Source release 15.2.0

oemcrypto/test/oec_device_features.cpp

@@ -7,8 +7,13 @@
 #include "oec_device_features.h"
 
 #include <stdio.h>
-#include <sys/types.h>
-#include <unistd.h>
+
+#ifdef _WIN32
+# include <windows.h>
+#else
+# include <sys/types.h>
+# include <unistd.h>
+#endif
 
 #include <cstring>
 
@@ -18,6 +23,43 @@ namespace wvoec {
 
 DeviceFeatures global_features;
 
+bool CanChangeTime() {
+#ifdef _WIN32
+  LUID desired_id;
+  if (!LookupPrivilegeValue(nullptr, SE_SYSTEMTIME_NAME, &desired_id))
+    return false;
+  HANDLE token;
+  if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &token))
+    return false;
+  std::unique_ptr<void, decltype(&CloseHandle)> safe_token(token, &CloseHandle);
+
+  // This queries all the permissions given to the token to determine if we can
+  // change the system time.  Note this is subtly different from PrivilegeCheck
+  // as that only checks "enabled" privileges; even with admin rights, the
+  // privilege is default disabled, even when granted.
+
+  DWORD size = 0;
+  // Determine how big we need to allocate first.
+  GetTokenInformation(token, TokenPrivileges, nullptr, 0, &size);
+  // Since TOKEN_PRIVILEGES uses a variable-length array, we need to use malloc
+  std::unique_ptr<TOKEN_PRIVILEGES, decltype(&free)> privileges(
+      (TOKEN_PRIVILEGES*)malloc(size), &free);
+  if (privileges && GetTokenInformation(token, TokenPrivileges,
+                                        privileges.get(), size, &size)) {
+    for (int i = 0; i < privileges->PrivilegeCount; i++) {
+      if (privileges->Privileges[i].Luid.HighPart == desired_id.HighPart &&
+          privileges->Privileges[i].Luid.LowPart == desired_id.LowPart) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+#else
+  return getuid() == 0;
+#endif
+}
+
 void DeviceFeatures::Initialize(bool is_cast_receiver,
                                 bool force_load_test_keybox) {
   cast_receiver = is_cast_receiver;
@@ -153,37 +195,16 @@ std::string DeviceFeatures::RestrictFilter(const std::string& initial_filter) {
   if (provisioning_method
       != OEMCrypto_OEMCertificate)    FilterOut(&filter, "*Prov30*");
   if (!supports_rsa_3072)             FilterOut(&filter, "*RSAKey3072*");
-  if (api_version < 14) {
-    // Because API 13 uses an old hard coded test keybox, none of these tests
-    // will pass.  Partners who wish to test with a v13 OEMCrypto should use
-    // code on an older v13 branch.
-    printf("These unit tests are designed for OEMCrypto API 15 and above.\n");
-    printf("This device has an OEMCrypto with API version %d.\n", api_version);
-    printf("To verify correctness, please build unit tests from a "
-         "compatible branch.\n");
-    FilterOut(&filter, "*API09*");
-    FilterOut(&filter, "*API10*");
-    FilterOut(&filter, "*API11*");
-    FilterOut(&filter, "*API12*");
-    FilterOut(&filter, "*API13*");
-    FilterOut(&filter, "*API14*");
-    FilterOut(&filter, "*TestKeyboxTest*");
-    FilterOut(&filter, "*SessionTest*");
-    FilterOut(&filter, "*UsageTable*");
-    FilterOut(&filter, "*GenericCrypto*");
-    FilterOut(&filter, "*LoadsCertificate*");
-    FilterOut(&filter, "*UsesCertificate*");
-    // We also expect some CDM tests to fail without a new test keybox:
-    FilterOut(&filter, "*WvCdmRequestLicenseTest*");
-    FilterOut(&filter, "*WvGenericOperations*");
-    FilterOut(&filter, "*WvCdmEngine*");
-    FilterOut(&filter, "*Cdm/WvCdm*");
-    FilterOut(&filter, "*Cdm/WvHls*");
-  }
+  if (api_version <  9)               FilterOut(&filter, "*API09*");
+  if (api_version < 10)               FilterOut(&filter, "*API10*");
+  if (api_version < 11)               FilterOut(&filter, "*API11*");
+  if (api_version < 12)               FilterOut(&filter, "*API12*");
+  if (api_version < 13)               FilterOut(&filter, "*API13*");
+  if (api_version < 14)               FilterOut(&filter, "*API14*");
   if (api_version < 15)               FilterOut(&filter, "*API15*");
   // Some tests may require root access. If user is not root, filter these tests
   // out.
-  if (getuid()) {
+  if (!CanChangeTime()) {
     FilterOut(&filter, "UsageTableTest.TimeRollbackPrevention");
   }
   // Performance tests take a long time.  Filter them out if they are not