This CL modifies the haystack code to throw out the keybox if the
system id is wrong. This should help prevent b/33344450 from
persisting.
Part of this code change was to backport some updates to the haystack
tools on master.
arm/libwvlevel3.a Level3 Library 4445 Dec 6 2016 16:58:47
x86/libwvlevel3.a Level3 Library 4464 Dec 6 2016 17:06:21
mips/libwvlevel3.a Level3 Library 4465 Dec 7 2016 13:36:32
b/33556871
Change-Id: I8dadf4bc7981af6afb970533df61d34b80d133a7
This is a merge of go/wvgerrit/22627
The call table was meant to be a long-term way to track
the performance of all OEMCrypto function calls.
This feature does not get used. Apps that call into the
profiler can generate this from the history.
This change was designed to go into Android O
(go/wvgerrit/22503) but since the Call Table is causing problems
on specific chip sets its being removed in NYC MR2.
Bug: 33550032
Bug: 33459261
Change-Id: I2af417a32452e7d0d0a1ada8794efd849c497dc8
[ Merge of http://go/wvgerrit/21960 ]
When an offline release message is generated, a session is created
internally to generate the release and handle the release response.
If the response is never provided (network, server errors),
or there is an error when the response is being processed, the
session may not be closed. This change introduces a time to live for
release sessions of 60 seconds and will be reclaimed after this period.
Test: verified by unittests on angler
b/32223945
Change-Id: I3bd4637733ddf6c343956ed9f97c68d84dc7d4e4
[ Merge of http://go/wvgerrit/21960 ]
When an offline release message is generated, a session is created
internally to generate the release and handle the release response.
If the response is never provided (network, server errors),
or there is an error when the response is being processed, the
session may not be closed. This change introduces a time to live for
release sessions of 60 seconds and will be reclaimed after this period.
b/32223945
Change-Id: I3bd4637733ddf6c343956ed9f97c68d84dc7d4e4
Merge from widevine repo of http://go/wvgerrit/21681
This CL refactors some oemcrypto unit tests in preparation for adding
Provisioning 3.0 tests.
- The signature GenerateNonce has changed. Instead of the caller
passing in a pointer for the nonce, we store the nonce in a member
variable of Session.
- GenerateDerivedKeys is being replaced by InstallTestSessionKeys.
This sets up and calls the appropriate derive keys method. This
function is in the test class, instead of the session class so that
multiple sessions in a class can share the same wrapped rsa key.
This will be modified for provisioning 3.0 in a future CL.
- Rename tests that require a keybox. Some tests are specific for
using a keybox to request a DRM cert. These tests are renamed so we
can filter them out on devices that use an OEM Cert. Corresponding
tests for devices using provisioning 3.0 will be in a future CL.
- Some member variables and methods in the class Session were not
used. They are removed.
- Added openssl smart pointer.
- Comments. I added comments.
- clang format.
Change-Id: Ib579a322858e0ef92652a42167241b35cf85a041
Merge of several CLs from the widevine repo.
Merge from widevine repo of http://go/wvgerrit/22440
Build OEMCrypto v12 Haystacks with cache flush
level3/mips/libwvlevel3.a Level3 Library 4465 Nov 29 2016 13:34:45
level3/arm/libwvlevel3.a Level3 Library 4445 Nov 29 2016 14:02:08
level3/x86/libwvlevel3.a Level3 Library 4464 Nov 29 2016 14:22:21
Merge from widevine repo of http://go/wvgerrit/22403
Pull cache flush out of Haystack
Merge from widevine repo of http://go/wvgerrit/21145
OEMCrypto v12 stubs -- just the header file changes.
Merge from widevine repo of http://go/wvgerrit/21146
Add OEMCrypto v12 functions to profiler
This CL adds the new oemcrypto v12 functions for provision 3.0 to the
list of profiler functions.
Merge from widevine repo of http://go/wvgerrit/21143
OEMCrypto v12 adapter
This CL updates the oemcrypto dynamic and static adpaters to include
oemcrypto v12 funtionality. It adds the three new Provisioning 3.0
functions.
