widevine-partner/android
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updates to OTA Keybox Reprovisioning

Browse Source 
[ Cherry pick of http://ag/15847758 ]

Adjust OTA code to account for some design changes and
add integration tests.

Merge from Widevine repo of http://go/wvgerrit/133775
Change use_test_key to uint32_t type

Merge from Widevine repo of http://go/wvgerrit/133774
Cleanup CDM OKP info before tests.

Merge from Widevine repo of http://go/wvgerrit/133773
Change context for derivation in OTA keybox solution

Merge from Widevine repo of http://go/wvgerrit/133772
Updated OTA keybox key derivation.

Merge from Widevine repo of http://go/wvgerrit/133771
Use double provisioning step in integration tests

Merge from Widevine repo of http://go/wvgerrit/133770
Erase keybox on initialization for OEMCrypto testbed

Merge from Widevine repo of http://go/wvgerrit/133769
Add session id to OEMCrypto OTA functions

Merge from Widevine repo of http://go/wvgerrit/133768
Integration test for OTA Keybox reprovisioning

Merge from Widevine repo of http://go/wvgerrit/133767
Add test x509 cert for testing

Merge from Widevine repo of http://go/wvgerrit/133766
OTA Keybox basic functionality in testbed

Merge from Widevine repo of http://go/wvgerrit/133765
Update OTA test script to use newer build scripts

Merge from Widevine repo of http://go/wvgerrit/133764
Adjust comment stype for doxygen

Test: MediaDrmTest and Android unittests

Bug: 190505461
Bug: 190505461
Bug: 190505461
bug: 187646550
Bug: 187646550
Bug: 187646550
Bug: 187646550
Bug: 190505461
Bug: 187646550
Bug: 188228998
Bug: 190505461
Bug: 187646550
Change-Id: I41ff819a1fd8aca2e20adb25127fa0d9c4879b01
This commit is contained in:
Fred Gylys-Colwell
2021-09-16 22:08:34 +00:00
committed by Alex Dale
parent 6afcbab5cf
commit 7397f77343
10 changed files with 443 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

