256   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
257   EXPECT_TRUE(is_trusted);
258 }
259 
TEST_F(AvbAtxValidateTest,FailReadPermamentAttributes)260 TEST_F(AvbAtxValidateTest, FailReadPermamentAttributes) {
261   fail_read_permanent_attributes_ = true;
262   bool is_trusted = true;
263   EXPECT_EQ(AVB_IO_RESULT_ERROR_IO, Validate(&is_trusted));
264   EXPECT_FALSE(is_trusted);
265 }
266 
TEST_F(AvbAtxValidateTest,FailReadPermamentAttributesHash)267 TEST_F(AvbAtxValidateTest, FailReadPermamentAttributesHash) {
268   fail_read_permanent_attributes_hash_ = true;
269   bool is_trusted = true;
270   EXPECT_EQ(AVB_IO_RESULT_ERROR_IO, Validate(&is_trusted));
271   EXPECT_FALSE(is_trusted);
272 }
273 
TEST_F(AvbAtxValidateTest,UnsupportedPermanentAttributesVersion)274 TEST_F(AvbAtxValidateTest, UnsupportedPermanentAttributesVersion) {
275   attributes_.version = 25;
276   ops_.set_permanent_attributes(attributes_);
277   bool is_trusted = true;
278   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
279   EXPECT_FALSE(is_trusted);
280 }
281 
TEST_F(AvbAtxValidateTest,PermanentAttributesHashMismatch)282 TEST_F(AvbAtxValidateTest, PermanentAttributesHashMismatch) {
283   ops_.set_permanent_attributes_hash("bad_hash");
284   bool is_trusted = true;
285   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
286   EXPECT_FALSE(is_trusted);
287 }
288 
289 // A fixture with parameterized metadata length.
290 class AvbAtxValidateTestWithMetadataLength
291     : public AvbAtxValidateTest,
292       public ::testing::WithParamInterface<size_t> {
293  protected:
Validate(bool * is_trusted)294   AvbIOResult Validate(bool* is_trusted) override {
295     return avb_atx_validate_vbmeta_public_key(
296         ops_.avb_ops(),
297         metadata_.product_signing_key_certificate.signed_data.public_key,
298         AVB_ATX_PUBLIC_KEY_SIZE,
299         reinterpret_cast<const uint8_t*>(&metadata_),
300         GetParam(),
301         is_trusted);
302   }
303 };
304 
TEST_P(AvbAtxValidateTestWithMetadataLength,InvalidMetadataLength)305 TEST_P(AvbAtxValidateTestWithMetadataLength, InvalidMetadataLength) {
306   bool is_trusted = true;
307   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
308   EXPECT_FALSE(is_trusted);
309 }
310 
311 // Test a bunch of invalid metadata length values.
312 INSTANTIATE_TEST_CASE_P(P,
313                         AvbAtxValidateTestWithMetadataLength,
314                         ::testing::Values(0,
315                                           1,
316                                           sizeof(AvbAtxPublicKeyMetadata) - 1,
317                                           sizeof(AvbAtxPublicKeyMetadata) + 1,
318                                           -1));
319 
TEST_F(AvbAtxValidateTest,UnsupportedMetadataVersion)320 TEST_F(AvbAtxValidateTest, UnsupportedMetadataVersion) {
321   metadata_.version = 25;
322   bool is_trusted = true;
323   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
324   EXPECT_FALSE(is_trusted);
325 }
326 
TEST_F(AvbAtxValidateTest,FailReadPIKRollbackIndex)327 TEST_F(AvbAtxValidateTest, FailReadPIKRollbackIndex) {
328   fail_read_pik_rollback_index_ = true;
329   bool is_trusted = true;
330   EXPECT_EQ(AVB_IO_RESULT_ERROR_IO, Validate(&is_trusted));
331   EXPECT_FALSE(is_trusted);
332 }
333 
TEST_F(AvbAtxValidateTest,UnsupportedPIKCertificateVersion)334 TEST_F(AvbAtxValidateTest, UnsupportedPIKCertificateVersion) {
335   metadata_.product_intermediate_key_certificate.signed_data.version = 25;
336   SignPIKCertificate();
337   bool is_trusted = true;
338   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
