widevine-partner/ce_cdm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Source release 15.1.0

Browse Source
This commit is contained in:
John W. Bruce
2019-03-29 18:16:05 -07:00
parent 66628486b5
commit 2b26dee09c
44 changed files with 1371 additions and 356 deletions
Download Patch File Download Diff File Expand all files Collapse all files

340
cdm/src/cdm.cpp
View File

@@ -26,6 +26,7 @@
#include "string_conversions.h"
#include "wv_cdm_constants.h"
#include "wv_cdm_event_listener.h"
#include "wv_cdm_types.h"
// CE:
#include "cdm_version.h"
@@ -123,6 +124,12 @@ class CdmImpl : public Cdm, public WvCdmEventListener {
ServiceRole role, const std::string& response,
std::string* certificate) override;
Status getRobustnessLevel(RobustnessLevel* level) override;
Status getResourceRatingTier(uint32_t* tier) override;
Status getOemCryptoBuildInfo(std::string* build_info) override;
bool isProvisioned() override;
Status getProvisioningRequest(std::string* request) override;
@@ -316,11 +323,87 @@ Cdm::Status CdmImpl::parseAndLoadServiceCertificateResponse(
LOGE("Failure parsing service certificate response!");
return kTypeError;
}
if (certificate)
*certificate = parsed_cert;
if (certificate) *certificate = parsed_cert;
return setServiceCertificate(role, parsed_cert);
}
Cdm::Status CdmImpl::getRobustnessLevel(RobustnessLevel* level) {
if (level == nullptr) {
LOGE("Missing level parameter to receive robustness level.");
return kTypeError;
}
std::string level_string;
CdmResponseType result = cdm_engine_->QueryStatus(
kLevelDefault, QUERY_KEY_SECURITY_LEVEL, &level_string);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
if (level_string == QUERY_VALUE_SECURITY_LEVEL_L1) {
*level = kL1;
} else if (level_string == QUERY_VALUE_SECURITY_LEVEL_L2) {
*level = kL2;
} else if (level_string == QUERY_VALUE_SECURITY_LEVEL_L3) {
*level = kL3;
} else {
LOGE("Unknown robustness level: %s", level_string.c_str());
return kUnexpectedError;
}
return kSuccess;
}
Cdm::Status CdmImpl::getResourceRatingTier(uint32_t* tier) {
if (tier == nullptr) {
LOGE("Missing tier parameter to receive resource rating tier.");
return kTypeError;
}
std::string tier_string;
CdmResponseType result = cdm_engine_->QueryStatus(
kLevelDefault, QUERY_KEY_RESOURCE_RATING_TIER, &tier_string);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
uint32_t parsed_tier = static_cast<uint32_t>(std::stoul(tier_string));
if (parsed_tier <= 0) {
LOGE("Invalid resource rating tier %lu", parsed_tier);
return kUnexpectedError;
}
*tier = parsed_tier;
return kSuccess;
}
Cdm::Status CdmImpl::getOemCryptoBuildInfo(std::string* build_info) {
if (build_info == nullptr) {
LOGE("Missing build_info parameter to receive build info.");
return kTypeError;
}
CdmResponseType result = cdm_engine_->QueryStatus(
kLevelDefault, QUERY_KEY_OEMCRYPTO_BUILD_INFORMATION, build_info);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
return kSuccess;
}
bool CdmImpl::isProvisioned() {
return cdm_engine_->IsProvisioned(kSecurityLevelL1);
}
@@ -333,9 +416,11 @@ Cdm::Status CdmImpl::getProvisioningRequest(std::string* request) {
request, &ignored_base_url);
if (result == CERT_PROVISIONING_NONCE_GENERATION_ERROR) {
LOGE("Nonce quota exceeded");
return kQuotaExceeded;
}
if (result != NO_ERROR) {
return kResourceContention;
} else if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
@@ -348,7 +433,10 @@ Cdm::Status CdmImpl::handleProvisioningResponse(const std::string& response) {
CdmResponseType result = cdm_engine_->HandleProvisioningResponse(
response, &ignored_cert, &ignored_wrapped_key);
if (result != NO_ERROR) {
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
