widevine-partner/provisioning_sdk_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update to support OEMCrypto v16 with ODK

Browse Source
This commit is contained in:
KongQun Yang
2020-09-21 15:54:04 -07:00
parent 93265ab9d1
commit 69d813f0f1
203 changed files with 16337 additions and 2290 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
provisioning_sdk/internal/BUILD
View File

@@ -15,6 +15,7 @@ package_group(
"//arcpp_provisioning/...",
"//provisioning_sdk/...",
"//sigma101_provisioning/...",
"//sigma210_provisioning/...",
],
)
@@ -29,21 +30,23 @@ cc_library(
deps = [
":oem_device_cert",
"//base",
"@abseil_repo//absl/base:core_headers",
"@abseil_repo//absl/synchronization",
"//common:aes_cbc_util",
"//common:certificate_type",
"//common:crypto_util",
"//common:drm_root_certificate",
"//common:drm_service_certificate",
"//common:hash_algorithm_util",
"//common:random_util",
"//common:rsa_key",
"//provisioning_sdk/internal/certificates:root_oem_certificates",
"//provisioning_sdk/public:provisioning_status",
"//protos/public:certificate_provisioning_proto",
"//protos/public:device_certificate_status_proto",
"//protos/public:drm_certificate_proto",
"//protos/public:provisioned_device_info_proto",
"//protos/public:signed_drm_certificate_proto",
"//protos/public:certificate_provisioning_cc_proto",
"//protos/public:device_certificate_status_cc_proto",
"//protos/public:drm_certificate_cc_proto",
"//protos/public:provisioned_device_info_cc_proto",
"//protos/public:signed_drm_certificate_cc_proto",
],
)
@@ -62,7 +65,7 @@ cc_test(
"//common:rsa_util",
"//common:status",
"//common:test_drm_certificates",
"//protos/public:certificate_provisioning_proto",
"//protos/public:certificate_provisioning_cc_proto",
],
)
@@ -99,15 +102,18 @@ cc_library(
":provisioning_session_impl",
"//base",
"//common:aes_cbc_util",
"//common:core_message_util",
"//common:drm_service_certificate",
"//common:hash_algorithm",
"//common:hash_algorithm_util",
"//common:random_util",
"//common:rsa_key",
"//common:sha_util",
"//provisioning_sdk/public:provisioning_status",
"//protos/public:certificate_provisioning_proto",
"//protos/public:client_identification_proto",
"//protos/public:drm_certificate_proto",
"//protos/public:provisioned_device_info_proto",
"//protos/public:certificate_provisioning_cc_proto",
"//protos/public:client_identification_cc_proto",
"//protos/public:drm_certificate_cc_proto",
"//protos/public:provisioned_device_info_cc_proto",
],
)
@@ -121,9 +127,13 @@ cc_test(
":provisioning_engine_impl",
":provisioning_session_impl",
"//testing:gunit_main",
"@abseil_repo//absl/strings",
"//common:aes_cbc_util",
"//common:hash_algorithm",
"//common:hash_algorithm_util",
"//common:mock_rsa_key",
"//common:sha_util",
"//protos/public:hash_algorithm_cc_proto",
],
)

