Commit: ce7ccf42a9a803f46217409028fed417ab2a22ce - system-hardware-interfaces (git)

system/hardware/interfaces

Commit MetaInfo

• Revisão: ce7ccf42a9a803f46217409028fed417ab2a22ce (tree)
• Hora: 2019-02-01 01:29:41
• Autor: Branden Archer <brarcher@goog...>
• Commiter: android-build-merger

Mensagem de Log

Add VTS for Wifi Keystore HAL's sign() am: 317497a968 am: 316ec32f1a
am: 84df885f1c

Change-Id: I908c7f15a79016595f6d138075246f94b50a2edb

Mudança Sumário

• modified: wifi/keystore/1.0/vts/functional/Android.bp
• modified: wifi/keystore/1.0/vts/functional/VtsHalWifiKeystoreV1_0TargetTest.cpp

Diff

--- a/wifi/keystore/1.0/vts/functional/Android.bp
+++ b/wifi/keystore/1.0/vts/functional/Android.bp
@@ -28,6 +28,12 @@ cc_test {
         "libnativehelper",
         "libutils",
         "android.system.wifi.keystore@1.0",
+        "libwifikeystorehal",
+        "libkeystore_binder",
+        "libbinder",
+        "libkeystore_aidl",
+        "libkeystore_parcelables",
+        "libkeymaster4support",
     ],
     static_libs: ["VtsHalHidlTargetTestBase"],
     cflags: [

--- a/wifi/keystore/1.0/vts/functional/VtsHalWifiKeystoreV1_0TargetTest.cpp
+++ b/wifi/keystore/1.0/vts/functional/VtsHalWifiKeystoreV1_0TargetTest.cpp
@@ -17,10 +17,233 @@
 #include <android-base/logging.h>
 
 #include <VtsHalHidlTargetTestBase.h>
+#include <binder/ProcessState.h>
+#include <keymasterV4_0/authorization_set.h>
+#include <keystore/keystore_promises.h>
+#include <private/android_filesystem_config.h>
+#include <utils/String16.h>
+#include <wifikeystorehal/keystore.h>
+
+using namespace std;
+using namespace ::testing;
+using namespace android;
+using namespace android::binder;
+using namespace android::security::keystore;
+using namespace android::security::keymaster;
+using namespace android::system::wifi::keystore::V1_0;
 
