Commit Graph

388 Commits

Author SHA1 Message Date
Fred Gylys-Colwell
3a3307242d Fix for off by one error and correct comments
Merge from Widevine repo of http://go/wvgerrit/66711

This addresses review comments for the OEMCrypto v15 CLs, as documented in
b/119685652.

Test: unit tests
Bug: 119685652
Change-Id: I0e7ce13dd80335eb1a12240df5c1df2c34ba4298
2018-11-18 14:00:28 -08:00
Fred Gylys-Colwell
f18ac47d71 Update oemcrypto adapter for v15 -> v14
Merge from master branch of Widevine repo of http://go/wvgerrit/66081
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/65962

This CL changes function names in the v14 level 3 libraries to work with
the dynamic adapter.  I also excluded several OEMCrypto unit tests from
running with a v14 oemcrypto because they require error code changes
introduced in v15.

Bug: 117888897 Fix backwards compatibility
Bug: 119313532 Integration test failing

Test: unit tests on taimen.  Play Movies, ExoPlayer, Netflix play on taimen.
Some unit tests do not pass because Taimen uses a v13 oemcrypto. Most pass.

Change-Id: Ib8eb8a89591fdba3055064c4bdf90523b01309a8
2018-11-16 17:14:02 -08:00
Fred Gylys-Colwell
246621c5ce Full decrypt path testing
Merge from master branch of Widevine repo of http://go/wvgerrit/66080
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/64002

This CL updates OEMCrypto reference code and unit tests to support full decrypt
path testing.

Test: unit tests
Test: tested as part of http://go/ag/5501993
Bug: 34078913
Change-Id: Ia67374599d6619698a336f41513068ad04294e7f
2018-11-16 17:14:00 -08:00
Fred Gylys-Colwell
4fa255ea51 Add Sandbox ID support
Merge from master branch of Widevine repo of http://go/wvgerrit/66078
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/64022

This CL updates OEMCrypto ref code, unit tests, and core code for
setting the sandbox id before initializing OEMCrypto.

Test: unit tests only
Test: tested as part of http://go/ag/5501993
Bug: 115834255
Change-Id: Id9831680fe4db1c69413815931cae4bc80df0c01
2018-11-16 17:14:00 -08:00
Srujan Gaddam
b7e4b56934 Update OEMCrypto calls to use substrings (addendum)
Merge from master branch of Widevine repo of http://go/wvgerrit/66076
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/64743

http://go/wvgerrit/64083 had some refactorings that weren't completely
accurate or slightly changed the meaning of some tests. This CL is an
addendum to that CL to fix those refactorings.

Test: tested as part of http://go/ag/5501993
Bug: 115874964

Change-Id: I37766a4c34de737eb9ca94ef781805435ee30dfd
2018-11-16 17:14:00 -08:00
Srujan Gaddam
4d5e0f961b Add tests for null kc/kc iv
Merge from master branch of Widevine repo of http://go/wvgerrit/66075
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/64702

Bug: 118172995

Tests OEMCrypto_LoadKeys when given a KeyObject with NULL KeyControl or
KeyControl iv.
Test: tested as part of http://go/ag/5501993

Change-Id: I1a5d26b1e2ff395fbd5ef7769af1165222c1877e
2018-11-16 17:14:00 -08:00
Srujan Gaddam
e6439255ba Update OEMCrypto calls to use substrings
Merge from master branch of Widevine repo of http://go/wvgerrit/66073
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/64083

As part of the update to v15, LoadKeys, RefreshKeys, and
LoadEntitledContentKeys should all use offsets and lengths into the
message rather than a pointer for its parameters. The CDM, tests,
adapters, and OEMCrypto implementations are changed to reflect this.

Test: tested as part of http://go/ag/5501993
Bug: 115874964

Change-Id: I981fa322dec7c565066fd163ca5775dbff71fccf
2018-11-16 17:14:00 -08:00
Fred Gylys-Colwell
4550979f22 OEMCrypto Resource Rating
Merge from master branch of Widevine repo of http://go/wvgerrit/66072
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/63764

This adds the function OEMCrypto_ResourceRatingTier to the oemcrypto referenece
code, dynamic adapter, and unit tests.