339   EXPECT_FALSE(is_trusted);
340 }
341 
TEST_F(AvbAtxValidateTest,BadPIKCert_ModifiedSubjectPublicKey)342 TEST_F(AvbAtxValidateTest, BadPIKCert_ModifiedSubjectPublicKey) {
343   metadata_.product_intermediate_key_certificate.signed_data.public_key[0] ^= 1;
344   bool is_trusted = true;
345   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
346   EXPECT_FALSE(is_trusted);
347 }
348 
TEST_F(AvbAtxValidateTest,BadPIKCert_ModifiedSubject)349 TEST_F(AvbAtxValidateTest, BadPIKCert_ModifiedSubject) {
350   metadata_.product_intermediate_key_certificate.signed_data.subject[0] ^= 1;
351   bool is_trusted = true;
352   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
353   EXPECT_FALSE(is_trusted);
354 }
355 
TEST_F(AvbAtxValidateTest,BadPIKCert_ModifiedUsage)356 TEST_F(AvbAtxValidateTest, BadPIKCert_ModifiedUsage) {
357   metadata_.product_intermediate_key_certificate.signed_data.usage[0] ^= 1;
358   bool is_trusted = true;
359   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
360   EXPECT_FALSE(is_trusted);
361 }
362 
TEST_F(AvbAtxValidateTest,BadPIKCert_ModifiedKeyVersion)363 TEST_F(AvbAtxValidateTest, BadPIKCert_ModifiedKeyVersion) {
364   metadata_.product_intermediate_key_certificate.signed_data.key_version ^= 1;
365   bool is_trusted = true;
366   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
367   EXPECT_FALSE(is_trusted);
368 }
369 
TEST_F(AvbAtxValidateTest,BadPIKCert_BadSignature)370 TEST_F(AvbAtxValidateTest, BadPIKCert_BadSignature) {
371   metadata_.product_intermediate_key_certificate.signature[0] ^= 1;
372   bool is_trusted = true;
373   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
374   EXPECT_FALSE(is_trusted);
375 }
376 
TEST_F(AvbAtxValidateTest,PIKCertSubjectIgnored)377 TEST_F(AvbAtxValidateTest, PIKCertSubjectIgnored) {
378   metadata_.product_intermediate_key_certificate.signed_data.subject[0] ^= 1;
379   SignPIKCertificate();
380   bool is_trusted = false;
381   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
382   EXPECT_TRUE(is_trusted);
383 }
384 
TEST_F(AvbAtxValidateTest,PIKCertUnexpectedUsage)385 TEST_F(AvbAtxValidateTest, PIKCertUnexpectedUsage) {
386   metadata_.product_intermediate_key_certificate.signed_data.usage[0] ^= 1;
387   SignPIKCertificate();
388   bool is_trusted = true;
389   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
390   EXPECT_FALSE(is_trusted);
391 }
392 
TEST_F(AvbAtxValidateTest,PIKRollback)393 TEST_F(AvbAtxValidateTest, PIKRollback) {
394   ops_.set_stored_rollback_indexes(
395       {{AVB_ATX_PIK_VERSION_LOCATION,
396         metadata_.product_intermediate_key_certificate.signed_data.key_version +
397             1},
398        {AVB_ATX_PSK_VERSION_LOCATION, 0}});
399   bool is_trusted = true;
400   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
401   EXPECT_FALSE(is_trusted);
402 }
403 
TEST_F(AvbAtxValidateTest,FailReadPSKRollbackIndex)404 TEST_F(AvbAtxValidateTest, FailReadPSKRollbackIndex) {
405   fail_read_psk_rollback_index_ = true;
406   bool is_trusted = true;
407   EXPECT_EQ(AVB_IO_RESULT_ERROR_IO, Validate(&is_trusted));
408   EXPECT_FALSE(is_trusted);
409 }
410 
TEST_F(AvbAtxValidateTest,UnsupportedPSKCertificateVersion)411 TEST_F(AvbAtxValidateTest, UnsupportedPSKCertificateVersion) {
412   metadata_.product_signing_key_certificate.signed_data.version = 25;
413   SignPSKCertificate();
414   bool is_trusted = true;
415   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
416   EXPECT_FALSE(is_trusted);
417 }
418 
TEST_F(AvbAtxValidateTest,BadPSKCert_ModifiedSubjectPublicKey)419 TEST_F(AvbAtxValidateTest, BadPSKCert_ModifiedSubjectPublicKey) {