41
provisioning_sdk/internal/provisioning30_session_impl.cc
View File

@@ -12,6 +12,9 @@
#include "glog/logging.h"
#include "common/aes_cbc_util.h"
#include "common/core_message_util.h"
#include "common/hash_algorithm.h"
#include "common/hash_algorithm_util.h"
#include "common/random_util.h"
#include "common/rsa_key.h"
#include "common/sha_util.h"
@@ -21,7 +24,8 @@
#define LOG_EVERY_N_WITH_PROTO(message, proto) \
LOG_EVERY_N(WARNING, FLAGS_prov_sdk_log_every_n) \
<< (message) << " [proto: " << (proto).ShortDebugString() << "]"
// TODO(user): Use instantiate_test_suite_p to reorg the test case to cover
// with or withoutcore_message.
namespace widevine {
Provisioning30SessionImpl::Provisioning30SessionImpl(
@@ -66,12 +70,14 @@ ProvisioningStatus Provisioning30SessionImpl::ProcessMessage(
LOG_EVERY_N_WITH_PROTO("Invalid token", client_id);
return INVALID_REQUEST_MESSAGE;
}
if (!cert_public_key->VerifySignature(signed_request.message(),
signed_request.signature())) {
const HashAlgorithm hash_algorithm =
HashAlgorithmProtoToEnum(signed_request.hash_algorithm());
if (!cert_public_key->VerifySignature(
signed_request.oemcrypto_core_message() + signed_request.message(),
hash_algorithm, signed_request.signature())) {
LOG_EVERY_N_WITH_PROTO("Signature verification failed", client_id);
return INVALID_REQUEST_MESSAGE;
}
// Save device_info for query later.
device_info_ = engine_.GetDeviceInfo(system_id);
@@ -81,8 +87,8 @@ ProvisioningStatus Provisioning30SessionImpl::ProcessMessage(
} else {
// Generate stable serial number.
const std::string stable_data(client_id.token() + request.stable_id() +
request.provider_id() +
engine_.secret_spoid_sauce());
request.provider_id() +
engine_.secret_spoid_sauce());
const std::string hash = Sha256_Hash(stable_data);
const size_t RootCertificateSerialNumberSize = 16;
certificate_serial_number = hash.substr(0, RootCertificateSerialNumberSize);
@@ -102,8 +108,25 @@ ProvisioningStatus Provisioning30SessionImpl::ProcessMessage(
LOG(WARNING) << "Error serializing ProvisioningResponse.";
return INTERNAL_ERROR;
}
if (signed_request.has_oemcrypto_core_message() &&
!signed_request.oemcrypto_core_message().empty()) {
if (!core_message_util::GetCoreProvisioningResponse(
signed_message.message(), signed_request.oemcrypto_core_message(),
signed_message.mutable_oemcrypto_core_message())) {
LOG(WARNING) << "Failed to get signed core message, response: "
<< signed_message.ShortDebugString();
return INTERNAL_ERROR;
}
if (signed_message.oemcrypto_core_message().empty()) {
LOG(WARNING) << "Failed to get signed core message, response: "
<< signed_message.ShortDebugString();
return INTERNAL_ERROR;
}
}
signed_message.set_hash_algorithm(HashAlgorithmEnumToProto(hash_algorithm));
if (!service_private_key_.GenerateSignature(
signed_message.message(), signed_message.mutable_signature())) {
signed_message.oemcrypto_core_message() + signed_message.message(),
hash_algorithm, signed_message.mutable_signature())) {
LOG(WARNING) << "Failed to sign ProvisioningResponse.";
return INTERNAL_ERROR;
}
@@ -111,7 +134,6 @@ ProvisioningStatus Provisioning30SessionImpl::ProcessMessage(
LOG(WARNING) << "Error serializing SignedProvisioningMessage.";
return INTERNAL_ERROR;
}
*done = true;
return OK;
}
@@ -197,7 +219,8 @@ bool Provisioning30SessionImpl::DecryptClientIdentification(
ProvisioningStatus Provisioning30SessionImpl::GenerateProvisioningResponse(
uint32_t system_id, const std::string& oem_ca_serial_number,
const std::string& provider_id, const std::string& certificate_serial_number,
const std::string& provider_id,
const std::string& certificate_serial_number,
const RsaPublicKey& cert_public_key, ProvisioningResponse* response) {
ProvisioningStatus status = engine_.GenerateProviderDeviceDrmCertificate(
system_id, oem_ca_serial_number, provider_id, device_drm_public_key_,

6
provisioning_sdk/internal/provisioning30_session_impl.h
View File

@@ -43,8 +43,7 @@ class Provisioning30SessionImpl : public ProvisioningSessionImpl {
// exchange is complete.
// Returns OK if successful, or an appropriate error status code otherwise.
ProvisioningStatus ProcessMessage(const std::string& message,
std::string* response,
bool* done) override;
std::string* response, bool* done) override;
// * Returns a ProvisioneddeviceInfo message containing information about the
// type of device being provisioned. May return nullptr.
@@ -65,7 +64,8 @@ class Provisioning30SessionImpl : public ProvisioningSessionImpl {
ClientIdentification* client_id);
ProvisioningStatus GenerateProvisioningResponse(
uint32_t system_id, const std::string& oem_ca_serial_number,
const std::string& provider_id, const std::string& certificate_serial_number,
const std::string& provider_id,
const std::string& certificate_serial_number,
const RsaPublicKey& cert_public_key, ProvisioningResponse* response);
const OemDeviceCert& oem_device_cert_;

