Widevine CENC drm engine update

bug: 8601053 This import syncs to the widevine git repository change commit 6a99ad1b59ad39495f62954b3065ddc22b78da49 It includes the following changes from the widevine git repository, which complete the jb-mr2 features Fix Unit Test Makefile Adds support for device certificate provisioning. Support application parameters Certificate based licensing Proto for client files Implement Property Query API Add Device Query For Unique ID Implement Generic Crypto in DrmEngine Do not validate Key IDs on clear playback Allow OEMCrypto_DecryptCTR with clear content and no key Add a case to the MediaDrm API test to repro b/8594163 Implement requiresSecureDecoderComponent Implement Eventing API Add end-to-end decryption test with vectors Refactoring of properties class Refactor OEMCrypto unittest. Fix for b/8567853: License renewal doesn't renew license. Add KEY_ERROR callback to WvContentDecryptionModule() ctor. Merged certificate_provisioning.proto and client_identification.proto to license_protocol.proto. Fix nonce check failure after a malformed key in OEC Mock. asynchronize decryption Allow querying of control information make debugging AddKey & Decrypt statuses easier Revert "Revert "Send KEY_ERROR event to app on license expiration or failure"" Revert "Send KEY_ERROR event to app on license expiration or failure" Send KEY_ERROR event to app on license expiration or failure remove extra session id copy use KeyError constants directly replace variable-length arrays with std::vector and fixed-sized array pass session ids as const references refactor key extraction and update keys on renewal Updates to enable renewals and signaling license expiration. fix error constant in OEMCrypto_DecryptCTR Change-Id: I5f7236c7bdff1d5ece6115fd2893f8a1e1e07c50
2013-04-12 14:12:16 -07:00
parent 2f980d7d7e
commit e6b1fedc4c
63 changed files with 2885 additions and 1134 deletions
--- a/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
+++ b/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
@@ -8,9 +8,11 @@

 #include "WVDrmPlugin.h"

+#include <sstream>
 #include <string>
 #include <vector>

+#include "media/stagefright/MediaErrors.h"
 #include "utils/Errors.h"
 #include "wv_cdm_constants.h"

@@ -20,7 +22,24 @@ using namespace android;
 using namespace std;
 using namespace wvcdm;

-WVDrmPlugin::WVDrmPlugin(WvContentDecryptionModule* cdm) : mCDM(cdm) {}
+WVDrmPlugin::WVDrmPlugin(WvContentDecryptionModule* cdm,
+                         WVGenericCryptoInterface* crypto)
+  : mCDM(cdm), mCrypto(crypto) {}
+
+WVDrmPlugin::~WVDrmPlugin() {
+  typedef map<CdmSessionId, CryptoSession>::iterator mapIterator;
+  for (mapIterator iter = mCryptoSessions.begin();
+       iter != mCryptoSessions.end();
+       ++iter) {
+    bool bRes = mCDM->DetachEventListener(iter->first, this);
+
+    if (!bRes) {
+      ALOGE("Received failure when trying to detach WVDrmPlugin as an event"
+            "listener.");
+    }
+  }
+  mCryptoSessions.clear();
+}

 status_t WVDrmPlugin::openSession(Vector<uint8_t>& sessionId) {
  CdmSessionId cdmSessionId;
@@ -30,11 +49,46 @@ status_t WVDrmPlugin::openSession(Vector<uint8_t>& sessionId) {
    return android::UNKNOWN_ERROR;
  }

-  sessionId.clear();
-  sessionId.appendArray(reinterpret_cast<const uint8_t*>(cdmSessionId.data()),
-                        cdmSessionId.size());
+  bool success = false;