@@ -357,14 +445,24 @@ Cdm::Status CdmImpl::handleProvisioningResponse(const std::string& response) {
}
Cdm::Status CdmImpl::removeProvisioning() {
if (cdm_engine_->Unprovision(kSecurityLevelL1) != NO_ERROR) {
CdmResponseType result = cdm_engine_->Unprovision(kSecurityLevelL1);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
return kSuccess;
}
Cdm::Status CdmImpl::removeUsageTable() {
if (cdm_engine_->DeleteUsageTable(kSecurityLevelL1) != NO_ERROR) {
CdmResponseType result = cdm_engine_->DeleteUsageTable(kSecurityLevelL1);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
return kSuccess;
@@ -375,8 +473,13 @@ Cdm::Status CdmImpl::listStoredLicenses(std::vector<std::string>* key_set_ids) {
LOGE("Missing vector parameter to receive key_set_ids.");
return kTypeError;
}
if (cdm_engine_->ListStoredLicenses(kSecurityLevelL1, key_set_ids) !=
NO_ERROR) {
CdmResponseType result =
cdm_engine_->ListStoredLicenses(kSecurityLevelL1, key_set_ids);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
return kSuccess;
@@ -387,24 +490,39 @@ Cdm::Status CdmImpl::listUsageRecords(std::vector<std::string>* ksids) {
LOGE("Missing vector parameter to receive KSIDs.");
return kTypeError;
}
if (cdm_engine_->ListUsageIds(property_set_.app_id(), kSecurityLevelL1, ksids,
nullptr) != NO_ERROR) {
CdmResponseType result = cdm_engine_->ListUsageIds(
property_set_.app_id(), kSecurityLevelL1, ksids, nullptr);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
return kSuccess;
}
Cdm::Status CdmImpl::deleteUsageRecord(const std::string& key_set_id) {
if (cdm_engine_->DeleteUsageRecord(property_set_.app_id(), kSecurityLevelL1,
key_set_id) != NO_ERROR) {
CdmResponseType result = cdm_engine_->DeleteUsageRecord(
property_set_.app_id(), kSecurityLevelL1, key_set_id);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
return kSuccess;
}
Cdm::Status CdmImpl::deleteAllUsageRecords() {
if (cdm_engine_->RemoveAllUsageInfo(property_set_.app_id(),
kSecurityLevelL1) != NO_ERROR) {
CdmResponseType result =
cdm_engine_->RemoveAllUsageInfo(property_set_.app_id(), kSecurityLevelL1);
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
return kSuccess;
@@ -466,6 +584,9 @@ Cdm::Status CdmImpl::createSession(SessionType session_type,
// misleading ID to the application.
session_id->clear();
return kNeedsDeviceCertificate;
case SYSTEM_INVALIDATED_ERROR:
LOGE("System invalidated");
return kSystemStateLost;
default:
LOGE("Unexpected error %d", result);
return kUnexpectedError;
@@ -547,17 +668,19 @@ Cdm::Status CdmImpl::generateRequest(const std::string& session_id,
session_id, session_id, init_data_obj, license_type, app_parameters_,
&key_request);
if (result == LICENSE_REQUEST_NONCE_GENERATION_ERROR) {
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
} else if (result == LICENSE_REQUEST_NONCE_GENERATION_ERROR) {
LOGE("Nonce quota exceeded");
return kQuotaExceeded;
}
if (result == NEED_PROVISIONING) {
return kResourceContention;
} else if (result == NEED_PROVISIONING) {
LOGE("Device not provisioned");
return kNeedsDeviceCertificate;
}
if (result != KEY_MESSAGE) {
} else if (result != KEY_MESSAGE) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
@@ -586,6 +709,9 @@ Cdm::Status CdmImpl::load(const std::string& session_id) {
switch (result) {
case NO_ERROR:
break;
case SYSTEM_INVALIDATED_ERROR:
LOGE("System invalidated");
return kSystemStateLost;
case NEED_PROVISIONING:
return kNeedsDeviceCertificate;
default:
@@ -602,15 +728,20 @@ Cdm::Status CdmImpl::load(const std::string& session_id) {
if (!f.LicenseExists(session_id)) {
// This might be a usage record session which needs to be loaded.
