To ensure the ref impl of OEMCrypto_GetDeviceSignedCsrPayload() in OPK
and testbed returns the correct sample format.
Test: opk_ta_p40, run_fake_l1_tests
Bug: 300304834
Change-Id: I6d399774fbaac2e12096cf878d582cd3c1320318
Let the sample device info built by ref implementation include all
required fields to pass device info validation tests.
Test: opk_ta_p40, run_fake_l1_tests
Bug: 307968622
Change-Id: Ib6b7645a1d26347f6992dd3c3bc2f39d4a92b283
Some tests were not in a doxygen group, so they were not
showing up on the dev site.
Bug: 298719677
Change-Id: Ic86b7999ac7ab324eb40a30023b74897f87d97e5
The returned BCC from OEMCrypto_GetBootCertificateChain() can be
validated by unit tests with BccValidator.
Test: run_fake_l1_tests, opk_ta_p40
Bug: 300304834
Bug: 307968622
Change-Id: I6312cb45548f5d8a711c13ea0356d6ec8db51082
For DRM, but not for CAS, we allow the entitlement session
and the entitled session to be the same.
Bug: 301462149
Change-Id: Ib830484be8437b1c4ce34500ae912e6c119dcfc3
(cherry picked from commit c1ec1c248d3ca1d3bc414c71cc9222c77d56f043)
This updates the code and tests to allow for using license protocol 2.2
when using OEMCrypto v19.
Issue: 80428549
Issue: 121031064
Issue: 232464183
Change-Id: Ib6bb61f86dd310b566227462658530bca5940b88
Since we want to migrate to using GTEST_SKIP to skip unit tests instead
of GTEST_FILTER, we can remove the RestrictFilter() function which
filters the tests out using GTEST_FILTER. To do this, the RSAPerformance
test needs to be removed, which is acceptable since no one uses this
test anymore. However, b/299135804 is being used to track a new way to
either execute/track permance.
Bug: 251240681, 299135804
Change-Id: Ife59c468ee127f4c39d3be91707ca38a061b7895
Since KDF functions are only used right before specific functions, this
merges them to simplify internal state within OEMCrypto.
Fixes: 299527712
Change-Id: I426cfcdc102bd73cf65cd809b213da2474f44b34
The current implementation of OEMCrypto_SetDecryptHash gives developers
flexibility to use different types of hashes. However, all the
implementations we have seen thus far use crc32. Because of this, crc32
should be sufficient and we can refactor OEMCrypto_SetDecryptHash to
only use the crc32 hash.
Bug: 287706586
Change-Id: I4aaa253b2656dfd9c984f77dfb08fe160b23b47c
The extra call to OEMCrypto_GenerateNonce is not needed. And it would
also lead to failure when the fuzzers are linked with the OPK
serialization layer.
Bug: 324666282
Change-Id: I43941fd5ee1f15f7106e6f0be2b65dce206225cf
- Initialize allowed_schemes_ since it is used by CreateDefaultResponse.
- Issue was detected by Coverity.
Change-Id: I368c4773f6316b65196aaa39e23e70717299c570
OEMCrypto_ERROR_INVALID_RSA_KEY is deprecated in v17. But
v16 oemcrypto can still return it. Unit test should allow
this error for now.
Test: run_dynamic_oemcrypto_v16.4, run_dynamic_oemcrypto_v16.3
Bug: 307668988
Change-Id: I950b62c8b3e02ea09d4795839a3d69573ab718aa
This CL adds unit tests to verify that the following
forbidden uses of an RSA private key do not work:
- ForbidPrepAndSign -- A cast cert key cannot sign a license
request.
- ForbidUseAsDRMCert -- A cast cert cannot be used with the
DRM cert's padding scheme and it cannot be used to derive
keys from a session key.
- *ForbidRSASignatureForDRMKey* -- A DRM cert key cannot be
used with GenerateRSASignature.
- *OEMCertForbidGenerateRSASignature* -- An OEM cert key
cannot be used with GenerateRSASignature.
