Detect when unable to meet policy requirements

[ Merge of http://go/wvgerrit/25781 ]

The security level (software/hardware, decryption/decode)
in the policy that specified how the key was to be used was
not being respected for L3. Playback would either continue or
a vendor specific error would be thrown.

If the device cannot use the key as permitted by the policy
CryptoException#ERROR_INSUFFICIENT_OUTPUT_PROTECTION will be thrown.

Test: Verified by WV unit+integration tests.
      Verified by WidevineDashPolicyTests
      Verified by WidevineDashPolicyTests#testL3SoftwareSecureDecoderRequired,
      testL3HardwareSecureCryptoRequired, testL3HardwareSecureDecodeRequired,
      testL3SecureVideoPathRequired.

b/31913737
b/31913439

Change-Id: Ibfc7f3dd6fc7264e8cf9b0d33f6f8d619eed6c00

libwvdrmengine/cdm/core/include/policy_engine.h

@@ -34,6 +34,10 @@ class PolicyEngine {
   // status is not calculated to avoid overhead in the decryption path.
   virtual bool CanDecryptContent(const KeyId& key_id);
 
+  // Verifies whether the policy allows use of the specified key of
+  // a given security level for content decryption.
+  virtual bool CanUseKey(const KeyId& key_id, CdmSecurityLevel security_level);
+
   // OnTimerEvent is called when a timer fires. It notifies the Policy Engine
   // that the timer has fired and dispatches the relevant events through
   // |event_listener_|.

libwvdrmengine/cdm/core/include/wv_cdm_types.h

@@ -295,6 +295,7 @@ enum CdmResponseType {
   RELEASE_USAGE_INFO_FAILED,
   INCORRECT_USAGE_SUPPORT_TYPE_1,
   INCORRECT_USAGE_SUPPORT_TYPE_2, /* 255 */
+  KEY_PROHIBITED_FOR_SECURITY_LEVEL,
 };
 
 enum CdmKeyStatus {
@@ -392,6 +393,16 @@ struct CdmUsageEntryInfo {
   std::string usage_info_file_name;
 };
 
+enum CdmKeySecurityLevel {
+  kKeySecurityLevelUnset,
+  kSoftwareSecureCrypto,
+  kSoftwareSecureDecode,
+  kHardwareSecureCrypto,
+  kHardwareSecureDecode,
+  kHardwareSecureAll,
+  kKeySecurityLevelUnknown,
+};
+
 class CdmKeyAllowedUsage {
  public:
   CdmKeyAllowedUsage() {
@@ -408,6 +419,7 @@ class CdmKeyAllowedUsage {
     generic_decrypt = false;
     generic_sign = false;
     generic_verify = false;
+    key_security_level_ = kKeySecurityLevelUnset;
     valid_ = false;
   }
 
@@ -418,7 +430,8 @@ class CdmKeyAllowedUsage {
         generic_encrypt != other.generic_encrypt ||
         generic_decrypt != other.generic_decrypt ||
         generic_sign != other.generic_sign ||
-        generic_verify != other.generic_verify) {
+        generic_verify != other.generic_verify ||
+        key_security_level_ != other.key_security_level_) {
       return false;
     }
     return true;
@@ -430,6 +443,7 @@ class CdmKeyAllowedUsage {
   bool generic_decrypt;
   bool generic_sign;
   bool generic_verify;
+  CdmKeySecurityLevel key_security_level_;
 
  private:
   bool valid_;