Bug: 117110800
Test: tested as part of http://go/ag/5501993

Change-Id: Idf47af405f0c69601108b75c788a97b30abdb39d
2018-11-16 17:14:00 -08:00
Fred Gylys-Colwell
52b274a3a4 Add HDCP 2.3 to logs
Merge from master branch of Widevine repo of http://go/wvgerrit/66071
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/63842

OEMCrypto tests log the HDCP value.  This CL updates those logs to include logs
for HDCP 2.3.

Test: unit tests
Test: tested as part of http://go/ag/5501993
Bug: 78773763
Change-Id: I7a3003e081c3c848b5d595ac241a0b546dacb747
2018-11-16 17:14:00 -08:00
Fred Gylys-Colwell
43a47a60c0 Add session parameter to OEMCrypto_CopyBuffer
Merge from master branch of Widevine repo of http://go/wvgerrit/66070
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/63662

To make the threading model more clear, CopyBuffer is now a session function.
This means we need to pass in which session the current thread locks.

Test: unit tests.
Test: tested as part of http://go/ag/5501993
Bug: 113680369
Change-Id: I2fdd2cfcaab99f3793950b3845941463675f5e4c
2018-11-16 17:14:00 -08:00
Fred Gylys-Colwell
ef067572bc Remove error OEMCrypto_KEY_NOT_LOADED
Merge from master branch of Widevine repo of http://go/wvgerrit/66066
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/63628

The error code OEMCrypto_KEY_NOT_LOADED is redundant with
OEMCrypto_ERROR_NO_CONTENT_KEY and OEMCrypto_KEY_NOT_ENTITLED.  The
function LoadEntitledContentKey should return KEY_NOT_ENTITLED if it
does not find the corresponding entitlement key in its key table.  All
other functions that do not find a key id in the key table should
return OEMCrypto_ERROR_NO_CONTENT_KEY.  This includes QueryKeyControl,
SelectKey, and RefreshKeys.

Test: unit tests
Test: tested as part of http://go/ag/5501993
Bug: 115574797
Change-Id: Ida2111f32e331b99f3f0c77fa404a42654d0870c
2018-11-16 17:09:32 -08:00
Fred Gylys-Colwell
f3e9d84484 Add build info API to OEMCrypto
Merge from master branch of Widevine repo of http://go/wvgerrit/66065
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/63080

This is for the reference code, the unit tests, and the oemcrypto adapter.

Bug: 116414218
Test: unit tests
Test: tested as part of http://go/ag/5501993

Change-Id: I05a631f6cfcf1584a748b3a0c9ae48633893589f
2018-11-16 15:38:45 -08:00
Fred Gylys-Colwell
f2edb8f2dd Update API version to 15
Merge from master branch of Widevine repo of http://go/wvgerrit/66064
Merge from oemcrypto-v15 branch of Widevine repo of http://go/wvgerrit/63063

This is in the reference code for OEMCrypto, and in the unit tetss.

Bug: 111939411
Test: unit tests
Test: tested as part of http://go/ag/5501993

Change-Id: I2cc2e7028f62d1c375eb632452eef94566fa9ae3
2018-11-16 15:38:45 -08:00
Fred Gylys-Colwell
05fc8b5e97 Temporarily use old test keybox
Merge from Widevine repo of http://go/wvgerrit/65922

This CL puts the old 4121 test keybox back into the unit and android
integration tests so that we can run tests on a device with OEMCrypto v13.

This change should not be released, and should not be included in CE CDM.  It
should be removed once we have more test devices with v14 or v15.

Bug: 119313532
Bug: 119316243
Test: unit tests
Test: tested as part of http://go/ag/5501993

Change-Id: If6a459e11176e07c66fbe6fc45c63d87595a20dc
2018-11-16 15:38:45 -08:00
Fred Gylys-Colwell
458de2569d Remove old test cert and rest of 4121
Merge from Widevine repo of http://go/wvgerrit/62782

There were still some old test keyboxes in the unit tests for older devices and
in the mod mock.  These are removed.  Also, the cert with system id 7346 has
been removed.

