Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 57b34793 authored by Selene Huang's avatar Selene Huang Committed by David Zeuthen
Browse files

Add attestation certificate parsing and validate for IC vts. 

 - Added attestation certificate parsing support.
 - Added various certificate conversion support.
 - Added certification verification support.
 - Added tests for the attestation certificate verification.
 - Updated the old tests to use the new attestation validation
   implementation.
 - Updated GenerateReaderCertificate to use pointer reader private key.

Bug: 154909726
Test: VtsHalIdentityTargetTest
Test: atest android.security.identity.cts
Merged-In: Ibe770e6eaf0b0018d60876926d824204e4eaf732
Change-Id: I07c2eaf92ed60fa31761816c4b45684806c3305e
parent 38ca6961

identity/aidl/vts/Android.bp

+6 −0
Original line number Diff line number Diff line
@@ -8,10 +8,16 @@ cc_test { 
        "VtsHalIdentityEndToEndTest.cpp",

        "VtsIWritableIdentityCredentialTests.cpp",

        "VtsIdentityTestUtils.cpp",

        "VtsAttestationTests.cpp",

        "VtsAttestationParserSupport.cpp",

    ],

    shared_libs: [

        "android.hardware.keymaster@4.0",

        "libbinder",

        "libcrypto",

        "libkeymaster_portable",

        "libsoft_attestation_cert",

        "libpuresoftkeymasterdevice",

    ],

    static_libs: [

        "libcppbor",

identity/aidl/vts/VtsHalIdentityEndToEndTest.cpp

+11 −10
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ 
 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#define LOG_TAG "VtsHalIdentityTargetTest"

#define LOG_TAG "VtsHalIdentityEndToEndTest"



#include <aidl/Gtest.h>

#include <aidl/Vintf.h>
@@ -45,6 +45,8 @@ using ::android::binder::Status; 
using ::android::hardware::keymaster::HardwareAuthToken;

using ::android::hardware::keymaster::VerificationToken;



using test_utils::validateAttestationCertificate;



class IdentityAidl : public testing::TestWithParam<std::string> {

  public:

    virtual void SetUp() override {
@@ -69,13 +71,13 @@ TEST_P(IdentityAidl, createAndRetrieveCredential) { 
    // part of the request data.

    vector<uint8_t> readerKey;

    optional<vector<uint8_t>> readerCertificate =

            test_utils::GenerateReaderCertificate("1234", readerKey);

            test_utils::generateReaderCertificate("1234", &readerKey);

    ASSERT_TRUE(readerCertificate);



    // Make the portrait image really big (just shy of 256 KiB) to ensure that

    // the chunking code gets exercised.

    vector<uint8_t> portraitImage;

    test_utils::SetImageData(portraitImage);

    test_utils::setImageData(portraitImage);



    // Access control profiles:

    const vector<test_utils::TestProfile> testProfiles = {// Profile 0 (reader authentication)
@@ -114,17 +116,16 @@ TEST_P(IdentityAidl, createAndRetrieveCredential) { 


    string cborPretty;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    string challenge = "attestationChallenge";

    test_utils::AttestationData attData(writableCredential, challenge, {});

    ASSERT_TRUE(attData.result.isOk())

            << attData.result.exceptionCode() << "; " << attData.result.exceptionMessage() << endl;

    ASSERT_EQ(binder::Status::EX_NONE, attData.result.exceptionCode());

    ASSERT_EQ(IIdentityCredentialStore::STATUS_OK, attData.result.serviceSpecificErrorCode());



    // TODO: set it to something random and check it's in the cert chain

    ASSERT_GE(attData.attestationCertificate.size(), 2);

    EXPECT_TRUE(validateAttestationCertificate(attData.attestationCertificate,

                                               attData.attestationChallenge,

                                               attData.attestationApplicationId, hwInfo));



    // This is kinda of a hack but we need to give the size of

    // ProofOfProvisioning that we'll expect to receive.
@@ -136,7 +137,7 @@ TEST_P(IdentityAidl, createAndRetrieveCredential) { 
                    .isOk());



    optional<vector<SecureAccessControlProfile>> secureProfiles =

            test_utils::AddAccessControlProfiles(writableCredential, testProfiles);

            test_utils::addAccessControlProfiles(writableCredential, testProfiles);

