Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 08cda5d4 authored by Sean Thomas's avatar Sean Thomas
Browse files

Add VTS test that checks for substring "keymint" 

This CL exposes a function that allows the checking for a
a substring of the component name in the configuration
descriptor of the leaf certificate for the DICE chain in a
CSR.

The aim is to use this function to check for the substring
"keymint" in the primary KeyMint ("default") instance.

In the bug referenced below, look at third bullet in
comment#13.

Test: m libhwtrust_cxx
      atest libkeymint_remote_prov_support_test
Bug: 376297620
Change-Id: Ic81bf8d074b5afeec011513e7dfbc55a1e5da435
parent e20eecb7

security/keymint/support/include/remote_prov/remote_prov_utils.h

+5 −0
Original line number Diff line number Diff line
@@ -222,6 +222,11 @@ ErrMsgOr<bool> compareRootPublicKeysInDiceChains(const std::vector<uint8_t>& csr 
                                                 const std::vector<uint8_t>& csr2,

                                                 std::string_view instanceName2);



/** Checks whether the component name in the configuration descriptor in the leaf certificate

 * of the primary KeyMint instance's DICE certificate chain contains "keymint"

 */

ErrMsgOr<bool> verifyComponentNameInKeyMintDiceChain(const std::vector<uint8_t>& csr);



/** Verify the DICE chain. */

ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc,

                                                hwtrust::DiceChain::Kind kind, bool allowAnyMode,

security/keymint/support/remote_prov_utils.cpp

+27 −1
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ constexpr int32_t kBccPayloadSubjPubKey = -4670552; 
constexpr int32_t kBccPayloadKeyUsage = -4670553;

constexpr int kP256AffinePointSize = 32;

constexpr uint32_t kNumTeeDeviceInfoEntries = 14;

constexpr std::string_view kKeyMintComponentName = "keymint";



using EC_KEY_Ptr = bssl::UniquePtr<EC_KEY>;

using EVP_PKEY_Ptr = bssl::UniquePtr<EVP_PKEY>;
@@ -882,7 +883,7 @@ ErrMsgOr<bool> isCsrWithProperDiceChain(const std::vector<uint8_t>& encodedCsr, 
    return diceChain->IsProper();

}



std::string hexlify(const std::vector<unsigned char>& bytes) {

std::string hexlify(const std::vector<uint8_t>& bytes) {

    std::stringstream ss;

    ss << std::hex << std::setfill('0');
@@ -944,4 +945,29 @@ ErrMsgOr<bool> compareRootPublicKeysInDiceChains(const std::vector<uint8_t>& enc 
    return *result;

}



ErrMsgOr<bool> verifyComponentNameInKeyMintDiceChain(const std::vector<uint8_t>& encodedCsr) {

    auto diceChainKind = getDiceChainKind();

    if (!diceChainKind) {

        return diceChainKind.message();

    }



    auto csr = hwtrust::Csr::validate(encodedCsr, *diceChainKind, false /*isFactory*/,

                                      false /*allowAnyMode*/, deviceSuffix(DEFAULT_INSTANCE_NAME));

    if (!csr.ok()) {

        return csr.error().message();

    }



    auto diceChain = csr->getDiceChain();

    if (!diceChain.ok()) {

        return diceChain.error().message();

    }



    auto satisfied = diceChain->componentNameContains(kKeyMintComponentName);

    if (!satisfied.ok()) {

        return satisfied.error().message();

    }



    return *satisfied;

}



}  // namespace aidl::android::hardware::security::keymint::remote_prov

security/keymint/support/remote_prov_utils_test.cpp

+86 −0
Original line number Diff line number Diff line
@@ -408,6 +408,82 @@ inline const std::vector<uint8_t> kCsrWithoutUdsCerts{ 
        0x35, 0x2e, 0x34, 0x32, 0x3a, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x72, 0x65, 0x6c, 0x65, 0x61,

        0x73, 0x65, 0x2d, 0x6b, 0x65, 0x79, 0x73};



inline const std::vector<uint8_t> kCsrWithKeyMintInComponentName{

        0x85, 0x01, 0xa0, 0x82, 0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20, 0x44,