 int main(int argc, char** argv) {
-    ::testing::InitGoogleTest(&argc, argv);
+    // Start thread pool for Binder
+    android::ProcessState::self()->startThreadPool();
+
+    InitGoogleTest(&argc, argv);
     int status = RUN_ALL_TESTS();
-    LOG(INFO) << "Test result = " << status;
     return status;
 }
+
+namespace {
+
+enum KeyPurpose {
+    ENCRYPTION,
+    SIGNING,
+};
+
+// The fixture for testing the Wifi Keystore HAL
+class WifiKeystoreHalTest : public Test {
+   protected:
+    void SetUp() override {
+        keystore = implementation::HIDL_FETCH_IKeystore(nullptr);
+
+        sp<android::IServiceManager> service_manager = android::defaultServiceManager();
+        sp<android::IBinder> keystore_binder =
+            service_manager->getService(String16(kKeystoreServiceName));
+        service = interface_cast<IKeystoreService>(keystore_binder);
+
+        EXPECT_NE(nullptr, service.get());
+
+        deleteKey(kTestKeyName);
+    }
+
+    void TearDown() override { deleteKey(kTestKeyName); }
+
+    /**
+     * Delete a key if it exists.
+     *
+     * @param keyName: name of the key to delete
+     *
+     * @return true iff the key existed and is now deleted, false otherwise.
+     */
+    bool deleteKey(std::string keyName) {
+        String16 keyName16(keyName.data(), keyName.size());
+        int32_t result;
+        auto binder_result = service->del(keyName16, -1 /* process' uid*/, &result);
+        if (!binder_result.isOk()) {
+            cout << "deleteKey: failed binder call" << endl;
+            return false;
+        }
+
+        keystore::KeyStoreNativeReturnCode wrappedResult(result);
+        return wrappedResult.isOk();
+    }
+
+    /**
+     * Generate a key for a specific purpose.
+     *
+     * This generates a key which can be used either for signing
+     * or encryption. The signing key is setup to be used in
+     * the Wifi Keystore HAL's sign() call. The data
+     * about the key returning from its generation is discarded.
+     * If this returns 'true' the key generation has completed
+     * and the key is ready for use.
+     *
+     * @param keyName: name of the key to generate
+     * @param purpose: the purpose the generated key will support
+     *
+     * @return true iff the key was successfully generated and is
+     * ready for use, false otherwise.
+     */
+    bool generateKey(std::string keyName, KeyPurpose purpose) {
+        constexpr uint32_t kAESKeySize = 256;
+
+        int32_t aidl_return;
+        vector<uint8_t> entropy;
+        keystore::AuthorizationSetBuilder key_parameters;
+        if (purpose == KeyPurpose::SIGNING) {
+            key_parameters.EcdsaSigningKey(kAESKeySize);
+        }
+
+        if (purpose == KeyPurpose::ENCRYPTION) {
+            key_parameters.AesEncryptionKey(kAESKeySize);
+        }
+
+        key_parameters.NoDigestOrPadding()
+            .Authorization(keystore::keymaster::TAG_BLOCK_MODE, keystore::keymaster::BlockMode::CBC)
+            .Authorization(keystore::keymaster::TAG_NO_AUTH_REQUIRED);
+
+        sp<keystore::KeyCharacteristicsPromise> promise(new keystore::KeyCharacteristicsPromise);
+        auto future = promise->get_future();
+
+        String16 keyName16(keyName.data(), keyName.size());
+
+        fflush(stdout);
+        auto binder_result = service->generateKey(
+            promise, keyName16, KeymasterArguments(key_parameters.hidl_data()), entropy,
+            -1,  // create key for process' uid
+            0,   // empty flags; pick default key provider
+            &aidl_return);
+
+        if (!binder_result.isOk()) {
+            cout << "generateKey: Failed binder call" << endl;
+            return false;
+        }
+
+        keystore::KeyStoreNativeReturnCode rc(aidl_return);
+        if (!rc.isOk()) {
+            cout << "generateKey: Failed to generate key" << endl;
+            return false;
+        }
+
+        auto [km_response, characteristics] = future.get();
+
+        return true;
+    }
+
+    /**
+     * Creates a TYPE_GENERIC key blob. This cannot be used for signing.
+     *
+     * @param keyName: name of the key to generate.
+     *
+     * @returns true iff the key was successfully created, false otherwise.
+     */
+    bool insert(std::string keyName) {
+        int32_t aidl_return;
+        vector<uint8_t> item;
+
+        String16 keyName16(keyName.data(), keyName.size());
+        auto binder_result = service->insert(keyName16, item,
+                                             -1,  // Use process' uid
+                                             0,   // empty flags; pick default key provider
+                                             &aidl_return);
+
+        if (!binder_result.isOk()) {
+            cout << "insert: Failed binder call" << endl;
+            return false;
+        }
+
+        keystore::KeyStoreNativeReturnCode rc(aidl_return);
+        if (!rc.isOk()) {
+            cout << "insert: Failed to generate key" << endl;
+            return false;
+        }
+
+        return true;
+    }
+
+    constexpr static const char kKeystoreServiceName[] = "android.security.keystore";
+    constexpr static const char kTestKeyName[] = "TestKeyName";
+
+    IKeystore* keystore = nullptr;
+    sp<IKeystoreService> service;
+};
+
+/**
+ * Test for the Wifi Keystore HAL's sign() call.
+ */
+TEST_F(WifiKeystoreHalTest, Sign) {
+    IKeystore::KeystoreStatusCode statusCode;
+
+    auto callback = [&statusCode](IKeystore::KeystoreStatusCode status,
+                                  const ::android::hardware::hidl_vec<uint8_t>& /*value*/) {
+        statusCode = status;
+        return;
+    };
+
+    ::android::hardware::hidl_vec<uint8_t> dataToSign;
+
+    // These attempts do not include an existing key to use
+
+    keystore->sign(nullptr, dataToSign, callback);
+    EXPECT_EQ(IKeystore::KeystoreStatusCode::ERROR_UNKNOWN, statusCode);
+
+    keystore->sign("", dataToSign, callback);
+    EXPECT_EQ(IKeystore::KeystoreStatusCode::ERROR_UNKNOWN, statusCode);
+
+    bool result = generateKey(kTestKeyName, KeyPurpose::SIGNING);
+    EXPECT_EQ(result, true);
+
+    // The data to sign is empty, and a failure is expected
+
+    keystore->sign(kTestKeyName, dataToSign, callback);
+    EXPECT_EQ(IKeystore::KeystoreStatusCode::ERROR_UNKNOWN, statusCode);
+
+    // With data the signing attempt should succeed
+
+    dataToSign.resize(100);
+    keystore->sign(kTestKeyName, dataToSign, callback);
+    EXPECT_EQ(IKeystore::KeystoreStatusCode::SUCCESS, statusCode);
+
+    // Create a key which cannot sign; any signing attempt should fail.
+
+    result = deleteKey(kTestKeyName);
+    EXPECT_EQ(result, true);
+
+    result = generateKey(kTestKeyName, KeyPurpose::ENCRYPTION);
+    EXPECT_EQ(result, true);
+
+    keystore->sign(kTestKeyName, dataToSign, callback);
+    EXPECT_EQ(IKeystore::KeystoreStatusCode::ERROR_UNKNOWN, statusCode);
+
+    // Generate a TYPE_GENERIC key instead of a TYPE_KEYMASTER_10 key.
+    // This also cannot be used to sign.
+
+    result = deleteKey(kTestKeyName);
+    EXPECT_EQ(result, true);
+
+    result = insert(kTestKeyName);
+    EXPECT_EQ(result, true);
+
+    keystore->sign(kTestKeyName, dataToSign, callback);
+    EXPECT_EQ(IKeystore::KeystoreStatusCode::ERROR_UNKNOWN, statusCode);
+}
+
+}  // namespace