    ASSERT_TRUE(secureProfiles);



    // Uses TestEntryData* pointer as key and values are the encrypted blobs. This
@@ -144,7 +145,7 @@ TEST_P(IdentityAidl, createAndRetrieveCredential) { 
    map<const test_utils::TestEntryData*, vector<vector<uint8_t>>> encryptedBlobs;



    for (const auto& entry : testEntries) {

        ASSERT_TRUE(test_utils::AddEntry(writableCredential, entry, hwInfo.dataChunkSize,

        ASSERT_TRUE(test_utils::addEntry(writableCredential, entry, hwInfo.dataChunkSize,

                                         encryptedBlobs, true));

    }

identity/aidl/vts/VtsIWritableIdentityCredentialTests.cpp

+57 −41
Original line number Diff line number Diff line
@@ -56,8 +56,12 @@ class IdentityCredentialTests : public testing::TestWithParam<string> { 


TEST_P(IdentityCredentialTests, verifyAttestationWithEmptyChallenge) {

    Status result;



    HardwareInformation hwInfo;

    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());



    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    vector<uint8_t> attestationChallenge;

    vector<Certificate> attestationCertificate;
@@ -68,13 +72,18 @@ TEST_P(IdentityCredentialTests, verifyAttestationWithEmptyChallenge) { 
    EXPECT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage()

                               << endl;



    EXPECT_TRUE(test_utils::ValidateAttestationCertificate(attestationCertificate));

    EXPECT_TRUE(test_utils::validateAttestationCertificate(

            attestationCertificate, attestationChallenge, attestationApplicationId, hwInfo));

}



TEST_P(IdentityCredentialTests, verifyAttestationSuccessWithChallenge) {

    Status result;



    HardwareInformation hwInfo;

    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());



    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    string challenge = "NotSoRandomChallenge1NotSoRandomChallenge1NotSoRandomChallenge1";

    vector<uint8_t> attestationChallenge(challenge.begin(), challenge.end());
@@ -87,17 +96,24 @@ TEST_P(IdentityCredentialTests, verifyAttestationSuccessWithChallenge) { 
    EXPECT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage()

                               << endl;



    EXPECT_TRUE(test_utils::ValidateAttestationCertificate(attestationCertificate));

    EXPECT_TRUE(test_utils::validateAttestationCertificate(

            attestationCertificate, attestationChallenge, attestationApplicationId, hwInfo));

}



TEST_P(IdentityCredentialTests, verifyAttestationDoubleCallFails) {

    Status result;



    HardwareInformation hwInfo;

    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());



    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    string challenge = "NotSoRandomChallenge1";

    test_utils::AttestationData attData(writableCredential, challenge, {});

    ASSERT_TRUE(test_utils::ValidateAttestationCertificate(attData.attestationCertificate));

    ASSERT_TRUE(test_utils::validateAttestationCertificate(

            attData.attestationCertificate, attData.attestationChallenge,

            attData.attestationApplicationId, hwInfo));



    string challenge2 = "NotSoRandomChallenge2";

    test_utils::AttestationData attData2(writableCredential, challenge2, {});
@@ -110,7 +126,7 @@ TEST_P(IdentityCredentialTests, verifyAttestationDoubleCallFails) { 
TEST_P(IdentityCredentialTests, verifyStartPersonalization) {

    Status result;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    // First call should go through

    const vector<int32_t> entryCounts = {2, 4};
@@ -131,7 +147,7 @@ TEST_P(IdentityCredentialTests, verifyStartPersonalization) { 
TEST_P(IdentityCredentialTests, verifyStartPersonalizationMin) {

    Status result;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    // Verify minimal number of profile count and entry count

    const vector<int32_t> entryCounts = {1, 1};
@@ -143,7 +159,7 @@ TEST_P(IdentityCredentialTests, verifyStartPersonalizationMin) { 
TEST_P(IdentityCredentialTests, verifyStartPersonalizationZero) {