The new test keybox has system ID 7912.
The new test cert has system id 7913.

bug: 76435251
Test: unit tests (unit tests do not pass on v13 oemcrypto)
Test: tested as part of http://go/ag/5501993

Change-Id: I6007b6650162d9dc9d01384faaafc87acdf8ebd7
2018-11-16 15:38:45 -08:00
Fred Gylys-Colwell
c3772ebd0c Ensure provisioned in unit tests
Merge from Widevine repo of http://go/wvgerrit/61262

This CL helps the CE CDM unit tests provision by providing a helper code to
determine if OEMCrypto is L1 or L3.

Test: unit tests
Test: tested as part of http://go/ag/5501993
Bug: 37286053
Change-Id: Ibe358e0eb628b4051f2db3406eaa6fcfc07f07ff
2018-11-16 15:38:45 -08:00
TreeHugger Robot
fcb428fc26 Merge "Multiple RSA keys unit test" 2018-09-24 21:54:35 +00:00
Fred Gylys-Colwell
20e85635a2 Multiple RSA keys unit test
Merge from Widevine repo of http://go/wvgerrit/55460

This test ensures that different oemcrypto sessions can use different RSA keys.

bug: 110319198 Test concurrent sessions can use different DRM certificates
test: unit tests on taimen
Change-Id: Id75eedea347d453987dfe42894a8a7301e345674
2018-09-18 23:49:47 +00:00
Fred Gylys-Colwell
e288d10026 Unit test with small buffer
Merge from Widevine repo of http://go/wvgerrit/57640

Add a unit test for OEMCrypto to handle a small buffer.

Test: unit tests
bug: 78233951
Change-Id: I5efe088705e2d248ab9ea45d8576daf69ad8bcdb
2018-09-18 16:48:13 -07:00
Fred Gylys-Colwell
562c14b5f1 Use InstallRootKeyCertificate for keybox and cert
Merge from Widevine repo of http://go/wvgerrit/55461

This CL allows provisioning 3.0 devices to install their OEM certs
from an initialization partition.  This method is already used for
keyboxes on Android -- we are just adding the ability to use it for
OEM certs, also.

Also, for v15, we require OEMCrypto to report a valid certificate in
the unit tests.

bug: 111725154
test: unit tests
Change-Id: I142c84a1a67bdb4cee943cfd12a632421901eb24
2018-09-18 16:33:11 -07:00
Fred Gylys-Colwell
e37509dcb2 Remove keybox from OEMCrypto ref
Merge from Widevine repo of http://go/wvgerrit/56526

This CL removes the test keybox from OEMCrypto reference code.

Test: unit tests
Bug: 76393338 split mock into ref and testbed
Change-Id: I4bf0eb777c6851191d0ac9ccf8e2b42c55c8f6b9
2018-09-18 16:33:11 -07:00
Fred Gylys-Colwell
4af5aaf18a Add test base that catches nonce flood
Merge from Widevine repo of http://go/wvgerrit/56520

This CL adds a test base that installs a test keybox and catches nonce
flood errors for all CDM tests.

In order to do this, a new class is added called a
CryptoSessionFactory.  The default factory just creates a new
CryptoSession.  All places in the code that create a new CryptoSession
now call the static method MakeCryptoSession, which uses the current
factory to create a CryptoSession.  If MakeCryptoSession is called and
there is no current factory, a default factory is created.

The CryptoSession constructor is now private, so that we do not
accidentally try to create one without using the factory.

For the new test base, we first create a special test
CryptoSessionFactory that creates a TestCryptoSession.  The test
factory catches the first call to MakeCryptoSession and injects an
installation of the test keybox after OEMCrypto_Initialize is called.

The TestCryptoSession injects a sleep statement and a retry whenever
it detects a nonce flood.

Test: current unit tests still pass.
bug: 72354901 Fix Generic Crypto tests.
bug: 111361440 Remove #ifdef from unit tests
Change-Id: I248e7f3c53721c04d2af412ef835e19bb4d15d9a
2018-09-18 16:33:11 -07:00
Fred Gylys-Colwell
60d010d18d Address review comments
Merge from Widevine repo of http://go/wvgerrit/54540

Addressing comments in http://go/ag/4448747

Test: tested as part of http://go/ag/4674759
Change-Id: I29005397efcc2e982e635581cc68c8293cea6243
2018-09-09 11:37:48 -07:00
Fred Gylys-Colwell
299623e148 Use different time call in TimeRollbackPrevention test
Merge from widevine of http://go/wvgerrit/48885

iOS prohibits using clock_settime. In order to make the test consistent,
we set time using settimeofday instead.

