[ Cherry-pick of v19 http://go/wvgerrit/219592 ]
[ Merge of http://go/wvgerrit/219554 ]
The original CheckBuildInformation_OutputLengthAPI17 test was
written with the assumption that the estimated length would not
be too much larger than the real length of the build info; however
this is not true for some vendors.
This CL changes the short-buffer length to be based on a real
build info length from a successful call to OEMCrypto.
Bug: 411308060
Change-Id: I6504288ca59d7d41facaadc45adc76a5236826d9
[ Merge of http://go/wvgerrit/219213 ]
Updates CheckJsonBuildInformationAPI18 to better check the contents
of the JSON build information introduced in V18.
Bug: 348498112
Bug: 348497732
Change-Id: I567700eb2ba451a9b10c52159d5fd30d5ae94841
[ Merge of http://go/wvgerrit/219212 ]
This CL adds a new OEMCrypto test CheckBuildInformation*API17 which
ensures that OEMCrypto_BuildInformation() is generating valid build
information.
Bug: 348498112
Bug: 348497732
Change-Id: I22f9878d8ffa05b2b1b1b6ec28718e231438d4a7
Merged-In: I22f9878d8ffa05b2b1b1b6ec28718e231438d4a7
Merge of https://widevine-internal-review.git.corp.google.com/c/cdm/+/206431
Message to be signed by CAST funciton is supposed to be in a certain
format: "constant prefix + SHA1(message)".
Some of our current CAST tests uses random message which break this
specification. This fixes the input message.
Test: Cast tests with run_fake_l1_tests
Bug: 359893908
Change-Id: I6b318d749971d837f13daa7b147313e8e0b1d3d0
We are receiving reports from partners in the field that they are
failing the OEMCrypto tests only because the tests assume the BCC will
fit into 5k of memory but their BCC is nearly 8k in size.
This patch increases the buffer to 10k.
Bug: 354834629
Test: x86-64
Merged from https://widevine-internal-review.googlesource.com/204773
Change-Id: I360196518b7651139c003505253d1aed6a0c3907
This is based on a patch submitted by Amlogic.
When we're doing decrypt fallback, either in the CDM or the OEMCrypto
tests, we sometimes fall back to a point where we're synthesizing new
samples and/or subsamples for the content being decrypted. When this
happens and the output buffer is clear, we should limit the size of the
output buffer to only the space needed to hold the output.
Previously, we've been passing the entire output buffer to every call.
This can create a problem if the reason for the fallback is a lack of
enough memory to communicate the buffers to the TA, since the output
buffer will remain the same size as the total output. Restricting the
buffer passed to each call to only the space needed by that call will
reduce the memory requirement.
Bug: 354834629
Test: x86-64
Merged from https://widevine-internal-review.googlesource.com/204810
Merged from https://widevine-internal-review.googlesource.com/204953
Change-Id: I412f43d8f88c72072ef1dd5293436bdb58e500b3
[ Merge of http://go/wvgerrit/199050 ]
Fix to L3 renewal policy bypass attack:
OEMCrypto_DeriveKeysFromSessionKey cannot be called after a license is
loaded.
Re-generated L3 from oemcrypto-v19 branch.
Also needed to update a few tests because it now returns a different
error code.
Test: tested with
https: //widevine-internal-review.git.corp.google.com/c/cdm/+/196392
Bug: 334154045
Merged from https://widevine-internal-review.googlesource.com/197957
Change-Id: Id0e81123b140085654106e99a05ae2405091f101
[ Merge of http://go/wvgerrit/195850 ]
Since Widevine device builds now include APEX prebuilts,
shared library dependencies for the prebuilts are in
are in /apex/com.google.android.widevine/lib[64] rather
than /system/lib[64] or /vendor/lib[64]. When tests are
run not all the dependencies are present.
These changes include
* Statically linking missing dependencies
* Adding /apex/com.google.android.widevine/lib[64] to
the shared library path
* Searching for some of the test executables in
/data/nativetest[64]/vendor/
Bug: 329888778
Bug: 329891889
Bug: 329891175
Bug: 329891049
Test: ./build_and_run_all_unit_tests.sh
Change-Id: I067685cedc7701c4e6502bdac98b53e22b61ad1e
Extract BCC and build info from oemcrypto, construct BCC uploading
record and dumps it out a JSON file.
The BCC uploader will pick up the output file later.
Bug: 312787974
Change-Id: Ie8ef6a75408e8ef8355b1c0de14532de0ae83732
[ Partial merge of http://go/wvgerrit/188279 ]
This CL adds unit tests to verify that the following
forbidden uses of an RSA private key do not work:
- ForbidPrepAndSign -- A cast cert key cannot sign a license
request.