-  return android::OK;
+  // Register for events
+  bool listenerAttached = mCDM->AttachEventListener(cdmSessionId, this);
+
+  if (listenerAttached) {
+    // Construct a CryptoSession
+    CdmQueryMap info;
+
+    CdmResponseType res = mCDM->QueryKeyControlInfo(cdmSessionId, &info);
+
+    if (res == wvcdm::NO_ERROR && info.count(QUERY_KEY_OEMCRYPTO_SESSION_ID)) {
+      OEMCrypto_SESSION oecSessionId;
+      istringstream(info[QUERY_KEY_OEMCRYPTO_SESSION_ID]) >> oecSessionId;
+
+      mCryptoSessions[cdmSessionId] = CryptoSession(oecSessionId);
+
+      success = true;
+    }
+  } else {
+    ALOGE("Received failure when trying to attach WVDrmPlugin as an event"
+          "listener.");
+  }
+
+  if (success) {
+    // Marshal Session ID
+    sessionId.clear();
+    sessionId.appendArray(reinterpret_cast<const uint8_t*>(cdmSessionId.data()),
+                          cdmSessionId.size());
+
+    return android::OK;
+  } else {
+    if (listenerAttached) {
+      mCDM->DetachEventListener(cdmSessionId, this);
+    }
+
+    mCDM->CloseSession(cdmSessionId);
+
+    return android::UNKNOWN_ERROR;
+  }
 }

 status_t WVDrmPlugin::closeSession(const Vector<uint8_t>& sessionId) {
@@ -42,6 +96,7 @@ status_t WVDrmPlugin::closeSession(const Vector<uint8_t>& sessionId) {
  CdmResponseType res = mCDM->CloseSession(cdmSessionId);

  if (res == wvcdm::NO_ERROR) {
+    mCryptoSessions.erase(cdmSessionId);
    return android::OK;
  } else {
    return android::UNKNOWN_ERROR;
@@ -67,7 +122,6 @@ status_t WVDrmPlugin::getKeyRequest(

  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
  CdmInitData cdmInitData(initData.begin(), initData.end());
-  // TODO: Do something with mimeType?

  CdmAppParameterMap cdmParameters;
  for (size_t i = 0; i < optionalParameters.size(); ++i) {
@@ -90,7 +144,6 @@ status_t WVDrmPlugin::getKeyRequest(
    return android::UNKNOWN_ERROR;
  }

-  // TODO: Do something more with defaultUrl?
  defaultUrl.clear();

  request.clear();
@@ -104,7 +157,7 @@ status_t WVDrmPlugin::provideKeyResponse(
    const Vector<uint8_t>& sessionId,
    const Vector<uint8_t>& response,
    Vector<uint8_t>& keySetId) {
-    // TODO: return keySetId for persisted offline content
+  // TODO: return keySetId for persisted offline content
  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
  CdmKeyResponse cdmResponse(response.begin(), response.end());

@@ -119,13 +172,13 @@ status_t WVDrmPlugin::provideKeyResponse(

 status_t WVDrmPlugin::removeKeys(const Vector<uint8_t>& keySetId) {
  // TODO: remove persisted offline keys associated with keySetId
-  return android::UNKNOWN_ERROR;
+  return android::ERROR_UNSUPPORTED;
 }

 status_t WVDrmPlugin::restoreKeys(const Vector<uint8_t>& sessionId,
                                  const Vector<uint8_t>& keySetId) {
  // TODO: restore persisted offline keys associated with keySetId
-  return android::UNKNOWN_ERROR;
+  return android::ERROR_UNSUPPORTED;
 }

 status_t WVDrmPlugin::queryKeyStatus(
@@ -232,76 +285,306 @@ status_t WVDrmPlugin::releaseSecureStops(const Vector<uint8_t>& ssRelease) {

 status_t WVDrmPlugin::getPropertyString(const String8& name,
                                        String8& value) const {
-  // TODO: Implement this function once the CDM query API is finalized.
-  return -EPERM;
+  if (name == "vendor") {
+    value = "Google";
+  } else if (name == "version") {
+    value = "1.0";
+  } else if (name == "description") {
+    value = "Widevine CDM";
+  } else if (name == "algorithms") {
+    value = "AES/CBC/NoPadding,HmacSHA256";
+  } else if (name == "securityLevel") {
+    CdmQueryMap status;
+
+    CdmResponseType res = mCDM->QueryStatus(&status);
+
+    if (res != wvcdm::NO_ERROR) {
+      ALOGE("Error querying CDM status: %u", res);
+      return android::UNKNOWN_ERROR;
+    } else if (!status.count(QUERY_KEY_SECURITY_LEVEL)) {
+      ALOGE("CDM did not report a security level");
+      return android::UNKNOWN_ERROR;
+    }
+
+    const string& securityLevel = status[QUERY_KEY_SECURITY_LEVEL];
+
+    value.clear();
+    value.append(securityLevel.data(), securityLevel.size());
+  } else {
+    ALOGE("App requested unknown property %s", name.string());
+    return android::ERROR_UNSUPPORTED;
+  }
+
+  return android::OK;
 }