Test: tested as part of http://go/ag/4674759

Change-Id: I8812b9b099fa8160591fafece070c34afeed82fa
2018-09-02 11:45:16 -07:00
Fred Gylys-Colwell
947531a6a9 Refactor oemcrypto mock into stand alone reference code
Merge from Widevine repo of http://go/wvgerrit/46204
Refactor utility code - split the mock, step 1

Merge from Widevine repo of http://go/wvgerrit/46205
Move some OEMCrypto types to common header - split the mock, step 2

Merge from Widevine repo of http://go/wvgerrit/46206
Split mock into two -- step 3

Merge from Widevine repo of http://go/wvgerrit/47460
Split the mock into two -- step 3.5

The CL moves several files used by oemcrypto and cdm into a common
subdirectory, so that it may more easily be shared with partners.

The CORE_DISALLOW_COPY_AND_ASSIGN macro was moved to its own header in
the util/include directory.

This CL removes some references to the mock from other code, and puts
some constants and types, such as the definition of the keybox, into a
header in oemcrypto.

Test: tested as part of http://go/ag/4674759
bug: 76393338
Change-Id: I75b4bde7062ed8ee572c97ebc2f4da018f4be0c9
2018-09-02 11:45:16 -07:00
Fred Gylys-Colwell
5b74e3186a Refine TwoHundredEntries tests
am: a963e90bb8

Change-Id: I38d4ccb9c7e517e72a2b4555557db0de01f01302
2018-08-29 18:10:22 -07:00
Fred Gylys-Colwell
a963e90bb8 Refine TwoHundredEntries tests
Merge from Widevine repo of http://go/wvgerrit/58440

This CL modifies the oemcrypto test TwoHundredEntries so that it
attempts to create more than 200 entries.  A device is allowed to fail
when such an attempt is made, but it must return an insufficient
resources error.

The test then verifies that each of the entries that were succesfully
created can be used to reload its license and the keys can be used for
decryption.

It then shrinks the usage table header, and verifies that the
remaining licenses can still be used for decryption.

bug: 112486006
test: unit tests (test code only)
Change-Id: I6e6edfb00f0553724e0f99fb4e5ea5c817450937
2018-08-29 14:54:25 -07:00
Haibo Huang
3513db8f73 Remove std::tr1::
To be compatible with latest googletest.

Test: compile
Change-Id: I15d857ce7b9b28ba5f75c84c61f1c6a970012ca7
Merged-In: I15d857ce7b9b28ba5f75c84c61f1c6a970012ca7
2018-08-10 21:37:50 +00:00
Fred Gylys-Colwell
b396f9a870 Fix entry count in TwoHundredEntries
Merge from Widevine repo of http://go/wvgerrit/50600

The entry count was really 201 -- it should be 200.

test: This code is unit tests only -- no production code.
bug: 79875327
Change-Id: Ib81253ce9d51a7157ea0a64cddeb6cc266b3e25e
2018-05-16 15:08:35 -07:00
Fred Gylys-Colwell
bd6bbce86f Unit test for kInactiveUnused usage reports
Merge from Widevine repo of http://go/wvgerrit/50422

This CL adds unit tests to verify that a usage report can have the status
kInactiveUnused.

bug: 79556142
test: unit test code only
Change-Id: I10f71ac2e585ef33727aa8f80d867d80fe156ab8
2018-05-15 13:23:30 -07:00
TreeHugger Robot
f29901e310 Merge "Use 128 bit AES for key control block" into pi-dev 2018-05-09 21:57:29 +00:00
Fred Gylys-Colwell
a313985174 Add unit test for nonce sharing
Merge from Widevine repo of http://go/wvgerrit/49302

This CL adds some unit tests to verify that several OEMCrypto sessions
do not share nonce tables.

bug: 64850992
test: unit tests run on sailfish, taimen, and walleye.
Change-Id: I06cf3fdafb84f8b09cf2f0e58c1866bac511a293
2018-05-08 14:30:37 -07:00
Fred Gylys-Colwell
98532d313b Use 128 bit AES for key control block
Merge from Widevine repo of http://go/wvgerrit/49805