        0xfd, 0xdd, 0xf1, 0x8a, 0x78, 0xa0, 0xbe, 0x37, 0x49, 0x51, 0x85, 0xfb, 0x7a, 0x16, 0xca,

        0xc1, 0x00, 0xb3, 0x78, 0x13, 0x4a, 0x90, 0x4c, 0x5a, 0xa1, 0x3b, 0xfc, 0xea, 0xb6, 0xf3,

        0x16, 0x22, 0x58, 0x20, 0x12, 0x7f, 0xf5, 0xe2, 0x14, 0xbd, 0x5d, 0x51, 0xd3, 0x7f, 0x2f,

        0x1f, 0x9c, 0xc2, 0x18, 0x31, 0x94, 0x13, 0x52, 0x31, 0x3d, 0x43, 0xc9, 0x39, 0xbc, 0xc9,

        0x06, 0xb0, 0xb2, 0xa9, 0x0e, 0x59, 0x84, 0x43, 0xa1, 0x01, 0x26, 0xa0, 0x59, 0x01, 0x0e,

        0xa9, 0x01, 0x66, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x02, 0x67, 0x73, 0x75, 0x62, 0x6a,

        0x65, 0x63, 0x74, 0x3a, 0x00, 0x47, 0x44, 0x50, 0x58, 0x20, 0x55, 0x55, 0x55, 0x55, 0x55,

        0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,

        0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x3a, 0x00, 0x47,

        0x44, 0x52, 0x58, 0x20, 0x88, 0x44, 0x82, 0xb6, 0x6c, 0x9c, 0xcb, 0x2e, 0xe8, 0xdc, 0xb4,

        0xe9, 0xd3, 0xf7, 0x87, 0x63, 0x03, 0xaa, 0x90, 0x9d, 0xd9, 0xcb, 0xc3, 0x81, 0x03, 0x5b,

        0xa9, 0xa2, 0x75, 0xe8, 0xfa, 0x50, 0x3a, 0x00, 0x47, 0x44, 0x53, 0x58, 0x1e, 0xa1, 0x3a,

        0x00, 0x01, 0x11, 0x71, 0x77, 0x4d, 0x6f, 0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6e, 0x20,

        0x6a, 0x75, 0x73, 0x74, 0x20, 0x6b, 0x65, 0x79, 0x6d, 0x69, 0x6e, 0x74, 0x3f, 0x3a, 0x00,

        0x47, 0x44, 0x54, 0x58, 0x20, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,

        0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,

        0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x3a, 0x00, 0x47, 0x44, 0x56, 0x41, 0x01, 0x3a,

        0x00, 0x47, 0x44, 0x57, 0x58, 0x4d, 0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58,

        0x20, 0xe7, 0x0e, 0x4b, 0xcb, 0x8d, 0x4a, 0xd0, 0x36, 0x7f, 0xbf, 0x19, 0xdd, 0x9a, 0xd9,

        0x43, 0x62, 0xab, 0x29, 0x13, 0x1e, 0x14, 0x98, 0x68, 0xee, 0x5d, 0xae, 0xfa, 0x2f, 0x49,

        0x99, 0xfa, 0x0b, 0x22, 0x58, 0x20, 0xfb, 0x9f, 0xd3, 0xd8, 0x67, 0x86, 0x81, 0x5f, 0xb3,

        0x84, 0x00, 0x32, 0xc4, 0xe8, 0x7e, 0x9b, 0xb2, 0x4c, 0x1d, 0xd7, 0x71, 0x0d, 0x8f, 0xe0,

        0x26, 0xc6, 0x73, 0xb1, 0x8f, 0x2d, 0x02, 0xf8, 0x3a, 0x00, 0x47, 0x44, 0x58, 0x41, 0x20,

        0x58, 0x40, 0x8f, 0xb9, 0x41, 0x5f, 0xa7, 0x48, 0xe4, 0xe3, 0xfb, 0x80, 0xbf, 0x2e, 0x30,

        0xb8, 0xc9, 0x2c, 0xe4, 0x74, 0x4f, 0x4c, 0xb1, 0x79, 0xfb, 0x42, 0x43, 0x1e, 0xb4, 0x6c,