It also adds code in the initialization routine to null out all of
the function pointers if any of them fail to load. It is better to
fall back to level 3 than to use an inconsistent level 1.
b/31528025
Change-Id: I3579dc93e00ad7e7c743beecdd8291eac557d4e4
[ Merge of http://go/wvgerrit/22140 ]
There are occasional issues when trying to connect to
http://widevine-proxy.appspot.com/proxy . This changes introduces upto
3 retry attempts. The UAT server on appspot is being replaced by UAT on borg
and so it is not worth our while to debug these issues furthur.
b/30022298
Change-Id: I76c1421e93c7c14b5d2bcd7ad07119a705245922
(This is a merge of go/wvgerrit/21580)
The version number for N-MR1 has been increased to 7.1.1, which
triggered our version number canary. Since this is still N-MR1, no
Widevine version number update is necessary as we already updated it for
N-MR1, but the canary needs to be updated.
Bug: 32018966
Change-Id: Ia1d673f837d9c6a5935f26beec7372b25ea3a6b9
This CL merges several CLs from the widevine repo:
http://go/wvgerrit/18012 Add support for querying allowed usage for key.
http://go/wvgerrit/17971 Add per-origin storage.
http://go/wvgerrit/18152 Add OEMCrypto's generic crypto operations to CDM.
http://go/wvgerrit/17911 QueryKeyControlInfo => QueryOemCryptoSessionId
Note: numbering in wv_cdm_types.h was added in this CL and will be
back ported to wvgerrit in a future CL.
Change-Id: Idb9e9a67e94f62f25dc16c5307f75a08b3430b64
Merge of http://go/wvgerrit/20924
This CL pulls the cache flush code out of the haystack code and into
the adapter level. This is so it will be built with processor
specific compiler flags instead of as part of the precompiled binary.
level3/mips/libwvlevel3.a Level3 Library 4465 Sep 10 2016 21:44:37
level3/arm/libwvlevel3.a Level3 Library 4445 Sep 10 2016 21:30:01
level3/x86/libwvlevel3.a Level3 Library 4464 Sep 10 2016 21:49:53
b/30550782 Battery Problems
Change-Id: I8967da498a43cabe82e78345162705dc2fcdb859
(This is a merge of go/wvgerrit/20500)
This patch removes the logic that calculates the "pattern offset" from
the Android glue layer. There is no such thing as a pattern offset, and
setting this value to anything other than zero may break cens mode on
some devices.
To reduce the risk of setting this value to anything other than zero,
the offset_blocks parameter has been removed from the pattern descriptor
in the CDM Core. It will have to remain part of OEMCrypto v11,
unfortunately, but the code to set it to zero is now centralized in
CryptoSession.
Bug: 28726863
Change-Id: I9c5bfe470fe251c7a57901dc2e998f4dab7fe7d7
(This is a merge of go/wvgerrit/20402)
This updates the version number to v4.1.0 for the NYC-MR1 release. It
also updates the canary to pass on the nyc-mr1-dev branch.
Bug: 30813903
Change-Id: I05de038ff52e9f7633efff7011052b48b59d90fa
[ Merge of http://go/wvgerrit/19960 ]
Protections schemes are specified using a 4CC code {"cbc1", "cbcs",
"cenc", "cens"}. A host to network conversion was performed when the
PSSH was created and inserted into the license request. A reverse
conversion was performed when the code was extracted from the
license response.
These conversions are problematic if the PSSH is created externally and
passed into mediaDrm. To address this, the conversions have been removed
and allow protobuf to handle byte ordering. For backward compatibility
we allow codes in either ordering.
b/30713238
Change-Id: I25f01ecc621549fd3c13b443e4c8b89168463249
This makes it easier to translate an error code
number to the corresponding enum.
Merge of https://widevine-internal-review.googlesource.com/18793/
from the widevine repo.
Change-Id: I7d07f16e5477decd27fcc5391fc62b1bd254d4a3
[ Merge of http://go/wvgerrit/18295 ]
SSL v3 is being disabled across Google infrastructure. Networking
code in integration tests used SSL v3 during HTTPS protocol negotiation.
Once this is disabled, it will cause integration test failures at
staging and UAT license servers.
With this change the client will use TLS 1.2. Insecure cipher suites
(TLS_RSA_WITH_RC4_128_MD5, TLS_RSA_WITH_RC4_128_SHA,
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA)
have been disabled as well.
b/29356581
Change-Id: I98a04d345fe83c48132b9d79986a21cc84827dc8
In the unit tests, the test case name and test name
are logged, but currently the test case and name are
reversed. This CL orders them correctly, so instead
of, e.g. CheckHDCPCapability.OEMCryptoClientTest, we
get OEMCryptoClientTest.CheckHDCPCapability as intended.