    Status result;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    const vector<int32_t> entryCounts = {0};

    writableCredential->startPersonalization(0, entryCounts);
@@ -154,7 +170,7 @@ TEST_P(IdentityCredentialTests, verifyStartPersonalizationZero) { 
TEST_P(IdentityCredentialTests, verifyStartPersonalizationOne) {

    Status result;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    // Verify minimal number of profile count and entry count

    const vector<int32_t> entryCounts = {1};
@@ -166,7 +182,7 @@ TEST_P(IdentityCredentialTests, verifyStartPersonalizationOne) { 
TEST_P(IdentityCredentialTests, verifyStartPersonalizationLarge) {

    Status result;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    // Verify set a large number of profile count and entry count is ok

    const vector<int32_t> entryCounts = {3000};
@@ -178,7 +194,7 @@ TEST_P(IdentityCredentialTests, verifyStartPersonalizationLarge) { 
TEST_P(IdentityCredentialTests, verifyProfileNumberMismatchShouldFail) {

    Status result;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    // Enter mismatched entry and profile numbers

    const vector<int32_t> entryCounts = {5, 6};
@@ -186,7 +202,7 @@ TEST_P(IdentityCredentialTests, verifyProfileNumberMismatchShouldFail) { 
    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage()

                               << endl;



    optional<vector<uint8_t>> readerCertificate = test_utils::GenerateReaderCertificate("12345");

    optional<vector<uint8_t>> readerCertificate = test_utils::generateReaderCertificate("12345");

    ASSERT_TRUE(readerCertificate);



    const vector<test_utils::TestProfile> testProfiles = {// Profile 0 (reader authentication)
@@ -196,7 +212,7 @@ TEST_P(IdentityCredentialTests, verifyProfileNumberMismatchShouldFail) { 
                                                          {4, {}, false, 0}};



    optional<vector<SecureAccessControlProfile>> secureProfiles =

            test_utils::AddAccessControlProfiles(writableCredential, testProfiles);

            test_utils::addAccessControlProfiles(writableCredential, testProfiles);

    ASSERT_TRUE(secureProfiles);



    vector<uint8_t> credentialData;
@@ -205,7 +221,7 @@ TEST_P(IdentityCredentialTests, verifyProfileNumberMismatchShouldFail) { 
            writableCredential->finishAddingEntries(&credentialData, &proofOfProvisioningSignature);



    // finishAddingEntries should fail because the number of addAccessControlProfile mismatched with

    // startPersonalization, and begintest_utils::AddEntry was not called.

    // startPersonalization, and begintest_utils::addEntry was not called.

    EXPECT_FALSE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage()

                                << endl;

    EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, result.exceptionCode());
@@ -215,7 +231,7 @@ TEST_P(IdentityCredentialTests, verifyProfileNumberMismatchShouldFail) { 
TEST_P(IdentityCredentialTests, verifyDuplicateProfileId) {

    Status result;

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    const vector<int32_t> entryCounts = {3, 6};

    writableCredential->startPersonalization(3, entryCounts);
@@ -272,14 +288,14 @@ TEST_P(IdentityCredentialTests, verifyOneProfileAndEntryPass) { 
    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());



    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    string challenge = "NotSoRandomChallenge1";

    test_utils::AttestationData attData(writableCredential, challenge, {});

    EXPECT_TRUE(attData.result.isOk())

            << attData.result.exceptionCode() << "; " << attData.result.exceptionMessage() << endl;



    optional<vector<uint8_t>> readerCertificate1 = test_utils::GenerateReaderCertificate("123456");

    optional<vector<uint8_t>> readerCertificate1 = test_utils::generateReaderCertificate("123456");

    ASSERT_TRUE(readerCertificate1);



    const vector<int32_t> entryCounts = {1u};
@@ -293,7 +309,7 @@ TEST_P(IdentityCredentialTests, verifyOneProfileAndEntryPass) { 
    const vector<test_utils::TestProfile> testProfiles = {{1, readerCertificate1.value(), true, 1}};



    optional<vector<SecureAccessControlProfile>> secureProfiles =

            test_utils::AddAccessControlProfiles(writableCredential, testProfiles);

            test_utils::addAccessControlProfiles(writableCredential, testProfiles);