CdmKeyMessage ignored_release_message;
result = cdm_engine_->LoadUsageSession(session_id, &ignored_release_message);
if (result == LOAD_USAGE_INFO_MISSING) {
LOGE("Unable to load license: %s", session_id.c_str());
result =
cdm_engine_->LoadUsageSession(session_id, &ignored_release_message);
if (result != KEY_MESSAGE) {
cdm_engine_->CloseSession(session_id);
return kSessionNotFound;
} else if (result != KEY_MESSAGE) {
LOGE("Unexpected error %d", result);
cdm_engine_->CloseSession(session_id);
return kUnexpectedError;
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == LOAD_USAGE_INFO_MISSING) {
LOGE("Unable to load license: %s", session_id.c_str());
return kSessionNotFound;
} else {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
}
sessions_[session_id].type = kPersistentUsageRecord;
@@ -622,6 +753,9 @@ Cdm::Status CdmImpl::load(const std::string& session_id) {
if (result == GET_RELEASED_LICENSE_ERROR) {
// This was partially removed already.
// The EME spec states that we should be able to load it, but not use it.
} else if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != KEY_ADDED) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
@@ -665,7 +799,13 @@ Cdm::Status CdmImpl::update(const std::string& session_id,
// result should only be NEED_KEY after server certificate provisioning, which
// should no longer happen in this version of the CDM.
assert(result != NEED_KEY);
if (result == OFFLINE_LICENSE_PROHIBITED) {
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
} else if (result == OFFLINE_LICENSE_PROHIBITED) {
LOGE("A temporary session cannot be used for a persistent license.");
return kRangeError;
} else if (result == STORAGE_PROHIBITED) {
@@ -724,11 +864,16 @@ Cdm::Status CdmImpl::loadEmbeddedKeys(const std::string& session_id,
session_id, session_id, init_data_obj, kLicenseTypeEmbeddedKeyData,
app_parameters_, &key_request);
if (result == LICENSE_REQUEST_NONCE_GENERATION_ERROR) {
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
} else if (result == LICENSE_REQUEST_NONCE_GENERATION_ERROR) {
LOGE("Nonce quota exceeded");
return kQuotaExceeded;
}
if (result != KEY_ADDED) {
return kResourceContention;
} else if (result != KEY_ADDED) {
LOGE("Unexpected Failure: GenerateKeyRequest() returned %lu", result);
return kUnexpectedError;
}
@@ -781,11 +926,16 @@ Cdm::Status CdmImpl::getKeyAllowedUsages(const std::string& session_id,
CdmResponseType result =
cdm_engine_->QueryKeyAllowedUsage(session_id, key_id, &usage_for_key);
if (result != NO_ERROR) {
// TODO(http://b/114435278): there are a million KEY_NOT_FOUND_* errors.
// that should probably all turn into kNoKey. Here, and below, and
// everywhere.
// TODO(b/114435278): There are multiple KEY_NOT_FOUND_* errors that should
// probably all turn into kNoKey. Here, and below, and everywhere.
if (result == KEY_NOT_FOUND_1) {
return kNoKey;
} else if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
} else {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
@@ -809,6 +959,12 @@ Cdm::Status CdmImpl::getKeyAllowedUsages(const std::string& key_id,
if (result != NO_ERROR) {
if (result == KEY_NOT_FOUND_1 || result == KEY_NOT_FOUND_2) {
return kNoKey;
} else if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
} else if (result == KEY_CONFLICT_1) {
return kTypeError;
} else {
@@ -864,7 +1020,10 @@ Cdm::Status CdmImpl::close(const std::string& session_id) {
}
CdmResponseType result = cdm_engine_->CloseSession(session_id);
if (result != NO_ERROR) {
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
@@ -903,11 +1062,16 @@ Cdm::Status CdmImpl::remove(const std::string& session_id) {
session_id, session_id, empty_initialization_data, kLicenseTypeRelease,
app_parameters_, &key_request);
if (result == LICENSE_REQUEST_NONCE_GENERATION_ERROR) {
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
} else if (result == LICENSE_REQUEST_NONCE_GENERATION_ERROR) {
LOGE("Nonce quota exceeded");
return kQuotaExceeded;
}
if (result != KEY_MESSAGE) {
return kResourceContention;
} else if (result != KEY_MESSAGE) {