420   metadata_.product_signing_key_certificate.signed_data.public_key[0] ^= 1;
421   bool is_trusted = true;
422   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
423   EXPECT_FALSE(is_trusted);
424 }
425 
TEST_F(AvbAtxValidateTest,BadPSKCert_ModifiedSubject)426 TEST_F(AvbAtxValidateTest, BadPSKCert_ModifiedSubject) {
427   metadata_.product_signing_key_certificate.signed_data.subject[0] ^= 1;
428   bool is_trusted = true;
429   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
430   EXPECT_FALSE(is_trusted);
431 }
432 
TEST_F(AvbAtxValidateTest,BadPSKCert_ModifiedUsage)433 TEST_F(AvbAtxValidateTest, BadPSKCert_ModifiedUsage) {
434   metadata_.product_signing_key_certificate.signed_data.usage[0] ^= 1;
435   bool is_trusted = true;
436   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
437   EXPECT_FALSE(is_trusted);
438 }
439 
TEST_F(AvbAtxValidateTest,BadPSKCert_ModifiedKeyVersion)440 TEST_F(AvbAtxValidateTest, BadPSKCert_ModifiedKeyVersion) {
441   metadata_.product_signing_key_certificate.signed_data.key_version ^= 1;
442   bool is_trusted = true;
443   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
444   EXPECT_FALSE(is_trusted);
445 }
446 
TEST_F(AvbAtxValidateTest,BadPSKCert_BadSignature)447 TEST_F(AvbAtxValidateTest, BadPSKCert_BadSignature) {
448   metadata_.product_signing_key_certificate.signature[0] ^= 1;
449   bool is_trusted = true;
450   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
451   EXPECT_FALSE(is_trusted);
452 }
453 
TEST_F(AvbAtxValidateTest,PSKCertUnexpectedSubject)454 TEST_F(AvbAtxValidateTest, PSKCertUnexpectedSubject) {
455   metadata_.product_signing_key_certificate.signed_data.subject[0] ^= 1;
456   SignPSKCertificate();
457   bool is_trusted = true;
458   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
459   EXPECT_FALSE(is_trusted);
460 }
461 
TEST_F(AvbAtxValidateTest,PSKCertUnexpectedUsage)462 TEST_F(AvbAtxValidateTest, PSKCertUnexpectedUsage) {
463   metadata_.product_signing_key_certificate.signed_data.usage[0] ^= 1;
464   SignPSKCertificate();
465   bool is_trusted = true;
466   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
467   EXPECT_FALSE(is_trusted);
468 }
469 
TEST_F(AvbAtxValidateTest,PSKRollback)470 TEST_F(AvbAtxValidateTest, PSKRollback) {
471   ops_.set_stored_rollback_indexes(
472       {{AVB_ATX_PIK_VERSION_LOCATION, 0},
473        {AVB_ATX_PSK_VERSION_LOCATION,
474         metadata_.product_signing_key_certificate.signed_data.key_version +
475             1}});
476   bool is_trusted = true;
477   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
478   EXPECT_FALSE(is_trusted);
479 }
480 
481 // A fixture with parameterized public key length.
482 class AvbAtxValidateTestWithPublicKeyLength
483     : public AvbAtxValidateTest,
484       public ::testing::WithParamInterface<size_t> {
485  protected:
Validate(bool * is_trusted)486   AvbIOResult Validate(bool* is_trusted) override {
487     return avb_atx_validate_vbmeta_public_key(
488         ops_.avb_ops(),
489         metadata_.product_signing_key_certificate.signed_data.public_key,
490         GetParam(),
491         reinterpret_cast<const uint8_t*>(&metadata_),
492         sizeof(metadata_),
493         is_trusted);
494   }
495 };
496 
TEST_P(AvbAtxValidateTestWithPublicKeyLength,InvalidPublicKeyLength)497 TEST_P(AvbAtxValidateTestWithPublicKeyLength, InvalidPublicKeyLength) {
498   bool is_trusted = true;
499   EXPECT_EQ(AVB_IO_RESULT_OK, Validate(&is_trusted));
500   EXPECT_FALSE(is_trusted);
501 }
502 
503 // Test a bunch of invalid public key length values.