Merge of go/wvgerrit/18045 from widevine repo
Change-Id: I20bb2d47de0c84b3a1f00bb46af5ed0a45d7fc56
[ Merge of http://go/wvgerrit/17959 ]
This will allow the license server to base licensing decisions on the
devices security module revision.
b/28882058
Change-Id: I574e7686bb305397946d2bfaff504cfae242e628
(This is a merge of http://go/wvgerrit/17661)
Because Widevine core always has a decrypt mode set, even on unencrypted
calls where we potentially do not know the crypto mode, it will reject
unencrypted decrypt calls for sessions that have been flagged as
AES-CBC, since the crypto mode defaults to AES-CTR.
The fix is to not validate the crypto mode on unencrypted decrypt calls,
as the data won't be getting decrypted anyway.
Bug: 28423928
Change-Id: If848834dd498ca96983a2b69d448b8d81d50e0a4
Merge from widevine repo of http://go/wvgerrit/17463
This CL updates the unit tests to verify that
OEMCrypto_Generic_Encrypt and OEMCrypto_Generic_Decrypt can handle a
buffer size of at least 100k. It also adds code to the
oemcrypto_dynamic_adapter so that buffer sizes that are larger than
100k are broken into chunks of 100k.
All Nexus devices targeted for N pass these tests.
b/27040752
Change-Id: Iaf5c65d2f0b69e60f03cc99732d1ecab60658049
[ Merge of http://go/wvgerrit/17501 ]
Widevine request_license_tests were written with the expectation that
devices would by default be enabled for security level 1 and fallback
to level 3 if needed. Some devices such as seed are L3 only and results
in failures in the QueryStatusL3 test. This CL corrects the test's
expectation.
b/26902214
Change-Id: Ie84554337cd3716d120f67e592888af0cde719c7
[ merge of http://go/wvgerrit/17454 ]
When processing a license or renewal, calls to Set/UpdateLicense
update the policy information. A side effect was introduced whereby
updating the policy may cause (expiration, session key state)
notifications to be sent to the listener. Due to the ordering,
the notifications would be sent before the keys were loaded/refreshed,
which caused issues when the notifications were immediately acted upon.
This has now been corrected.
b/27842970
Change-Id: Id81a71ff48edfa9ca0baafc43267995d5a3e80a6
[ Merge from http://go/wvgerrit/17429 ]
This is to correct for when HDCP validation failure at the OEMCrypto level
ends up returning a CryptoException through MediaCrypto with error code
Unknown Error (-2998).
b/27849488
Change-Id: Ib3a9b1c3a17b9323f3d079a678cf88dedeec3b4b
(In addition to being a merge of http://go/wvgerrit/17394, this commit
updates tests/Android.mk to no longer try to build the private gMock.)
Previously, we maintained our own version of gMock (named libwvgmock
to avoid naming conflicts) and depended on it for our unit tests. Now
that Android has gMock in the externals/ directory and vaage@ has
eliminated the need for us to customize gMock's arity, we can stop
depending on or maintaining our own copy.
Bug: 26907374
Change-Id: Ia01d6c02e2f28a642480d7ef178b9bc3dde6d306
[ Merge of http://go/wvgerrit/17204 ]
Sleep was being employed, to introduce a delay so that one license expired
but the other was still active. The duration was long enough that
occasionally the second license would also expire, causing the test to fail.
Reduce the sleep duration to correct this behaviour.
b/27673513
Change-Id: Ieef9100c98783c16fc5ab8fe345fa1dd26604f18
Some decryption errors were being reported as
vendor-unique diagnostic codes that were not generally
actionable by an app. Recently a new
MediaCodec.CryptoException code was added so these types
of failures can be reported as ERROR_UNSUPPORTED_OPERATION,
in which case the app can use an alternate DRM
configuration in a way that does not require
vendor-specific handling. This change remaps this class
of decrypt errors to the new error code.
Merge of http://go/wvgerrit/17110
bug: 25929554
Change-Id: Iff44c2f04f9ee28d065fb17d59bca4032c5d55ca