LOGE("Unexpected error %d", result);
cdm_engine_->CloseSession(session_id);
return kUnexpectedError;
@@ -937,7 +1101,13 @@ Cdm::Status CdmImpl::forceRemove(const std::string& session_id) {
CdmResponseType result = cdm_engine_->RemoveLicense(session_id);
if (result != NO_ERROR) {
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
} else if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
} else if (result != NO_ERROR) {
LOGE("Unexpected error %d", result);
return kUnexpectedError;
}
@@ -1003,6 +1173,21 @@ Cdm::Status CdmImpl::decrypt(const std::string& session_id,
return kSuccess;
}
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
}
if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
}
if (result == OUTPUT_TOO_LARGE_ERROR) {
LOGE("Output too large");
return kOutputTooLarge;
}
if (result == NEED_KEY || result == KEY_NOT_FOUND_3 ||
result == SESSION_NOT_FOUND_FOR_DECRYPT) {
LOGE("Key not available.");
@@ -1035,6 +1220,18 @@ Cdm::Status CdmImpl::genericEncrypt(const std::string& session_id,
if (result == NO_ERROR) {
return kSuccess;
}
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
}
if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
}
if (result == OUTPUT_TOO_LARGE_ERROR) {
LOGE("Output too large");
return kOutputTooLarge;
}
if (result == SESSION_NOT_FOUND_13) {
LOGE("No such session: %s", session_id.c_str());
return kSessionNotFound;
@@ -1064,6 +1261,18 @@ Cdm::Status CdmImpl::genericDecrypt(const std::string& session_id,
if (result == NO_ERROR) {
return kSuccess;
}
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
}
if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
}
if (result == OUTPUT_TOO_LARGE_ERROR) {
LOGE("Output too large");
return kOutputTooLarge;
}
if (result == SESSION_NOT_FOUND_14) {
LOGE("No such session: %s", session_id.c_str());
return kSessionNotFound;
@@ -1092,6 +1301,14 @@ Cdm::Status CdmImpl::genericSign(const std::string& session_id,
if (result == NO_ERROR) {
return kSuccess;
}
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
}
if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
}
if (result == SESSION_NOT_FOUND_15) {
LOGE("No such session: %s", session_id.c_str());
return kSessionNotFound;
@@ -1120,6 +1337,14 @@ Cdm::Status CdmImpl::genericVerify(const std::string& session_id,
if (result == NO_ERROR) {
return kSuccess;
}
if (result == SYSTEM_INVALIDATED_ERROR) {
LOGE("System invalidated");
return kSystemStateLost;
}
if (result == SESSION_LOST_STATE_ERROR) {
LOGE("Session invalidated");
return kSessionStateLost;
}
if (result == SESSION_NOT_FOUND_16) {
LOGE("No such session: %s", session_id.c_str());
return kSessionNotFound;
@@ -1276,13 +1501,6 @@ Cdm::Status CdmImpl::ConvertHdcpLevel(const std::string& query_value,
return kSuccess;
}
bool VerifyL1() {
metrics::CryptoMetrics throwaway_metrics;
std::unique_ptr<CryptoSession> cs(
CryptoSession::MakeCryptoSession(&throwaway_metrics));
return cs->GetSecurityLevel() == kSecurityLevelL1;
}
} // namespace
// static
@@ -1293,24 +1511,8 @@ Cdm::Status Cdm::initialize(SecureOutputType secure_output_type,
// the console. See core/include/log.h for the valid priority values.
g_cutoff = static_cast<LogPriority>(verbosity);
// If you want to direct-render on L3, CryptoSession will pass that
// request along to OEMCrypto. But if you want to use an opaque
// handle on L3, CryptoSession will silently ignore you and tell
// OEMCrypto to treat the address as a clear buffer.
//
// So this logic mirrors that in CryptoSession. Effectively, we
// are detecting at init time the conditions that would prevent
// CryptoSession (in its current form) from passing the desired
// buffer type constant to OEMCrypto.
switch (secure_output_type) {
case kOpaqueHandle:
// This output type requires an OEMCrypto that reports L1.
// This requirement comes from CryptoSession::SetDestinationBufferType().
if (!VerifyL1()) {
LOGE("Not an L1 implementation, kOpaqueHandle cannot be used!");
return kNotSupported;
}
break;
case kDirectRender:
case kNoSecureOutput:
break;