This aligns the oemcrypto reference code and unit tests to match the
API design doc: http://go/oemcrypto

bug: 79375509
test: unit tests pass
Change-Id: I13761a7384a17e99d88e61aaf80b4a22941fd172
2018-05-08 14:01:45 -07:00
Srujan Gaddam
73c3007c24 Address offline playback with rollbacked time
Merge from http://go/wvgerrit/47640

Test: unit/integration tests

Bug: b/62058202

The usage table keeps track of license duration by using the current
system time. However, if a user were to rollback the time, they can
effectively continue offline playback indefinitely. This changes the way
we compute time by computing offsets by which the user rollbacked the
time and adding it to the current time. This change also includes a test
to verify protection against rollback for usage entries that is only run
when the user is root.

Change-Id: I97c430e1443747b0f9759ae5390b8f5d06bdebf1
2018-04-23 15:44:26 -07:00
Fred Gylys-Colwell
1a25cbdad6 Update Copyright
Merge from Widevine repo of http://go/wvgerrit/47860

This CL updates the copyright notice to indicate that files
shared with partners are shared under the Widevine Master
License Agreement.

bug: 77926774
test: comment change only
Change-Id: I0423668111578b80fb39a932d763df2827e2dfc3
2018-04-16 16:38:05 -07:00
Srujan Gaddam
f217742582 Fixed loading mac keys in mock and Level3
Merge of http://go/wvgerrit/45521/

Bug: b/73818548

Test: request_license_tests and GTS tests on sailfish and taimen

This change loads the mac keys into the session to be used in
GenerateSignature from the last call to one of: DeriveKeysFromSessionKey,
GenerateDerivedKeys, LoadKeys, and LoadUsageEntry. OEMCrypto tests are
changed to reflect this as well (specifically the order in which we call
the above methods).
2018-03-29 10:39:21 -07:00
Fred Gylys-Colwell
f1f88f529e Disable v14 unit test for Pi
Merge from Widevine repo of http://go/wvgerrit/44502

OEMCrypto v14 is no longer required for Pi, so this CL disables the
unit test verifying that version.  The test will be re-enabled for
MR1.

test: unit tests
bug: 74003607
Change-Id: I76f9b66e1652ffb1f8a5bfc7be572e3c7a4cff83
2018-02-28 15:27:14 -08:00
Fred Gylys-Colwell
9729663671 Adjust nonce flood rate in mock oemcrypto
Merge from Widevine repo of http://go/wvgerrit/43721

This CL allows the tester to change the nonce flood rate from the
default of 20.  A tester would want this value to be larger to make
tests run more quickly.

Setting the rate to 1 makes every other nonce request a flood error.
A tester wants to do this in order to verify cdm code responds to
nonce flood correctly.  Several failing oemcrypto tests have also been
corrected.

This CL changes test code only.

bug: 73607610
test: unit tests
Change-Id: I3f52ff7ea9bcc1db7bc0e010da0b64a12d3b4dd3
2018-02-21 13:34:09 -08:00
Fred Gylys-Colwell
6562488d0f Fix key size when decrypting KCB with entitlement keys.
Merge from Widevine repo of http://go/wvgerrit/42942

This CL changes test code only.

Bug: 73132054
test: unit tests

Change-Id: Ic9ca1879a942b0cad8ea15a98ed263a5fd170b4c
2018-02-09 11:44:11 -08:00
Fred Gylys-Colwell
a682329684 Fix backwards compatibility
Merge from Widevine repo of http://go/wvgerrit/42403

This CL changes the names of some unit tests so that they don't run
when testing an older version of oemcrypto.

bug: 68275290
test: ran unit tests against v8-v14 oemcrypto.
Change-Id: I773350adf4df3f3b310478400cd4d4e85789fc37
2018-02-06 21:23:42 +00:00
Fred Gylys-Colwell
8ae3759a7d Correct AES bit size for generic crypto
Merge from Widevine repo of http://go/wvgerrit/42402

This changes the AES key size back to 128 for keys that are not
entitlment keys.

bug: 72904259
test: unit tests
Change-Id: I07cc56050cafb82c65b67c56df3f18d375047eb8
2018-02-06 12:10:49 -08:00
Fred Gylys-Colwell
dfe6489ca2 Test Carmicahel RSA Keys
Merge from Widevine repo of http://go/wvgerrit/42064

This adds a unit test to verify that OEMCrypto can load a certificate
with an RSA private key generated using the Carmichael Totient.

bug: 67309725
test: No new failures. This code is part of unit tests only.