 status_t WVDrmPlugin::getPropertyByteArray(const String8& name,
-                                      Vector<uint8_t>& value) const {
-  // TODO: Implement this function once the CDM query API is finalized.
-  return -EPERM;
+                                           Vector<uint8_t>& value) const {
+  if (name == "deviceUniqueId") {
+    CdmQueryMap status;
+
+    CdmResponseType res = mCDM->QueryStatus(&status);
+
+    if (res != wvcdm::NO_ERROR) {
+      ALOGE("Error querying CDM status: %u", res);
+      return android::UNKNOWN_ERROR;
+    } else if (!status.count(QUERY_KEY_DEVICE_ID)) {
+      ALOGE("CDM did not report a unique ID");
+      return android::UNKNOWN_ERROR;
+    }
+
+    const string& uniqueId = status[QUERY_KEY_DEVICE_ID];
+
+    value.clear();
+    value.appendArray(reinterpret_cast<const uint8_t*>(uniqueId.data()),
+                      uniqueId.size());
+  } else {
+    ALOGE("App requested unknown property %s", name.string());
+    return android::ERROR_UNSUPPORTED;
+  }
+
+  return android::OK;
 }

 status_t WVDrmPlugin::setPropertyString(const String8& name,
                                        const String8& value) {
-  // TODO: Implement this function once the CDM query API is finalized.
-  return -EPERM;
+  return android::ERROR_UNSUPPORTED;
 }

 status_t WVDrmPlugin::setPropertyByteArray(const String8& name,
                                           const Vector<uint8_t>& value) {
-  // TODO: Implement this function once the CDM query API is finalized.
-  return -EPERM;
+  return android::ERROR_UNSUPPORTED;
 }

-status_t WVDrmPlugin::setCipherAlgorithm(Vector<uint8_t> const &sessionId,
-                                         String8 const &algorithm) {
-  // TODO: Implement this function once the OEMCrypto API supports it
-  return -EPERM;
+status_t WVDrmPlugin::setCipherAlgorithm(const Vector<uint8_t>& sessionId,
+                                         const String8& algorithm) {
+  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
+
+  if (!mCryptoSessions.count(cdmSessionId)) {
+    return android::NO_INIT;
+  }
+
+  CryptoSession& cryptoSession = mCryptoSessions[cdmSessionId];
+
+  if (algorithm == "AES/CBC/NoPadding") {
+    cryptoSession.setCipherAlgorithm(OEMCrypto_AES_CBC_128_NO_PADDING);
+  } else {
+    return android::BAD_VALUE;
+  }
+
+  return android::OK;
 }

-status_t WVDrmPlugin::setMacAlgorithm(Vector<uint8_t> const &sessionId,
-                                      String8 const &algorithm) {
-  // TODO: Implement this function once the OEMCrypto API supports it
-  return -EPERM;
+status_t WVDrmPlugin::setMacAlgorithm(const Vector<uint8_t>& sessionId,
+                                      const String8& algorithm) {
+  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
+
+  if (!mCryptoSessions.count(cdmSessionId)) {
+    return android::NO_INIT;
+  }
+
+  CryptoSession& cryptoSession = mCryptoSessions[cdmSessionId];
+
+  if (algorithm == "HmacSHA256") {
+    cryptoSession.setMacAlgorithm(OEMCrypto_HMAC_SHA256);
+  } else {
+    return android::BAD_VALUE;
+  }
+
+  return android::OK;
 }