        0x6a, 0x37, 0xaf, 0x3a, 0x76, 0x15, 0x16, 0x1f, 0x25, 0x26, 0x27, 0x1b, 0x9c, 0x5c, 0xcf,

        0x9a, 0xfd, 0xb0, 0x82, 0xad, 0xe4, 0xd1, 0xd9, 0x04, 0x80, 0x80, 0x1a, 0x21, 0x12, 0x3e,

        0x81, 0xff, 0x0c, 0x23, 0x3d, 0x0a, 0x84, 0x43, 0xa1, 0x01, 0x26, 0xa0, 0x59, 0x02, 0x10,

        0x82, 0x58, 0x20, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c,

        0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,

        0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x59, 0x01, 0xea, 0x84, 0x03, 0x67, 0x6b, 0x65, 0x79, 0x6d,

        0x69, 0x6e, 0x74, 0xae, 0x65, 0x62, 0x72, 0x61, 0x6e, 0x64, 0x66, 0x47, 0x6f, 0x6f, 0x67,

        0x6c, 0x65, 0x65, 0x66, 0x75, 0x73, 0x65, 0x64, 0x01, 0x65, 0x6d, 0x6f, 0x64, 0x65, 0x6c,

        0x65, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x66, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x66, 0x64,

        0x65, 0x76, 0x69, 0x63, 0x65, 0x67, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x65, 0x70,

        0x69, 0x78, 0x65, 0x6c, 0x68, 0x76, 0x62, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x65, 0x67,

        0x72, 0x65, 0x65, 0x6e, 0x6a, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,

        0x62, 0x31, 0x32, 0x6c, 0x6d, 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x65,

        0x72, 0x66, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x6d, 0x76, 0x62, 0x6d, 0x65, 0x74, 0x61,

        0x5f, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x4f, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,

        0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69,

        0x74, 0x79, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x63, 0x74, 0x65, 0x65, 0x70, 0x62, 0x6f,

        0x6f, 0x74, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x1a,

        0x01, 0x34, 0x8c, 0x62, 0x70, 0x62, 0x6f, 0x6f, 0x74, 0x6c, 0x6f, 0x61, 0x64, 0x65, 0x72,

        0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x66, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x72, 0x73,

        0x79, 0x73, 0x74, 0x65, 0x6d, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x5f, 0x6c, 0x65, 0x76,

        0x65, 0x6c, 0x1a, 0x01, 0x34, 0x8c, 0x61, 0x72, 0x76, 0x65, 0x6e, 0x64, 0x6f, 0x72, 0x5f,

        0x70, 0x61, 0x74, 0x63, 0x68, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x1a, 0x01, 0x34, 0x8c,

        0x63, 0x82, 0xa6, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20, 0x40, 0x9a, 0x39,

        0x4d, 0xe2, 0xc5, 0x48, 0x58, 0x6e, 0xaa, 0x17, 0x81, 0x8a, 0xba, 0xc4, 0xea, 0x20, 0x23,

        0xc4, 0xf3, 0xdc, 0xfa, 0x78, 0x9f, 0x5b, 0x7d, 0x30, 0xd2, 0x3d, 0x6f, 0x42, 0xa8, 0x22,

        0x58, 0x20, 0x3e, 0x85, 0x73, 0xe5, 0x86, 0x57, 0x45, 0x72, 0xcd, 0xf2, 0xe8, 0x62, 0x93,

        0xf3, 0xea, 0xbf, 0x21, 0x57, 0xa9, 0x25, 0xe7, 0xa8, 0x2a, 0xa0, 0xd0, 0x0a, 0x1d, 0xa5,

        0x81, 0x22, 0xd0, 0xe1, 0x23, 0x58, 0x21, 0x00, 0x95, 0x00, 0xea, 0x43, 0x32, 0x8d, 0x2e,

        0x1c, 0x18, 0x6d, 0x73, 0x34, 0xa2, 0xe4, 0x53, 0x64, 0x20, 0x95, 0x25, 0x8d, 0x4b, 0x97,

        0x71, 0x13, 0xdf, 0xa6, 0x0e, 0xdc, 0x5b, 0x66, 0x66, 0x0b, 0xa6, 0x01, 0x02, 0x03, 0x26,