- ForbidUseAsDRMCert -- A cast cert cannot be used with the
DRM cert's padding scheme and it cannot be used to derive
keys from a session key.
- *ForbidRSASignatureForDRMKey* -- A DRM cert key cannot be
used with GenerateRSASignature.
- *OEMCertForbidGenerateRSASignature* -- An OEM cert key
cannot be used with GenerateRSASignature.
Bug: 251875110
Test: WVTS
Change-Id: I55b1eb04465023352edea55ba4ef532d1cd07231
[ Merge of http://go/wvgerrit/192010 ]
Adding files not merged in ag/26501922
Updates the CDM to add support for DRM reprovisioning request creation.
- Load the baked-in certificate for use as the client token.
- Add functions to build and sign a drm reprovisioning request.
- Update the Rikers L3 OEMCrypto implementation to support signing
provisioning requests and getting embedded certificate.
- Update client id token to handle DRM reprovisioning.
- Add OEMCrypto function to load the baked-in device certificate in
Rikers CDMs and stubs for non-Rikers CDMs.
- Add dynamic adapter support for getting embedded device certificate
only on L3.
Bug: 305093063
Test: WVTS
Change-Id: I839db69a48c1add196f9b56e6ee3812f549f814d
OEMCrypto_LoadProvisioning() has changed signature in v19.
Added lipcppbor library and utils to Android tests.
Test: build_all_unit_tests.sh
Bug: 324147162
Change-Id: Id890f97602f684e38d6e42cace9d5dc225958bec
To ensure the ref impl of OEMCrypto_GetDeviceSignedCsrPayload() in OPK
and testbed returns the correct sample format.
Test: opk_ta_p40, run_fake_l1_tests
Bug: 300304834
Change-Id: I6d399774fbaac2e12096cf878d582cd3c1320318
Let the sample device info built by ref implementation include all
required fields to pass device info validation tests.
Test: opk_ta_p40, run_fake_l1_tests
Bug: 307968622
Change-Id: Ib6b7645a1d26347f6992dd3c3bc2f39d4a92b283
Some tests were not in a doxygen group, so they were not
showing up on the dev site.
Bug: 298719677
Change-Id: Ic86b7999ac7ab324eb40a30023b74897f87d97e5
The returned BCC from OEMCrypto_GetBootCertificateChain() can be
validated by unit tests with BccValidator.
Test: run_fake_l1_tests, opk_ta_p40
Bug: 300304834
Bug: 307968622
Change-Id: I6312cb45548f5d8a711c13ea0356d6ec8db51082
For DRM, but not for CAS, we allow the entitlement session
and the entitled session to be the same.
Bug: 301462149
Change-Id: Ib830484be8437b1c4ce34500ae912e6c119dcfc3
(cherry picked from commit c1ec1c248d3ca1d3bc414c71cc9222c77d56f043)
This updates the code and tests to allow for using license protocol 2.2
when using OEMCrypto v19.
Issue: 80428549
Issue: 121031064
Issue: 232464183
Change-Id: Ib6bb61f86dd310b566227462658530bca5940b88
Since we want to migrate to using GTEST_SKIP to skip unit tests instead
of GTEST_FILTER, we can remove the RestrictFilter() function which
filters the tests out using GTEST_FILTER. To do this, the RSAPerformance
test needs to be removed, which is acceptable since no one uses this
test anymore. However, b/299135804 is being used to track a new way to
either execute/track permance.
Bug: 251240681, 299135804
Change-Id: Ife59c468ee127f4c39d3be91707ca38a061b7895
Since KDF functions are only used right before specific functions, this
merges them to simplify internal state within OEMCrypto.
Fixes: 299527712
Change-Id: I426cfcdc102bd73cf65cd809b213da2474f44b34
The current implementation of OEMCrypto_SetDecryptHash gives developers
flexibility to use different types of hashes. However, all the
implementations we have seen thus far use crc32. Because of this, crc32
should be sufficient and we can refactor OEMCrypto_SetDecryptHash to
only use the crc32 hash.
Bug: 287706586
Change-Id: I4aaa253b2656dfd9c984f77dfb08fe160b23b47c
The extra call to OEMCrypto_GenerateNonce is not needed. And it would
also lead to failure when the fuzzers are linked with the OPK
serialization layer.
Bug: 324666282
Change-Id: I43941fd5ee1f15f7106e6f0be2b65dce206225cf
- Initialize allowed_schemes_ since it is used by CreateDefaultResponse.
- Issue was detected by Coverity.
Change-Id: I368c4773f6316b65196aaa39e23e70717299c570