Change-Id: I492cf6bcff0ac2d1a838e7aa334c4b2b580ac5c7
2018-01-31 01:07:56 +00:00
Fred Gylys-Colwell
8230484de2 Fix some unit tests
Merge from Widevine repo of http://go/wvgerrit/42020

This CL fixes the OEMCrypto unit tests for refresh license.

Test: ran unit tests

bug: 64851667
bug: 72497813
Change-Id: Ice1661fd832793358b725be9016d85465f6b8d14
2018-01-30 00:48:11 -08:00
Fred Gylys-Colwell
8de7caf788 Fix entitlement keys encryption and content key loading.
Merge from Widevine repo of http://go/wvgerrit/41831

Bug: 72418096 OEMCrypto14 entitlement keys failed decryption testing
Test: in child CL

Change-Id: Ie92c34edb6162fb1e4553c5364f478de189ab793
2018-01-30 00:03:29 -08:00
Fred Gylys-Colwell
d72f49e31a Update LoadTestKeybox
Merge from Widevine repo of http://go/wvgerrit/41662

This CL updates oemcrypto unit tests to use the new test keybox.

bug: 69552641 Update OEMCrypto_LoadTestKeybox

test: Unit tests compile and run -- many tests won't pass until merged
with vendor code

Change-Id: I73bdca3958b2c985d4c61801aa95807a2e6d4299
2018-01-24 21:54:34 -08:00
Fred Gylys-Colwell
19cb1792a4 OEMCrypto v14 Unit tests and reference code
Merge from Widevine repo of http://go/wvgerrit/41661

bug: 64001862 OEMCrypto V14 for Android P

test: Unit tests pass
Change-Id: I3314a881357c12ef63d7b257d83f6f0d07e4725a
2018-01-24 21:54:34 -08:00
Fred Gylys-Colwell
979ed70c7b Add Entitlement License to OEMCrypto
This CL adds entitlement license features and moves cipher mode from
LoadKeys to SelectKeys.

Merge from Widevine repo of http://go/wvgerrit/41660

bug: 70334840 Entitlement License - cdm layer
bug: 70334345 Entitlement License - reference code and unit tests

test: Entitlement license unit tests pass.
Change-Id: Ic7d7f42c15e6d83ef7fcfd8a866c778adc4c8095
2018-01-24 21:53:15 -08:00
Fred Gylys-Colwell
df389c1417 Convert oemcrypto tests to BoringSSL
Merge from Widevine repo of http://go/wvgerrit/41620

bug: 62739406
test: unit tests
Change-Id: I72a64623912305965ff625a45041e2932a41f69b
2018-01-24 21:53:15 -08:00
Srujan Gaddam
c58a0c62fe Make OEMCrypto test error-order agnostic
Bug: b/72320670
Test: Verified by unit/integration tests on sailfish

Merge from Widevine master of http://go/wvgerrit/41240

Previously, OEMCertForbiddenPaddingScheme checks to see if the OEMCrypto
returns a short buffer error on GenerateRSASignature and then resizes it
accordingly if so. If the OEMCrypto does not return this error first
(and instead complains about the padding scheme), the assertion will
return false since the signature has size 1. This CL changes that so it
doesn't matter which error the OEMCrypto returns first.

Change-Id: I2fd3a3814ff3722fd40ae6a3bcbd65293c9baed7
2018-01-22 14:01:43 -08:00
Rahul Frias
aac1439dea Merges to android Pi release (part 12)
These are a set of CLs merged from the wv cdm repo to the android repo.

* Correct error logging

  Author: Rahul Frias <rfrias@google.com>

  [ Merge of http://go/wvgerrit/40000 ]

  In tests, we set the cipher list to avoid using insecure
  ciphers when connecting to the provisioning/license service.
  The result of setting the cipher list was being incorrectly
  validated.

