Support Keybox, DRM Cert, and OEM Cert for Client ID

[ Merge of http://go/wvgerrit/22900 ]

Add GetClientToken(), GetProvisioningToken(), GetPreProvisionTokenType()
to CryptoSession.  They return the correct token bytes and token type
for preparing the ClientIdentification message for provisioning and
license server transactions.

Also refactor service certificate handling.

OEM certs are introduced in Provisioning 3.0

b/30811184

* Address build breaks

[ Merge of http://go/wvgerrit/23162 ]

This addresses issues introduced by http://go/wvgerrit/22900

b/30811184

* When http://go/wvgerrit/18012 was merged (ag/1446934) some changes
were not merged for mapErrors-inl.h. These changes are included in this CL.

* When ag/1678104 was reverse merged to http//go/wvgerrit/21981/ a variable
was renamed and some comments were added to add clarity in cdm_engine.cpp.
These changes are included in this CL.

Test: All unittests other than some oemcrypto, request_license_test
passed. Those tests failed with or without this CL.

Change-Id: Ie0215509f2f985f2a610f5a4c865db47edec8662

libwvdrmengine/cdm/core/src/certificate_provisioning.cpp

@@ -48,6 +48,38 @@ void CertificateProvisioning::ComposeJsonRequestAsQueryString(
   request->assign(message_b64);
 }
 
+/*
+ * Return the ClientIdentification message token type for provisioning request.
+ * NOTE: a DRM Cert should never be presented to the provisioning server.
+ */
+bool CertificateProvisioning::GetProvisioningTokenType(
+    ClientIdentification::TokenType* token_type) {
+  switch (crypto_session_.GetPreProvisionTokenType()) {
+    case kClientTokenKeybox:
+      *token_type = ClientIdentification::KEYBOX;
+      return true;
+    case kClientTokenOemCert:
+      *token_type = ClientIdentification::OEM_DEVICE_CERTIFICATE;
+      return true;
+    case kClientTokenDrmCert:
+    default:
+      // shouldn't happen
+      return false;
+  }
+}
+
+/*
+ * Return the provisioning protocol version - dictated by OEMCrypto
+ * support for OEM certificates.
+ */
+SignedProvisioningMessage::ProtocolVersion
+    CertificateProvisioning::GetProtocolVersion() {
+  if (crypto_session_.GetPreProvisionTokenType() == kClientTokenOemCert)
+    return SignedProvisioningMessage::VERSION_3;
+  else
+    return SignedProvisioningMessage::VERSION_2;
+}
+
 /*
  * Composes a device provisioning request and output the request in JSON format
  * in *request. It also returns the default url for the provisioning server
@@ -74,14 +106,35 @@ CdmResponseType CertificateProvisioning::GetProvisioningRequest(
 
   // Prepares device provisioning request.
   ProvisioningRequest provisioning_request;
-  ClientIdentification* client_id = provisioning_request.mutable_client_id();
-  client_id->set_type(ClientIdentification::KEYBOX);
   std::string token;
-  if (!crypto_session_.GetToken(&token)) {
-    LOGE("GetProvisioningRequest: fails to get token");
-    return CERT_PROVISIONING_GET_KEYBOX_ERROR_1;
+  ClientIdentification* client_id = provisioning_request.mutable_client_id();
+  ClientIdentification::TokenType token_type;
+
+  if (!GetProvisioningTokenType(&token_type)) {
+    LOGE("GetProvisioningRequest: bad token type");
+    return CERT_PROVISIONING_CLIENT_TOKEN_ERROR_1;
+  }
+  if (!crypto_session_.GetProvisioningToken(&token)) {
+    LOGE("GetProvisioningRequest: failure getting provisioning token");
+    return CERT_PROVISIONING_CLIENT_TOKEN_ERROR_2;
   }
   client_id->set_token(token);
+  client_id->set_type(token_type);
+
+#if 0  // TODO(gmorgan) in progress - encrypt ClientIdentification.
+  if (encrypt) {
+    EncryptedClientIdentification* encrypted_client_id =
+        provisioning_request->mutable_encrypted_client_id();
+    CdmResponseType sts;
+    sts = EncryptClientId(client_id, encrypted_client_id, certificate);
+    if (NO_ERROR == sts) {
+      provisioning_request->clear_client_id();
+    } else {
+      provisioning_request->clear_encrypted_client_id();
+    }
+    return sts;
+  }
+#endif
 
   uint32_t nonce;
   if (!crypto_session_.GenerateNonce(&nonce)) {
@@ -112,12 +165,14 @@ CdmResponseType CertificateProvisioning::GetProvisioningRequest(
   cert_type_ = cert_type;
   options->set_certificate_authority(cert_authority);
 
+  // TODO(gmorgan): use provider ID.
   if (origin != EMPTY_ORIGIN) {
     std::string device_unique_id;
     if (!crypto_session_.GetDeviceUniqueId(&device_unique_id)) {
       LOGE("GetProvisioningRequest: fails to get device unique ID");
       return CERT_PROVISIONING_GET_KEYBOX_ERROR_2;
     }
+    // TODO(gmorgan): handle provider id variants.
     provisioning_request.set_stable_id(device_unique_id + origin);
   }
 
@@ -139,6 +194,7 @@ CdmResponseType CertificateProvisioning::GetProvisioningRequest(
   SignedProvisioningMessage signed_provisioning_msg;
   signed_provisioning_msg.set_message(serialized_message);
   signed_provisioning_msg.set_signature(request_signature);
+  signed_provisioning_msg.set_protocol_version(GetProtocolVersion());
 
   std::string serialized_request;
   signed_provisioning_msg.SerializeToString(&serialized_request);