Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36a80e6e authored by Sean Thomas's avatar Sean Thomas
Browse files

Make VTS test only apply to RKP VM (i.e. avf) 

Check that the RKP VM has a non-normal DICE chain if and only if the
bootloader is not locked.

Bug: 388092592
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: Idbf03de2806ff4e39212f7ff623c1bdc5e762cc8
parent d7e02b58

security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp

+47 −31
Original line number Diff line number Diff line
@@ -344,6 +344,53 @@ TEST(NonParameterizedTests, componentNameInConfigurationDescriptorForPrimaryKeyM 
    ASSERT_TRUE(*result);

}



/**

 * Check that ro.boot.vbmeta.device_state is not "locked" or ro.boot.verifiedbootstate

 * is not "green" if and only if the mode on at least one certificate in the DICE chain

 * is non-normal.

 */

TEST(NonParameterizedTests, unlockedBootloaderStatesImpliesNonnormalRkpVmDiceChain) {

    if (!AServiceManager_isDeclared(RKPVM_INSTANCE_NAME.c_str())) {

        GTEST_SKIP() << "The RKP VM (" << RKPVM_INSTANCE_NAME << ") is not present on this device.";

    }



    auto rpc = getHandle<IRemotelyProvisionedComponent>(RKPVM_INSTANCE_NAME);

    ASSERT_NE(rpc, nullptr) << "The RKP VM (" << RKPVM_INSTANCE_NAME << ") RPC is unavailable.";



    RpcHardwareInfo hardwareInfo;

    auto status = rpc->getHardwareInfo(&hardwareInfo);

    if (!status.isOk()) {

        GTEST_SKIP() << "The RKP VM is not supported on this system.";

    }



    auto challenge = randomBytes(MAX_CHALLENGE_SIZE);

    bytevec csr;

    auto rkpVmStatus = rpc->generateCertificateRequestV2({} /* keysToSign */, challenge, &csr);

    ASSERT_TRUE(rkpVmStatus.isOk()) << status.getDescription();



    auto isProper = isCsrWithProperDiceChain(csr, RKPVM_INSTANCE_NAME);

    ASSERT_TRUE(isProper) << isProper.message();

    if (!*isProper) {

        GTEST_SKIP() << "Skipping test: Only a proper DICE chain has a mode set.";

    }



    auto nonNormalMode = hasNonNormalModeInDiceChain(csr, RKPVM_INSTANCE_NAME);

    ASSERT_TRUE(nonNormalMode) << nonNormalMode.message();



    auto deviceState = ::android::base::GetProperty("ro.boot.vbmeta.device_state", "");

    auto verifiedBootState = ::android::base::GetProperty("ro.boot.verifiedbootstate", "");



    ASSERT_TRUE(!deviceState.empty());

    ASSERT_TRUE(!verifiedBootState.empty());



    ASSERT_EQ(deviceState != "locked" || verifiedBootState != "green", *nonNormalMode)

            << "ro.boot.vbmeta.device_state = '" << deviceState

            << "' and ro.boot.verifiedbootstate = '" << verifiedBootState << "', but the DICE "

            << " chain has a " << (*nonNormalMode ? "non-normal" : "normal") << " DICE mode."

            << " Locked devices must report normal, and unlocked devices must report "

            << " non-normal.";

}



using GetHardwareInfoTests = VtsRemotelyProvisionedComponentTests;



INSTANTIATE_REM_PROV_AIDL_TEST(GetHardwareInfoTests);
@@ -848,37 +895,6 @@ class CertificateRequestV2Test : public CertificateRequestTestBase { 
    }

};



/**

 * Check that ro.boot.vbmeta.device_state is not "locked" or ro.boot.verifiedbootstate

 * is not "green" if and only if the mode on at least one certificate in the DICE chain

 * is non-normal.

 */

TEST_P(CertificateRequestV2Test, DISABLED_unlockedBootloaderStatesImpliesNonnormalDiceChain) {

    auto challenge = randomBytes(MAX_CHALLENGE_SIZE);

    bytevec csr;

    auto status =

            provisionable_->generateCertificateRequestV2({} /* keysToSign */, challenge, &csr);

    ASSERT_TRUE(status.isOk()) << status.getDescription();



    auto isProper = isCsrWithProperDiceChain(csr, GetParam());

    ASSERT_TRUE(isProper) << isProper.message();

    if (!*isProper) {

        GTEST_SKIP() << "Skipping test: Only a proper DICE chain has a mode set.";

    }



    auto nonNormalMode = hasNonNormalModeInDiceChain(csr, GetParam());

    ASSERT_TRUE(nonNormalMode) << nonNormalMode.message();



    auto deviceState = ::android::base::GetProperty("ro.boot.vbmeta.device_state", "");

    auto verifiedBootState = ::android::base::GetProperty("ro.boot.verifiedbootstate", "");



    ASSERT_EQ(deviceState != "locked" || verifiedBootState != "green", *nonNormalMode)

            << "ro.boot.vbmeta.device_state = '" << deviceState

            << "' and ro.boot.verifiedbootstate = '" << verifiedBootState << "', but it is "

            << *nonNormalMode

            << " that the DICE chain has a certificate with a non-normal mode set.";

}



/**

 * Generate an empty certificate request with all possible length of challenge, and decrypt and

 * verify the structure and content.