-status_t WVDrmPlugin::encrypt(Vector<uint8_t> const &sessionId,
-                              Vector<uint8_t> const &keyId,
-                              Vector<uint8_t> const &input,
-                              Vector<uint8_t> const &iv,
-                              Vector<uint8_t> &output) {
-  // TODO: Implement this function once the OEMCrypto API supports it
-  return -EPERM;
+status_t WVDrmPlugin::encrypt(const Vector<uint8_t>& sessionId,
+                              const Vector<uint8_t>& keyId,
+                              const Vector<uint8_t>& input,
+                              const Vector<uint8_t>& iv,
+                              Vector<uint8_t>& output) {
+  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
+
+  if (!mCryptoSessions.count(cdmSessionId)) {
+    return android::NO_INIT;
+  }
+
+  const CryptoSession& cryptoSession = mCryptoSessions[cdmSessionId];
+
+  if (cryptoSession.cipherAlgorithm() == kInvalidCrytpoAlgorithm) {
+    return android::NO_INIT;
+  }
+
+  OEMCryptoResult res = mCrypto->selectKey(cryptoSession.oecSessionId(),
+                                           keyId.array(), keyId.size());
+
+  if (res != OEMCrypto_SUCCESS) {
+    ALOGE("OEMCrypto_SelectKey failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
+
+  output.resize(input.size());
+
+  res = mCrypto->encrypt(cryptoSession.oecSessionId(), input.array(),
+                         input.size(), iv.array(),
+                         cryptoSession.cipherAlgorithm(), output.editArray());
+
+  if (res == OEMCrypto_SUCCESS) {
+    return android::OK;
+  } else {
+    ALOGE("OEMCrypto_Generic_Encrypt failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
 }

-status_t WVDrmPlugin::decrypt(Vector<uint8_t> const &sessionId,
-                              Vector<uint8_t> const &keyId,
-                              Vector<uint8_t> const &input,
-                              Vector<uint8_t> const &iv,
-                              Vector<uint8_t> &output) {
-  // TODO: Implement this function once the OEMCrypto API supports it
-  return -EPERM;
+status_t WVDrmPlugin::decrypt(const Vector<uint8_t>& sessionId,
+                              const Vector<uint8_t>& keyId,
+                              const Vector<uint8_t>& input,
+                              const Vector<uint8_t>& iv,
+                              Vector<uint8_t>& output) {
+  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
+
+  if (!mCryptoSessions.count(cdmSessionId)) {
+    return android::NO_INIT;
+  }
+
+  const CryptoSession& cryptoSession = mCryptoSessions[cdmSessionId];
+
+  if (cryptoSession.cipherAlgorithm() == kInvalidCrytpoAlgorithm) {
+    return android::NO_INIT;
+  }
+
+  OEMCryptoResult res = mCrypto->selectKey(cryptoSession.oecSessionId(),
+                                           keyId.array(), keyId.size());
+
+  if (res != OEMCrypto_SUCCESS) {
+    ALOGE("OEMCrypto_SelectKey failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
+
+  output.resize(input.size());
+
+  res = mCrypto->decrypt(cryptoSession.oecSessionId(), input.array(),
+                         input.size(), iv.array(),
+                         cryptoSession.cipherAlgorithm(), output.editArray());
+
+  if (res == OEMCrypto_SUCCESS) {
+    return android::OK;
+  } else {
+    ALOGE("OEMCrypto_Generic_Decrypt failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
 }