  Bug: 64847919

* Move mips cache headers to clear_cache_function.h

  Author: Srujan Gaddam <srujzs@google.com>

  [ Merge of http://go/wvgerrit/39700 ]

  Since the clear_cache function has been moved away from the dynamic
  adapter, we need these conditional includes to be migrated as well for
  MIPS.

* Comment out Level 3 debug call until merge

  Author: Srujan Gaddam <srujzs@google.com>

  [ Merge of http://go/wvgerrit/39761 ]

  This call was introduced in go/wvgerrit/34260/. Since the haystack tool
  in google3 still needs this merge, this should be commented out so the
  tool can still build until the merge has finished.

* Add logging for MAC keys to mock

  Author: Srujan Gaddam <srujzs@google.com>

  [ Merge of http://go/wvgerrit/39740 ]

  Bug: 70637842

* Move external interfaces into level3.h + refactor

  Author: Srujan Gaddam <srujzs@google.com>

  [ Merge of http://go/wvgerrit/39673 ]

  As part of b/70523618, this CL moves interfaces that partners are
  responsible for in Level 3 to level3.h so they can be visible as
  part of the CDM release process. It also cleans up some of the
  names of the files and adds documentation.

* Corrected close session logging level

  Author: Rahul Frias <rfrias@google.com>

  [ Merge of http://go/wvgerrit/39676 ]

  Bug: 69460963

* Remove Security Level Path Backward Compatibility Support

  Author: Rahul Frias <rfrias@google.com>

  [ Merge of http://go/wvgerrit/39505 ]

  From the android K release onwards certificates were stored in
  security level specific directories. If upgrading from
  previous releases persistent information needed to be moved
  to those directories.

  Since no device is likely to upgrade from J to Pi, comptibility
  support can be removed.

  Bug: 70160032

* Rename privacy_crypto_openssl To privacy_crypto_boringssl

  Author: John W. Bruce <juce@google.com>

  [ Merge of http://go/wvgerrit/37122 ]

  Now that we no longer support OpenSSL in the Shared Source CDM, the name
  of this file can be updated.

  Bug: 67907873
  Test: build.py x86-64
  Test: wv_ce_cdm_unittest
  Test: jenkins/linux_unit_tests

* Remove Conditional Compilation from OpenSSL/BoringSSL

  Author: John W. Bruce <juce@google.com>

  [ Merge of http://go/wvgerrit/39460 ]

  This change removes the usages of conditional compilation to support
  both BoringSSL and OpenSSL, as well as to support multiple versions of
  the OpenSSL API. All code is now compiled against one of the two
  versions of BoringSSL in third_party/.

  Note that in some cases, the kit/ and legacy_kit/ versions of BoringSSL
  had different APIs, so when removing the OpenSSL version compatibility
  conditional compilation, sometimes the older branch was kept and
  sometimes the newer branch was kept.

  Bug: 67907873
  Test: build.py x86-64
  Test: wv_ce_cdm_unittest
  Test: jenkins/linux_unit_tests

* Build CE & Jenkins CDMs With BoringSSL from third_party/

  Author: John W. Bruce <juce@google.com>

  [ Merge of http://go/wvgerrit/37120 ]

  Up until now, integrators have been responsible for providing a
  compatible crypto library for use by the CE CDM. (either OpenSSL or
  BoringSSL) After this change, this decision will no longer be in their
  hands. The CE CDM build will always use the copy of BoringSSL in
  third_party/, which will be statically linked with our library with
  hidden visibility. This allows us to better control what crypto library
  we use and will prevent continuing problems with trying to support both
  OpenSSL and BoringSSL.

  Unfortunately, BoringSSL began using C++11 in mid-2017, and we can't
  support C++11 right now. Until we can, we need to use a C++11-free
  version of BoringSSL for libssl. The CDM itself will continue to use a
  recent BoringSSL, as it only needs libcrypto. But the unit tests that
  need libssl have to use the legacy version.