    ASSERT_TRUE(secureProfiles);



    const vector<test_utils::TestEntryData> testEntries1 = {
@@ -302,7 +318,7 @@ TEST_P(IdentityCredentialTests, verifyOneProfileAndEntryPass) { 


    map<const test_utils::TestEntryData*, vector<vector<uint8_t>>> encryptedBlobs;

    for (const auto& entry : testEntries1) {

        ASSERT_TRUE(test_utils::AddEntry(writableCredential, entry, hwInfo.dataChunkSize,

        ASSERT_TRUE(test_utils::addEntry(writableCredential, entry, hwInfo.dataChunkSize,

                                         encryptedBlobs, true));

    }
@@ -359,17 +375,17 @@ TEST_P(IdentityCredentialTests, verifyManyProfilesAndEntriesPass) { 
    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());



    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    string challenge = "NotSoRandomChallenge";

    test_utils::AttestationData attData(writableCredential, challenge, {});

    EXPECT_TRUE(attData.result.isOk())

            << attData.result.exceptionCode() << "; " << attData.result.exceptionMessage() << endl;



    optional<vector<uint8_t>> readerCertificate1 = test_utils::GenerateReaderCertificate("123456");

    optional<vector<uint8_t>> readerCertificate1 = test_utils::generateReaderCertificate("123456");

    ASSERT_TRUE(readerCertificate1);



    optional<vector<uint8_t>> readerCertificate2 = test_utils::GenerateReaderCertificate("1256");

    optional<vector<uint8_t>> readerCertificate2 = test_utils::generateReaderCertificate("1256");

    ASSERT_TRUE(readerCertificate2);



    const vector<test_utils::TestProfile> testProfiles = {
@@ -386,14 +402,14 @@ TEST_P(IdentityCredentialTests, verifyManyProfilesAndEntriesPass) { 
                               << endl;



    optional<vector<SecureAccessControlProfile>> secureProfiles =

            test_utils::AddAccessControlProfiles(writableCredential, testProfiles);

            test_utils::addAccessControlProfiles(writableCredential, testProfiles);

    ASSERT_TRUE(secureProfiles);



    vector<uint8_t> portraitImage1;

    test_utils::SetImageData(portraitImage1);

    test_utils::setImageData(portraitImage1);



    vector<uint8_t> portraitImage2;

    test_utils::SetImageData(portraitImage2);

    test_utils::setImageData(portraitImage2);



    const vector<test_utils::TestEntryData> testEntries1 = {

            {"Name Space 1", "Last name", string("Turing"), vector<int32_t>{1, 2}},
@@ -411,7 +427,7 @@ TEST_P(IdentityCredentialTests, verifyManyProfilesAndEntriesPass) { 


    map<const test_utils::TestEntryData*, vector<vector<uint8_t>>> encryptedBlobs;

    for (const auto& entry : testEntries1) {

        EXPECT_TRUE(test_utils::AddEntry(writableCredential, entry, hwInfo.dataChunkSize,

        EXPECT_TRUE(test_utils::addEntry(writableCredential, entry, hwInfo.dataChunkSize,

                                         encryptedBlobs, true));

    }
@@ -518,18 +534,18 @@ TEST_P(IdentityCredentialTests, verifyEmptyNameSpaceMixedWithNonEmptyWorks) { 
    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());



    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    string challenge = "NotSoRandomChallenge";

    test_utils::AttestationData attData(writableCredential, challenge, {});

    ASSERT_TRUE(attData.result.isOk())

            << attData.result.exceptionCode() << "; " << attData.result.exceptionMessage() << endl;



    optional<vector<uint8_t>> readerCertificate1 = test_utils::GenerateReaderCertificate("123456");

    optional<vector<uint8_t>> readerCertificate1 = test_utils::generateReaderCertificate("123456");