106
libwvdrmengine/oemcrypto/include/OEMCryptoCENC.h
View File

@@ -2959,31 +2959,19 @@ OEMCrypto_ProvisioningMethod OEMCrypto_GetProvisioningMethod(void);
* If the device has an OEM Certificate, this validates the certificate
* private key.
*
* On devices that support OEMCrypto_GenerateOTARequest and
* OEMCrypto_ProcessOTAKeybox, this function may return
* OEMCrypto_ERROR_NEEDS_KEYBOX_PROVISIONING when a valid keybox is not present.
*
* @retval OEMCrypto_SUCCESS
* @retval OEMCrypto_ERROR_BAD_MAGIC
* @retval OEMCrypto_ERROR_BAD_CRC
* @retval OEMCrypto_ERROR_KEYBOX_INVALID
* @retval OEMCrypto_ERROR_INVALID_RSA_KEY
* @retval OEMCrypto_ERROR_SYSTEM_INVALIDATED
* @retval OEMCrypto_ERROR_NEEDS_KEYBOX_PROVISIONING
*
* On devices that support OEMCrypto_GenerateOTARequest and
* OEMCrypto_ProcessOTAKeybox, this function may return
* OEMCrypto_ERROR_NEEDS_KEYBOX_PROVISIONING when a valid keybox is not
* present.
*
* Parameters:
* none
*
* Returns:
* OEMCrypto_SUCCESS
* OEMCrypto_ERROR_BAD_MAGIC
* OEMCrypto_ERROR_BAD_CRC
* OEMCrypto_ERROR_KEYBOX_INVALID
* OEMCrypto_ERROR_INVALID_RSA_KEY
* OEMCrypto_ERROR_SYSTEM_INVALIDATED
* OEMCrypto_ERROR_NEEDS_KEYBOX_PROVISIONING
*
* Threading:
* @threading
* This is a "Property Function" and may be called simultaneously with any
* other property function or session function, but not any initialization or
* usage table function, as if the CDM holds a read lock on the OEMCrypto
@@ -4752,27 +4740,25 @@ OEMCryptoResult OEMCrypto_FreeSecureBuffer(
/*
* OEMCrypto_GenerateOTARequest
*
* Description:
* Generate an OTA Keybox provisioning request. The format of the
* message is specified in the document Keybox OTA Reprovisioning. If
* use_test_key is true, then the debug model key and id should be
* used. Widevine does not allow all devices to support OTA
* provisioning. Using an OTA provisioned keybox usually lowers a device's
* security profile in the DCSL.
* Generate an OTA Keybox provisioning request. The format of the
* message is specified in the document Keybox OTA Reprovisioning. If
* use_test_key is true, then the debug model key and id should be
* used. Widevine does not allow all devices to support OTA
* provisioning. Using an OTA provisioned keybox usually lowers a device's
* security profile in the DCSL.
*
* Parameters:
* [out] buffer: where the provisioning request is stored.
* [in/out] buffer_length: length of the request, in bytes.
* [in] use_test_key: If true, use the debug model key. This is used for
* testing the workflow.
* @param[in] session: handle for the session to be used.
* @param[out] buffer: where the provisioning request is stored.
* @param[in/out] buffer_length: length of the request, in bytes.
* @param[in] use_test_key: If non-zero, use the debug model key. This is used
* for testing the workflow.
*
* Returns:
* OEMCrypto_SUCCESS on success
* OEMCrypto_ERROR_SHORT_BUFFER - if buffer_length is too small.
* OEMCrypto_ERROR_NOT_IMPLEMENTED
* @retval OEMCrypto_SUCCESS on success
* @retval OEMCrypto_ERROR_SHORT_BUFFER - if buffer_length is too small.
* @retval OEMCrypto_ERROR_NOT_IMPLEMENTED
* Any other error will be logged.
*
* Threading:
* @threading
* This is an "Initialization and Termination Function" and will not be called
* simultaneously with any other function, as if the CDM holds a write lock on
* the OEMCrypto system. It will be called only after
@@ -4780,51 +4766,51 @@ OEMCryptoResult OEMCrypto_FreeSecureBuffer(
* OEMCrypto_ERROR_NEEDS_KEYBOX_PROVISIONING immediately after initialization,
* and before any session is opened.
*
* Version:
* @version
* This method is new in API version 16.
*/
OEMCryptoResult OEMCrypto_GenerateOTARequest(uint8_t* buffer,
OEMCryptoResult OEMCrypto_GenerateOTARequest(OEMCrypto_SESSION session,
uint8_t* buffer,
size_t* buffer_length,
bool use_test_key);
uint32_t use_test_key);
/*
* OEMCrypto_ProcessOTAKeybox
*
* Description:
* The buffer will be parsed as an OTA Keybox provisioning message, as
* described in the document OTA Keybox Reprovisioning. The
* signature will be verified. The keybox will be decrypted and verified. If
* use_test_key is false, the keybox will be installed permanently.
* The buffer will be parsed as an OTA Keybox provisioning message, as
* described in the document OTA Keybox Reprovisioning. The
* signature will be verified. The keybox will be decrypted and verified. If
* use_test_key is false, the keybox will be installed permanently.
*
* If use_test_keybox is true, do not use the real model key, use the debug
* model key specified in OTA Keybox Reprovisioning.
* If use_test_keybox is true, do not use the real model key, use the debug
* model key specified in OTA Keybox Reprovisioning.
*
* Parameters:
* [in] buffer: pointer to provisioning response.
* [in] buffer_length: length of the buffer, in bytes.
* [in] use_test_key: If true, use the debug model key. This is used for
* testing the workflow.
* @param[in] session: handle for the session to be used.
* @param[in] buffer: pointer to provisioning response.
* @param[in] buffer_length: length of the buffer, in bytes.
* @param[in] use_test_key: If non-zero, use the debug model key. This is used
* for testing the workflow.
*
* Returns:
* OEMCrypto_SUCCESS on success
* OEMCrypto_ERROR_NOT_IMPLEMENTED
* OEMCrypto_ERROR_SIGNATURE_FAILURE - signature of message was wrong.
* OEMCrypto_ERROR_KEYBOX_INVALID - if the keybox was unpacked, but is
* @retval OEMCrypto_SUCCESS on success
* @retval OEMCrypto_ERROR_NOT_IMPLEMENTED
* @retval OEMCrypto_ERROR_SIGNATURE_FAILURE - signature of message was wrong.
* @retval OEMCrypto_ERROR_KEYBOX_INVALID - if the keybox was unpacked, but is
* invalid.
* OEMCrypto_ERROR_WRITE_KEYBOX - could not save keybox.
* @retval OEMCrypto_ERROR_WRITE_KEYBOX - could not save keybox.
* Any other error will be logged.
*
* Threading:
* @threading
* This is an "Initialization and Termination Function" and will not be called
* simultaneously with any other function, as if the CDM holds a write lock on
* the OEMCrypto system. It will only be called after
* OEMCrypto_GenerateOTARequest.
*
* Version:
* @version
* This method is new in API version 16.
*/
OEMCryptoResult OEMCrypto_ProcessOTAKeybox(const uint8_t* buffer,
OEMCryptoResult OEMCrypto_ProcessOTAKeybox(OEMCrypto_SESSION session,
const uint8_t* buffer,
size_t buffer_length,
bool use_test_key);
uint32_t use_test_key);
/****************************************************************************/
/****************************************************************************/