        0x20, 0x01, 0x21, 0x58, 0x20, 0xa4, 0x81, 0xd9, 0xa0, 0x37, 0x89, 0xb1, 0x5d, 0x22, 0xf1,

        0x22, 0x7e, 0x19, 0x00, 0xf1, 0x87, 0xdf, 0x10, 0x88, 0x1f, 0x64, 0xc5, 0x46, 0x6d, 0x91,

        0x9d, 0x6c, 0x86, 0x3b, 0x67, 0x07, 0x14, 0x22, 0x58, 0x20, 0x3c, 0x42, 0x1f, 0x47, 0x62,

        0x2c, 0x4f, 0x08, 0x29, 0xe9, 0xc6, 0x0c, 0x7c, 0xe5, 0x11, 0xc6, 0x39, 0x69, 0xc9, 0x9d,

        0xdf, 0x69, 0x18, 0x8e, 0xdb, 0x99, 0x87, 0x52, 0x2f, 0x6b, 0xb4, 0x6a, 0x23, 0x58, 0x21,

        0x00, 0x83, 0xa2, 0x6f, 0x5b, 0x3a, 0x71, 0x7c, 0x66, 0x3c, 0x96, 0x3f, 0x4e, 0x42, 0x6f,

        0x98, 0x45, 0x1f, 0x59, 0x50, 0x03, 0x48, 0x9b, 0x57, 0xf5, 0x0e, 0x0f, 0x96, 0x30, 0xa4,

        0xd6, 0xc3, 0x45, 0x58, 0x40, 0x8b, 0xdf, 0xc8, 0xc7, 0x6d, 0xa4, 0x02, 0xec, 0x3c, 0x5d,

        0x90, 0x73, 0x0f, 0x8c, 0x10, 0x0f, 0x99, 0xd2, 0x85, 0x6e, 0x03, 0x45, 0x55, 0x28, 0xf7,

        0x64, 0x0b, 0xbd, 0x7c, 0x3a, 0x69, 0xf1, 0x80, 0x1a, 0xf3, 0x93, 0x7e, 0x82, 0xfc, 0xa5,

        0x3b, 0x69, 0x98, 0xf1, 0xde, 0x06, 0xb6, 0x72, 0x78, 0x0b, 0xdb, 0xbb, 0x97, 0x20, 0x04,

        0x98, 0xb0, 0xd4, 0x07, 0x83, 0x65, 0xfb, 0xf8, 0x9c, 0xa1, 0x6b, 0x66, 0x69, 0x6e, 0x67,

        0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x78, 0x3b, 0x62, 0x72, 0x61, 0x6e, 0x64, 0x31,

        0x2f, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x31, 0x2f, 0x64, 0x65, 0x76, 0x69, 0x63,

        0x65, 0x31, 0x3a, 0x31, 0x31, 0x2f, 0x69, 0x64, 0x2f, 0x32, 0x30, 0x32, 0x31, 0x30, 0x38,

        0x30, 0x35, 0x2e, 0x34, 0x32, 0x3a, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x72, 0x65, 0x6c, 0x65,

        0x61, 0x73, 0x65, 0x2d, 0x6b, 0x65, 0x79, 0x73};



inline const std::vector<uint8_t> kCsrWithSharedUdsRoot1{

        0x85, 0x01, 0xa0, 0x82, 0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20, 0x96,

        0xf9, 0xf7, 0x16, 0xa7, 0xe2, 0x20, 0xe3, 0x6e, 0x19, 0x8e, 0xc0, 0xc4, 0x82, 0xc5, 0xca,
@@ -930,6 +1006,16 @@ TEST(RemoteProvUtilsTest, compareRootPublicKeysInDiceChains) { 
    ASSERT_FALSE(*notEqual) << "Root public keys in DICE chains match.";

}



TEST(RemoteProvUtilsTest, componentNameInLeafCertificateOfDiceChainContainsKeyMint) {

    auto result = verifyComponentNameInKeyMintDiceChain(kCsrWithKeyMintInComponentName);

    ASSERT_TRUE(result) << result.message();

    ASSERT_TRUE(*result) << "Leaf Certificate in CSR does not contain 'keymint' in component name";



    auto result2 = verifyComponentNameInKeyMintDiceChain(kCsrWithUdsCerts);