    ASSERT_TRUE(readerCertificate1);



    optional<vector<uint8_t>> readerCertificate2 =

            test_utils::GenerateReaderCertificate("123456987987987987987987");

            test_utils::generateReaderCertificate("123456987987987987987987");

    ASSERT_TRUE(readerCertificate2);



    const vector<int32_t> entryCounts = {2u, 2u};
@@ -547,7 +563,7 @@ TEST_P(IdentityCredentialTests, verifyEmptyNameSpaceMixedWithNonEmptyWorks) { 
                                                          {2, {}, false, 0}};



    optional<vector<SecureAccessControlProfile>> secureProfiles =

            test_utils::AddAccessControlProfiles(writableCredential, testProfiles);

            test_utils::addAccessControlProfiles(writableCredential, testProfiles);

    ASSERT_TRUE(secureProfiles);



    const vector<test_utils::TestEntryData> testEntries1 = {
@@ -560,7 +576,7 @@ TEST_P(IdentityCredentialTests, verifyEmptyNameSpaceMixedWithNonEmptyWorks) { 


    map<const test_utils::TestEntryData*, vector<vector<uint8_t>>> encryptedBlobs;

    for (const auto& entry : testEntries1) {

        EXPECT_TRUE(test_utils::AddEntry(writableCredential, entry, hwInfo.dataChunkSize,

        EXPECT_TRUE(test_utils::addEntry(writableCredential, entry, hwInfo.dataChunkSize,

                                         encryptedBlobs, true));

    }
@@ -580,7 +596,7 @@ TEST_P(IdentityCredentialTests, verifyInterleavingEntryNameSpaceOrderingFails) { 
    ASSERT_TRUE(credentialStore_->getHardwareInformation(&hwInfo).isOk());



    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    string challenge = "NotSoRandomChallenge";

    test_utils::AttestationData attData(writableCredential, challenge, {});
@@ -596,11 +612,11 @@ TEST_P(IdentityCredentialTests, verifyInterleavingEntryNameSpaceOrderingFails) { 
    ASSERT_TRUE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage()

                               << endl;



    optional<vector<uint8_t>> readerCertificate1 = test_utils::GenerateReaderCertificate("123456");

    optional<vector<uint8_t>> readerCertificate1 = test_utils::generateReaderCertificate("123456");

    ASSERT_TRUE(readerCertificate1);



    optional<vector<uint8_t>> readerCertificate2 =

            test_utils::GenerateReaderCertificate("123456987987987987987987");

            test_utils::generateReaderCertificate("123456987987987987987987");

    ASSERT_TRUE(readerCertificate2);



    const vector<test_utils::TestProfile> testProfiles = {{0, readerCertificate1.value(), false, 0},
@@ -608,7 +624,7 @@ TEST_P(IdentityCredentialTests, verifyInterleavingEntryNameSpaceOrderingFails) { 
                                                          {2, {}, false, 0}};



    optional<vector<SecureAccessControlProfile>> secureProfiles =

            test_utils::AddAccessControlProfiles(writableCredential, testProfiles);

            test_utils::addAccessControlProfiles(writableCredential, testProfiles);

    ASSERT_TRUE(secureProfiles);



    const vector<test_utils::TestEntryData> testEntries1 = {
@@ -619,13 +635,13 @@ TEST_P(IdentityCredentialTests, verifyInterleavingEntryNameSpaceOrderingFails) { 


    map<const test_utils::TestEntryData*, vector<vector<uint8_t>>> encryptedBlobs;

    for (const auto& entry : testEntries1) {

        EXPECT_TRUE(test_utils::AddEntry(writableCredential, entry, hwInfo.dataChunkSize,

        EXPECT_TRUE(test_utils::addEntry(writableCredential, entry, hwInfo.dataChunkSize,

                                         encryptedBlobs, true));

    }

    const test_utils::TestEntryData testEntry2 = {"Image", "Portrait image", string("asdfs"),

                                                  vector<int32_t>{0, 1}};



    EXPECT_TRUE(test_utils::AddEntry(writableCredential, testEntry2, hwInfo.dataChunkSize,