504 INSTANTIATE_TEST_CASE_P(P,
505                         AvbAtxValidateTestWithPublicKeyLength,
506                         ::testing::Values(0,
507                                           1,
508                                           AVB_ATX_PUBLIC_KEY_SIZE - 1,
509                                           AVB_ATX_PUBLIC_KEY_SIZE + 1,
510                                           AVB_ATX_PUBLIC_KEY_SIZE - 512,
511                                           -1));
512 
TEST_F(AvbAtxValidateTest,PSKMismatch)513 TEST_F(AvbAtxValidateTest, PSKMismatch) {
514   uint8_t bad_key[AVB_ATX_PUBLIC_KEY_SIZE] = {};
515   bool is_trusted = true;
516   EXPECT_EQ(AVB_IO_RESULT_OK,
517             avb_atx_validate_vbmeta_public_key(
518                 ops_.avb_ops(),
519                 bad_key,
520                 AVB_ATX_PUBLIC_KEY_SIZE,
521                 reinterpret_cast<const uint8_t*>(&metadata_),
522                 sizeof(metadata_),
523                 &is_trusted));
524   EXPECT_FALSE(is_trusted);
525 }
526 
527 // A fixture for testing avb_slot_verify() with ATX.
528 class AvbAtxSlotVerifyTest : public BaseAvbToolTest, public FakeAvbOpsDelegate {
529  public:
530   ~AvbAtxSlotVerifyTest() override = default;
531 
SetUp()532   void SetUp() override {
533     BaseAvbToolTest::SetUp();
534     ReadAtxDefaultData();
535     ops_.set_partition_dir(testdir_);
536     ops_.set_delegate(this);
537     ops_.set_permanent_attributes(attributes_);
538     ops_.set_stored_rollback_indexes({{0, 0},
539                                       {1, 0},
540                                       {2, 0},
541                                       {3, 0},
542                                       {AVB_ATX_PIK_VERSION_LOCATION, 0},
543                                       {AVB_ATX_PSK_VERSION_LOCATION, 0}});
544     ops_.set_stored_is_device_unlocked(false);
545   }
546 
547   // FakeAvbOpsDelegate methods. All forward to FakeAvbOps default except for
548   // validate_vbmeta_public_key().
read_from_partition(const char * partition,int64_t offset,size_t num_bytes,void * buffer,size_t * out_num_read)549   AvbIOResult read_from_partition(const char* partition,
550                                   int64_t offset,
551                                   size_t num_bytes,
552                                   void* buffer,
553                                   size_t* out_num_read) override {
554     return ops_.read_from_partition(
555         partition, offset, num_bytes, buffer, out_num_read);
556   }
557 
write_to_partition(const char * partition,int64_t offset,size_t num_bytes,const void * buffer)558   AvbIOResult write_to_partition(const char* partition,
559                                  int64_t offset,
560                                  size_t num_bytes,
561                                  const void* buffer) override {
562     return ops_.write_to_partition(partition, offset, num_bytes, buffer);
563   }
564 
validate_vbmeta_public_key(AvbOps * ops,const uint8_t * public_key_data,size_t public_key_length,const uint8_t * public_key_metadata,size_t public_key_metadata_length,bool * out_key_is_trusted)565   AvbIOResult validate_vbmeta_public_key(AvbOps* ops,
566                                          const uint8_t* public_key_data,
567                                          size_t public_key_length,
568                                          const uint8_t* public_key_metadata,
569                                          size_t public_key_metadata_length,
570                                          bool* out_key_is_trusted) override {
571     // Send to ATX implementation.