    ASSERT_TRUE(result2) << result2.message();

    ASSERT_FALSE(*result2) << "Leaf Certificate in CSR contains 'keymint' in component name";

}



TEST(RemoteProvUtilsTest, parseFullyQualifiedInstanceNames) {

    ASSERT_EQ(deviceSuffix(RKPVM_INSTANCE_NAME), "avf");

    ASSERT_EQ(deviceSuffix(DEFAULT_INSTANCE_NAME), "default");

security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp

+39 −6
Original line number Diff line number Diff line
@@ -238,6 +238,7 @@ TEST(NonParameterizedTests, eachRpcHasAUniqueId) { 
 * on the device.

 */

// @VsrTest = 3.10-015

// @VsrTest = 3.10-018.001

TEST(NonParameterizedTests, requireDiceOnDefaultInstanceIfStrongboxPresent) {

    int vsr_api_level = get_vsr_api_level();

    if (vsr_api_level < 35) {
@@ -270,12 +271,10 @@ TEST(NonParameterizedTests, requireDiceOnDefaultInstanceIfStrongboxPresent) { 
// @VsrTest = 7.1-003.001

TEST(NonParameterizedTests, equalUdsPubInDiceCertChainForRkpVmAndPrimaryKeyMintInstances) {

    int apiLevel = get_vsr_api_level();

    if (apiLevel < 202504) {

        if (!AServiceManager_isDeclared(RKPVM_INSTANCE_NAME.c_str())) {

            GTEST_SKIP() << "The RKP VM (" << RKPVM_INSTANCE_NAME

                         << ") is not present on this device.";

    if (apiLevel < 202504 && !AServiceManager_isDeclared(RKPVM_INSTANCE_NAME.c_str())) {

        GTEST_SKIP() << "The RKP VM (" << RKPVM_INSTANCE_NAME << ") is not present on this device.";

    }

    } else {

    if (apiLevel >= 202504) {

        ASSERT_TRUE(AServiceManager_isDeclared(RKPVM_INSTANCE_NAME.c_str()));

    }
@@ -311,6 +310,40 @@ TEST(NonParameterizedTests, equalUdsPubInDiceCertChainForRkpVmAndPrimaryKeyMintI 
    ASSERT_TRUE(*equal) << "Primary KeyMint and RKP VM RPCs have different UDS public keys";

}



/**

 * Suppose that there is a StrongBox KeyMint instance on the device.

 *

 * Then, this test verifies that "keymint" is a substring of the component name in the configuration

 * descriptor in the leaf certificate of the DICE chain for the primary ("default") KeyMint

 * instance.

 */

// @VsrTest = 3.10-018.003

TEST(NonParameterizedTests, componentNameInConfigurationDescriptorForPrimaryKeyMintInstance) {

    int vsr_api_level = get_vsr_api_level();

    if (vsr_api_level < 202504) {

        GTEST_SKIP() << "Applies only to VSR API level 202504 or newer, this device is: "

                     << vsr_api_level;

    }



    if (!AServiceManager_isDeclared(KEYMINT_STRONGBOX_INSTANCE_NAME.c_str())) {

        GTEST_SKIP() << "Strongbox is not present on this device.";

    }



    ::ndk::SpAIBinder binder(AServiceManager_waitForService(DEFAULT_INSTANCE_NAME.c_str()));

    std::shared_ptr<IRemotelyProvisionedComponent> rpc =

            IRemotelyProvisionedComponent::fromBinder(binder);

    ASSERT_NE(rpc, nullptr);



    bytevec challenge = randomBytes(64);

    bytevec csr;

    auto status = rpc->generateCertificateRequestV2({} /* keysToSign */, challenge, &csr);

    EXPECT_TRUE(status.isOk()) << status.getDescription();



    auto result = verifyComponentNameInKeyMintDiceChain(csr);

    ASSERT_TRUE(result) << result.message();

    ASSERT_TRUE(*result);

}



using GetHardwareInfoTests = VtsRemotelyProvisionedComponentTests;



INSTANTIATE_REM_PROV_AIDL_TEST(GetHardwareInfoTests);