    EXPECT_TRUE(test_utils::addEntry(writableCredential, testEntry2, hwInfo.dataChunkSize,

                                     encryptedBlobs, true));



    // We expect this to fail because the namespace is out of order, all "Name Space"
@@ -637,7 +653,7 @@ TEST_P(IdentityCredentialTests, verifyInterleavingEntryNameSpaceOrderingFails) { 
    };



    for (const auto& entry : testEntries3) {

        EXPECT_FALSE(test_utils::AddEntry(writableCredential, entry, hwInfo.dataChunkSize,

        EXPECT_FALSE(test_utils::addEntry(writableCredential, entry, hwInfo.dataChunkSize,

                                          encryptedBlobs, false));

    }
@@ -646,7 +662,7 @@ TEST_P(IdentityCredentialTests, verifyInterleavingEntryNameSpaceOrderingFails) { 
    result =

            writableCredential->finishAddingEntries(&credentialData, &proofOfProvisioningSignature);



    // should fail because test_utils::AddEntry should have failed earlier.

    // should fail because test_utils::addEntry should have failed earlier.

    EXPECT_FALSE(result.isOk()) << result.exceptionCode() << "; " << result.exceptionMessage()

                                << endl;

    EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, result.exceptionCode());
@@ -655,7 +671,7 @@ TEST_P(IdentityCredentialTests, verifyInterleavingEntryNameSpaceOrderingFails) { 


TEST_P(IdentityCredentialTests, verifyAccessControlProfileIdOutOfRange) {

    sp<IWritableIdentityCredential> writableCredential;

    ASSERT_TRUE(test_utils::SetupWritableCredential(writableCredential, credentialStore_));

    ASSERT_TRUE(test_utils::setupWritableCredential(writableCredential, credentialStore_));



    const vector<int32_t> entryCounts = {1};

    Status result = writableCredential->startPersonalization(1, entryCounts);

identity/aidl/vts/VtsIdentityTestUtils.cpp

+72 −14

File changed.

Preview size limit exceeded, changes collapsed.

identity/aidl/vts/VtsIdentityTestUtils.h

+11 −8
Original line number Diff line number Diff line
@@ -93,25 +93,28 @@ struct TestProfile { 
    uint64_t timeoutMillis;

};



bool SetupWritableCredential(sp<IWritableIdentityCredential>& writableCredential,

bool setupWritableCredential(sp<IWritableIdentityCredential>& writableCredential,

                             sp<IIdentityCredentialStore>& credentialStore);



optional<vector<uint8_t>> GenerateReaderCertificate(string serialDecimal);

optional<vector<uint8_t>> generateReaderCertificate(string serialDecimal);



optional<vector<uint8_t>> GenerateReaderCertificate(string serialDecimal,

                                                    vector<uint8_t>& readerPrivateKey);

optional<vector<uint8_t>> generateReaderCertificate(string serialDecimal,

                                                    vector<uint8_t>* outReaderPrivateKey);



optional<vector<SecureAccessControlProfile>> AddAccessControlProfiles(

optional<vector<SecureAccessControlProfile>> addAccessControlProfiles(

        sp<IWritableIdentityCredential>& writableCredential,

        const vector<TestProfile>& testProfiles);



bool AddEntry(sp<IWritableIdentityCredential>& writableCredential, const TestEntryData& entry,

bool addEntry(sp<IWritableIdentityCredential>& writableCredential, const TestEntryData& entry,

              int dataChunkSize, map<const TestEntryData*, vector<vector<uint8_t>>>& encryptedBlobs,

              bool expectSuccess);



bool ValidateAttestationCertificate(vector<Certificate>& inputCertificates);

void setImageData(vector<uint8_t>& image);



void SetImageData(vector<uint8_t>& image);

bool validateAttestationCertificate(const vector<Certificate>& inputCertificates,

                                    const vector<uint8_t>& expectedChallenge,

                                    const vector<uint8_t>& expectedAppId,

                                    const HardwareInformation& hwInfo);



vector<RequestNamespace> buildRequestNamespaces(const vector<TestEntryData> entries);