572     ++num_atx_calls_;
573     return avb_atx_validate_vbmeta_public_key(ops_.avb_ops(),
574                                               public_key_data,
575                                               public_key_length,
576                                               public_key_metadata,
577                                               public_key_metadata_length,
578                                               out_key_is_trusted);
579   }
580 
read_rollback_index(AvbOps * ops,size_t rollback_index_slot,uint64_t * out_rollback_index)581   AvbIOResult read_rollback_index(AvbOps* ops,
582                                   size_t rollback_index_slot,
583                                   uint64_t* out_rollback_index) override {
584     return ops_.read_rollback_index(
585         ops, rollback_index_slot, out_rollback_index);
586   }
587 
write_rollback_index(AvbOps * ops,size_t rollback_index_slot,uint64_t rollback_index)588   AvbIOResult write_rollback_index(AvbOps* ops,
589                                    size_t rollback_index_slot,
590                                    uint64_t rollback_index) override {
591     return ops_.write_rollback_index(ops, rollback_index_slot, rollback_index);
592   }
593 
read_is_device_unlocked(AvbOps * ops,bool * out_is_device_unlocked)594   AvbIOResult read_is_device_unlocked(AvbOps* ops,
595                                       bool* out_is_device_unlocked) override {
596     return ops_.read_is_device_unlocked(ops, out_is_device_unlocked);
597   }
598 
get_unique_guid_for_partition(AvbOps * ops,const char * partition,char * guid_buf,size_t guid_buf_size)599   AvbIOResult get_unique_guid_for_partition(AvbOps* ops,
600                                             const char* partition,
601                                             char* guid_buf,
602                                             size_t guid_buf_size) override {
603     return ops_.get_unique_guid_for_partition(
604         ops, partition, guid_buf, guid_buf_size);
605   }
606 
read_permanent_attributes(AvbAtxPermanentAttributes * attributes)607   AvbIOResult read_permanent_attributes(
608       AvbAtxPermanentAttributes* attributes) override {
609     return ops_.read_permanent_attributes(attributes);
610   }
611 
read_permanent_attributes_hash(uint8_t hash[AVB_SHA256_DIGEST_SIZE])612   AvbIOResult read_permanent_attributes_hash(
613       uint8_t hash[AVB_SHA256_DIGEST_SIZE]) override {
614     return ops_.read_permanent_attributes_hash(hash);
615   }
616 
617  protected:
618   FakeAvbOps ops_;
619   AvbAtxPermanentAttributes attributes_;
620   int num_atx_calls_ = 0;
621 
622  private:
ReadAtxDefaultData()623   void ReadAtxDefaultData() {
624     std::string tmp;
625     ASSERT_TRUE(
626         base::ReadFileToString(base::FilePath(kPermanentAttributesPath), &tmp));
627     ASSERT_EQ(tmp.size(), sizeof(AvbAtxPermanentAttributes));
628     memcpy(&attributes_, tmp.data(), tmp.size());
629   }
630 };
631 
TEST_F(AvbAtxSlotVerifyTest,SlotVerifyWithAtx)632 TEST_F(AvbAtxSlotVerifyTest, SlotVerifyWithAtx) {
633   std::string metadata_option = "--public_key_metadata=";
634   metadata_option += kMetadataPath;
635   GenerateVBMetaImage("vbmeta_a.img",
636                       "SHA512_RSA4096",
637                       0,
638                       base::FilePath("test/data/testkey_atx_psk.pem"),
639                       metadata_option);
640 
641   ops_.set_expected_public_key(
642       PublicKeyAVB(base::FilePath("test/data/testkey_atx_psk.pem")));
643 
644   AvbSlotVerifyData* slot_data = NULL;
645   const char* requested_partitions[] = {"boot", NULL};
646   EXPECT_EQ(AVB_SLOT_VERIFY_RESULT_OK,
647             avb_slot_verify(ops_.avb_ops(),
648                             requested_partitions,
649                             "_a",
650                             false /* allow_verification_error */,
651                             &slot_data));
652   EXPECT_NE(nullptr, slot_data);
653   avb_slot_verify_data_free(slot_data);
654   EXPECT_EQ(1, num_atx_calls_);
655 }
656 
657 }  // namespace avb
658