-status_t WVDrmPlugin::sign(Vector<uint8_t> const &sessionId,
-                           Vector<uint8_t> const &keyId,
-                           Vector<uint8_t> const &message,
-                           Vector<uint8_t> &signature) {
-  // TODO: Implement this function once the OEMCrypto API supports it
-  return -EPERM;
+status_t WVDrmPlugin::sign(const Vector<uint8_t>& sessionId,
+                           const Vector<uint8_t>& keyId,
+                           const Vector<uint8_t>& message,
+                           Vector<uint8_t>& signature) {
+  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
+
+  if (!mCryptoSessions.count(cdmSessionId)) {
+    return android::NO_INIT;
+  }
+
+  const CryptoSession& cryptoSession = mCryptoSessions[cdmSessionId];
+
+  if (cryptoSession.macAlgorithm() == kInvalidCrytpoAlgorithm) {
+    return android::NO_INIT;
+  }
+
+  OEMCryptoResult res = mCrypto->selectKey(cryptoSession.oecSessionId(),
+                                           keyId.array(), keyId.size());
+
+  if (res != OEMCrypto_SUCCESS) {
+    ALOGE("OEMCrypto_SelectKey failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
+
+  size_t signatureSize = 0;
+
+  res = mCrypto->sign(cryptoSession.oecSessionId(), message.array(),
+                      message.size(), cryptoSession.macAlgorithm(),
+                      signature.editArray(), &signatureSize);
+
+  if (res != OEMCrypto_ERROR_SHORT_BUFFER) {
+    ALOGE("OEMCrypto_Generic_Sign failed with %u when requesting signature "
+          "size", res);
+    return android::UNKNOWN_ERROR;
+  }
+
+  signature.resize(signatureSize);
+
+  res = mCrypto->sign(cryptoSession.oecSessionId(), message.array(),
+                      message.size(), cryptoSession.macAlgorithm(),
+                      signature.editArray(), &signatureSize);
+
+  if (res == OEMCrypto_SUCCESS) {
+    return android::OK;
+  } else {
+    ALOGE("OEMCrypto_Generic_Sign failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
 }

-status_t WVDrmPlugin::verify(Vector<uint8_t> const &sessionId,
-                             Vector<uint8_t> const &keyId,
-                             Vector<uint8_t> const &message,
-                             Vector<uint8_t> const &signature,
-                             bool &match) {
-  // TODO: Implement this function once the OEMCrypto API supports it
-  return -EPERM;
+status_t WVDrmPlugin::verify(const Vector<uint8_t>& sessionId,
+                             const Vector<uint8_t>& keyId,
+                             const Vector<uint8_t>& message,
+                             const Vector<uint8_t>& signature,
+                             bool& match) {
+  CdmSessionId cdmSessionId(sessionId.begin(), sessionId.end());
+
+  if (!mCryptoSessions.count(cdmSessionId)) {
+    return android::NO_INIT;
+  }
+
+  const CryptoSession& cryptoSession = mCryptoSessions[cdmSessionId];
+
+  if (cryptoSession.macAlgorithm() == kInvalidCrytpoAlgorithm) {
+    return android::NO_INIT;
+  }
+
+  OEMCryptoResult res = mCrypto->selectKey(cryptoSession.oecSessionId(),
+                                           keyId.array(), keyId.size());
+
+  if (res != OEMCrypto_SUCCESS) {
+    ALOGE("OEMCrypto_SelectKey failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
+
+  res = mCrypto->verify(cryptoSession.oecSessionId(), message.array(),
+                        message.size(), cryptoSession.macAlgorithm(),
+                        signature.array(), signature.size());
+
+  if (res == OEMCrypto_SUCCESS) {
+    match = true;
+    return android::OK;
+  } else if (res == OEMCrypto_ERROR_SIGNATURE_FAILURE) {
+    match = false;
+    return android::OK;
+  } else {
+    ALOGE("OEMCrypto_Generic_Verify failed with %u", res);
+    return android::UNKNOWN_ERROR;
+  }
 }

+void WVDrmPlugin::onEvent(const CdmSessionId& cdmSessionId,
+                          CdmEventType cdmEventType) {
+  Vector<uint8_t> sessionId;
+  EventType eventType;
+
+  switch (cdmEventType) {
+    case LICENSE_EXPIRED_EVENT:
+      eventType = kDrmPluginEventKeyExpired;
+      break;
+    case LICENSE_RENEWAL_NEEDED_EVENT:
+      eventType = kDrmPluginEventKeyNeeded;
+      break;
+    default:
+      ALOGE("Unknown CDM Event Received by WVDrmPlugin: %u", cdmEventType);
+      return;
+  }
+
+  sessionId.appendArray(reinterpret_cast<const uint8_t*>(cdmSessionId.data()),
+                        cdmSessionId.size());
+
+  // Call base-class method with translated event.
+  sendEvent(eventType, 0, &sessionId, NULL);
+}

-// TODO: Hook up to event listener methods on CDM once Android API for
-//       eventing is finalized.
 }  // namespace wvdrm