  Bug: 67907873
  Test: build.py x86-64
  Test: wv_ce_cdm_unittest
  Test: jenkins/linux_unit_tests

* Modified RNG for Level3 to use more entropy

  Author: Srujan Gaddam <srujzs@google.com>

  [ Merge of http://go/wvgerrit/39220 ]

  Bug: 65165076

  Modified seed generation to use an xor of clock_gettime and
  client-implemented code to supply random seeds to the RNG. Modified the RNG
  as well to use xoroshiro128+ instead of xorshift, since it uses more
  than one seed/state (which are 64-bit) and has higher "statistical quality".
  The default implementations for the seed generation use /dev/urandom.

* Configure base path for Level3FileSystem

  Author: Srujan Gaddam <srujzs@google.com>

  [ Merge of http://go/wvgerrit/39506 ]

  This is in response to b/70354006. This change makes the
  Android Level3FileSystem use the existing properties method
  GetDevicesFilesBasePath for binderization. The same is done for the
  Linux implementation.

* Add legacy_kit/ to BoringSSL Directory

  Author: John W. Bruce <juce@google.com>

  [ Merge of http://go/wvgerrit/38861 ]

  This adds a second copy of BoringSSL to the third_party/boringssl/
  directory. This second copy is pinned to the last revision of BoringSSL
  not to require C++11 and is not updated by the UPDATE_BORINGSSL.sh
  script. This second copy will be used to provide libssl to the tests on
  devices that do not support C++11.

  Once we support C++11 in the CDM again, this weight should be removed
  and all targets should use the copy of BoringSSL in the kit/ directory.

  Bug: 67907873

* Use Shared Libraries for Unit Tests

  Author: John W. Bruce <juce@google.com>

  [ Merge of http://go/wvgerrit/38860 ]

  Some unit tests were using a statically-linked CDM instead of a
  dynamically-linked one. (Or, in one case, trying to link both ways into
  the same binary.) For now, we need to only link dynamically, so that the
  unit tests and the CDM can use different versions of BoringSSL.

  Long-term, we would like to test both kinds of linkage. (See b/69548115
  for that.)

  Some unit tests were also using a dynamicaly-linked CDM that was named
  such that it appeared to be statically-linked. This patch renames some
  targets to make the linkage clearer.

  Bug: 67907873

* Change CDM_Backwards_Compatiblity_Tests to dedicated brances

  Author: Fred Gylys-Colwell <fredgc@google.com>

  [ Merge of http://go/wvgerrit/39003 ]

  The build scripts used by CDM_Backwards_Compatiblity_Tests now pull
  old versions of oemcrypto from the dedicated branches oemcrypto-v*,
  which [will eventually] contain old oemcrypto versions, that build
  with the current build system with a current boringssl version.

  bug: 67907873

* Fix spacing on level3 header

  Author: Srujan Gaddam <srujzs@google.com>

  [ Merge of http://go/wvgerrit/38760 ]

* Correct Query status calls

  Author: Rahul Frias <rfrias@google.com>

  [ Merge of http://go/wvgerrit/38640 ]

  Bug: 70160032

* Refactoring to allow encryption of client ID

  Author: Rahul Frias <rfrias@google.com>

  [ Merge of http://go/wvgerrit/37460 ]

  The code has been restructured to allow encryption of client
  identification in provisioning requests. This will be enabled
  when server side changes have been made (b/69427217).

  * Additional information is included in the Client Identification
    portion of the provisioning request.
  * Client identification will be encrypted with a service
    certificate provided by the app/client. Platform changes
    to enable passing this to core are needed. If a service certificate
    is not provided, a default one associated with the production Keysmith
    will be used.
  * Switched APIs in CdmEngine to take a service certificate for
    provisioning rather than licensing. Service certificates for
    licensing are session based and passed as properties from platform
    code.

  Bug: 30737060

* Allow some CDM errors to be reported from multiple locations

  Author: Rahul Frias <rfrias@google.com>

  [ Merge of http://go/wvgerrit/38360 ]

  This creates some CdmResponseType errors which may be reused
  PARAMETER_NULL, NOT_INITIALIZED_ERROR, REINIT_ERROR.

  I have made changes to a few classes to report these errors.
  Will work on additional classes in a separate CL.

  Bug: 69864404

BUG: 71650075
Test: WV Unit/integration tests
Change-Id: Icc048770d424ac537d11ff327cda2cb142da802d
2018-01-16 19:34:30 -08:00