Bug: 251875110
Change-Id: Ic2b23e3fd279e878c190a8294078a8d092126a29
This tool will soon be used in LUCI tests. It seemed necessary to
clean it up to make the build cop's job easier if there is a problem.
The following was completed:
* Removed stub for install XML based keyboxes
* This is handled externally
* Improved error checking
* Replace C-style prints with C++ styled prints
* Keybox information is still printed to stdout
* Major erros are printed to stderr
* Updated to follow Google style guide
* Fixed header includes
* Removed unused headers
* Added headers that are used, but were included indirectly
* Ensures OEMCrypto_Terminate() is called
* Particularly if there is an error encountered.
Bug: 299108238
Test: Tested in later CL
Change-Id: Ie6dafc44d050d0c6ae288f88cd5d6f3737d4a88c
The unit test helper function LoadWithAllowedSchemes should
only be used to load a Cast Certificate. So it has been
renamed to make that clear.
The only unit test that used the old function with the
non-cast padding scheme has been removed. A replacement will
be added in the next CL of the chain.
Change-Id: Id4aa2f420435baff664324ee4b3dcb74ab9ffe8a
There was some confusion about which tests loaded a cert and
which ones just used a cert. This distinction is important
when testing devices with a baked-in-cert.
Merged from https://widevine-internal-review.googlesource.com/183333
Change-Id: I3c2b119c3355b3a9190799637ff0860b6153b35b
This adds an install keybox tool to the OEMCrypto unit test
directory. It is built when we build the OPK w/linux IPC.
This CL also adds some scripts to use this tool when running
the OPK Linux TA, and then runs the standard tests.
Bug: 295371549
Change-Id: I11e59faa3b24d906f573bcd3f4855e73a4aa5fdf
Adds a new `cas` directory to the ports/linux project. This contains
an end-to-end demo of OEMCrypto CAS functionality, using the Linux
tee_simulator as a base.
Test: from ports/linux/cas dir: `CDM_DIR=~/work/cdm-dupe ./scripts/build.sh && CDM_DIR=~/work/cdm-dupe ./scripts/run.sh`
Merged from https://widevine-internal-review.googlesource.com/178250
Change-Id: I781b403100ad2e069d99650d9ddae8e7acbc309a
We want to transition to using GTEST_SKIP to skip unit tests instead of
modifying the GTEST_FILTER variable. This does so for tests that require
RSA 3072 support.
Bug: 251240681
Change-Id: I048d31e25316d621771efb5d472f651bff40bf75
Changes the OPK session state machine to allow API_MOVEENTRY in
the same circumstances as API_CREATENEWUSAGEENTRY. Adds a test
to trigger the same situation as the linked bug.
The test cases in the bug fail because OEMCrypto_MoveEntry() is
called immediately after OEMCrypto_CreateNewUsageEntry(), but the
session state machine has different filters for the two calls.
Furthermore, OEMCrypto_CreateNewUsageEntry() doesn't change the
state machine, so we should align the two filters to allow
OEMCrypto_MoveEntry() to be called immediately after
OEMCrypto_CreateNewUsageEntry() in all situations where
OEMCrypto_CreateNewUsageEntry() is allowed.
The existing OEMCrypto defrag tests did not catch this edge case
because the test helper functions always do something to modify the
state machine after calling OEMCrypto_CreateNewUsageEntry().
Test: OEMCryptoUsageTableDefragTest.MakeAndMoveEntry
Bug: 286938572
Merged from https://widevine-internal-review.googlesource.com/178013
(cherry picked from commit a87d66ccb7b2fc5f549142e64a7e45531dd95db6)
Change-Id: I8a8465b2b7479effe4055a014bc94b166178a693
1) Move some provisioning unit tests into
oemcrypto_provisioning_test.cpp
2) Remove some test group comments
Bug: 253779846
Merged from https://widevine-internal-review.googlesource.com/176735
Change-Id: I3d02c23b63eb7949fbc6abf60a7dbe32086ef2c9
