387147dffe
These are a set of CLs merged from the wv cdm repo to the android repo. * Update service certificate. Author: Gene Morgan <gmorgan@google.com> [ Merge of http://go/wvgerrit/28065 ] The updated service certificate fixes a number of failing tests. There are still some that fail, apparently due to mismatches with key set IDs and usage tables. Also updated QA server URL to point to QA proxy (although neither can be used by this client). Also fixed segfault in CdmTest.ListUsageRecords. * Add CDM APIs for Handling Service Certificates. Author: Gene Morgan <gmorgan@google.com> [ Merge of http://go/wvgerrit/28064 ] The responsibility for managing Service Certificates has been moved out of the CDM. Instead, provide CDM and CdmEngine methods to generate a service certificate request message, and handle a service certificate response. The API client can use these calls if it needs to get the service certificate from the License Server. These functions assume the request and response are base64 (web-safe) encoded (see b/37481392). Not all servers are operating this way yet. Any adaptations for non-compliant servers is handled outside the CDM. See test WvCdmEnginePreProvTest::ServiceCertificateRequestResponse in cdm_engine_test.cpp for an example of this. These changes also eliminate the stored init_data and deferred license type which were used to perform a service certificate request during a license request. * Fix and rename ClosesSessionWithoutReturningError test. Author: Edwin Wong <edwinwong@google.com> [ Merge of http://go/wvgerrit/27880 ] ClosesSessionWithoutReturningError should not check for Status::OK since it is expecting an error code back. The test is renamed to ClosesSessionWithError. Test: libwvdrmdrmplugin_hidl_test BUG: 62205215 * Get rid of default service certificate. Author: Gene Morgan <gmorgan@google.com> [ Merge of http://go/wvgerrit/27981 ] Instead, we need at least two service certs - one for the QA/Test servers, and one for UAT (and prod?) There are still some issues around the signature verififcation of the service cert, and in license_unittest.cpp, the use of the default service cert has been commented out. I don't know why this test needs a service cert. If it really does, then the same mechanism that is used elsewhere for selecting a specific server type will be needed here. BUG: 71650075 Test: Not currently passing. Will be addressed in a subsequent commit in the chain. Change-Id: Ieab815fb202c809ad5714cd0364c4bdfa068f77d
75 lines
2.5 KiB
C++
75 lines
2.5 KiB
C++
// Copyright 2017 Google Inc. All Rights Reserved.
|
|
//
|
|
#ifndef WVCDM_CORE_SERVICE_CERTIFICATE_H_
|
|
#define WVCDM_CORE_SERVICE_CERTIFICATE_H_
|
|
|
|
// Service Certificates are used to encrypt the ClientIdentification message
|
|
// that is part of Device Provisioning, License, Renewal, and Release requests.
|
|
// It also supplies a provider_id setting used in device provisioning.
|
|
// Service Certificates are typically supplied by the application. If one
|
|
// is not supplied and privacy mode is enabled, the CDM will send a Service
|
|
// Certificate Request to the target server to get one. Once the Service
|
|
// Certificate is established for the session, it should not change.
|
|
|
|
#include <memory>
|
|
|
|
#include "license_protocol.pb.h"
|
|
#include "privacy_crypto.h"
|
|
#include "wv_cdm_types.h"
|
|
|
|
namespace wvcdm {
|
|
|
|
class CryptoSession;
|
|
|
|
class ServiceCertificate {
|
|
public:
|
|
ServiceCertificate() : has_certificate_(false) {}
|
|
virtual ~ServiceCertificate() {}
|
|
|
|
// Set up a new service certificate.
|
|
// Accept a serialized video_widevine::SignedDrmDeviceCertificate message.
|
|
virtual CdmResponseType Init(const std::string& signed_certificate);
|
|
|
|
bool has_certificate() const { return has_certificate_; }
|
|
const std::string certificate() const { return certificate_; }
|
|
const std::string& provider_id() const { return provider_id_; }
|
|
|
|
// Verify the signature for a message.
|
|
virtual CdmResponseType VerifySignedMessage(const std::string& message,
|
|
const std::string& signature);
|
|
|
|
// Encrypt the ClientIdentification message for a provisioning or
|
|
// licensing request. Encryption is performed using the current
|
|
// service certificate. Return a failure if the service certificate is
|
|
// not present, not valid, or if some other error occurs.
|
|
// The routine should not be called if privacy mode is off or if the
|
|
// certificate is empty.
|
|
virtual CdmResponseType EncryptClientId(
|
|
CryptoSession* crypto_session,
|
|
const video_widevine::ClientIdentification* clear_client_id,
|
|
video_widevine::EncryptedClientIdentification* encrypted_client_id);
|
|
|
|
private:
|
|
|
|
// Track whether object holds valid certificate
|
|
bool has_certificate_;
|
|
|
|
// Certificate, verified and extracted from signed message.
|
|
std::string certificate_;
|
|
|
|
// Certificate serial number.
|
|
std::string serial_number_;
|
|
|
|
// Provider ID, extracted from certificate message.
|
|
std::string provider_id_;
|
|
|
|
// Public key.
|
|
std::unique_ptr<RsaPublicKey> public_key_;
|
|
|
|
CORE_DISALLOW_COPY_AND_ASSIGN(ServiceCertificate);
|
|
};
|
|
|
|
} // namespace wvcdm
|
|
|
|
#endif // WVCDM_CORE_SERVICE_CERTIFICATE_H_
|