209
provisioning_sdk/internal/provisioning30_session_impl_test.cc
View File

@@ -8,13 +8,20 @@
#include "provisioning_sdk/internal/provisioning30_session_impl.h"
#include <cstddef>
#include "testing/gmock.h"
#include "testing/gunit.h"
#include "absl/strings/escaping.h"
#include "absl/strings/str_cat.h"
#include "common/aes_cbc_util.h"
#include "common/hash_algorithm.h"
#include "common/hash_algorithm_util.h"
#include "common/mock_rsa_key.h"
#include "common/sha_util.h"
#include "provisioning_sdk/internal/oem_device_cert.h"
#include "provisioning_sdk/internal/provisioning_engine_impl.h"
#include "protos/public/hash_algorithm.pb.h"
using ::testing::_;
using ::testing::ByMove;
@@ -23,8 +30,16 @@ using ::testing::IsEmpty;
using ::testing::Return;
using ::testing::SaveArg;
using ::testing::SetArgPointee;
// TODO(user): use a real test key instead of mock_key to testcore message
// code change.
namespace {
const char kCoreMessage[] =
"00000005000000580000001000000010000000000000004000000000000000000000000000"
"00000000000000000000000000000000000000000000000000000000000000000000000000"
"0000000000000000000000000000";
const char kInvalidCoreMessage[] =
"0000000500000058000000100000001000000000000000400000000000000000000000000";
const char kEmptyCoreMessage[] = "";
const char kEncryptedClientIdIv[] = "sixteen_bytes_iv";
const char kPrivacyKey[] = "privacy_key_16B_";
const char kProviderId[] = "testing_provider";
@@ -38,8 +53,9 @@ const char kNonce[] = "testing_nonce";
const char kSignature[] = "generated_signature";
// Derives Stable Per-Origin IDentifiers.
std::string DeriveSpoid(const std::string& client_token, const std::string& provider_id,
const std::string& secret_sauce) {
std::string DeriveSpoid(const std::string& client_token,
const std::string& provider_id,
const std::string& secret_sauce) {
return widevine::Sha256_Hash(client_token + provider_id + secret_sauce)
.substr(0, 16);
}
@@ -50,27 +66,27 @@ namespace widevine {
class MockProvisioningEngineImpl : public ProvisioningEngineImpl {
public:
MOCK_CONST_METHOD6(GenerateProviderDeviceDrmCertificate,
ProvisioningStatus(uint32_t system_id,
const std::string& oem_ca_serial_number,
const std::string& provider_id,
const std::string& public_key,
const std::string& certificate_serial_number,
std::string* certificate));
MOCK_METHOD(ProvisioningStatus, GenerateProviderDeviceDrmCertificate,
(uint32_t system_id, const std::string& oem_ca_serial_number,
const std::string& provider_id, const std::string& public_key,
const std::string& certificate_serial_number,
std::string* certificate),
(const, override));
};
class MockOemDeviceCert : public OemDeviceCert {
public:
// gmock does not support SetArgPointee on std::unique_ptr, so we have to
// workaround it with a trick.
MOCK_CONST_METHOD4(DoVerifyCertificateChain,
bool(const std::string& certificate_chain,
RsaPublicKey** leaf_public_key, uint32_t* system_id,
std::string* oem_ca_serial_number));
bool VerifyCertificateChain(const std::string& certificate_chain,
std::unique_ptr<RsaPublicKey>* leaf_public_key,
uint32_t* system_id,
std::string* oem_ca_serial_number) const override {
MOCK_METHOD(bool, DoVerifyCertificateChain,
(const std::string& certificate_chain,
RsaPublicKey** leaf_public_key, uint32_t* system_id,
std::string* oem_ca_serial_number),
(const));
bool VerifyCertificateChain(
const std::string& certificate_chain,
std::unique_ptr<RsaPublicKey>* leaf_public_key, uint32_t* system_id,
std::string* oem_ca_serial_number) const override {
RsaPublicKey* raw_leaf_public_key = nullptr;
if (!DoVerifyCertificateChain(certificate_chain, &raw_leaf_public_key,
system_id, oem_ca_serial_number)) {
@@ -133,9 +149,61 @@ class Provisioning30SessionImplProcessTest
signed_prov_message_.set_signature("testing_signature");
}
void ProcessMessage(std::string core_message) {
signed_prov_message_.set_oemcrypto_core_message(
absl::HexStringToBytes(core_message));
const uint32_t kSystemId = 1234;
EXPECT_CALL(mock_service_private_key_, Decrypt(kEncryptedPrivacyKey, _))
.WillOnce(DoAll(SetArgPointee<1>(kPrivacyKey), Return(true)));
MockRsaPublicKey* mock_cert_public_key = new MockRsaPublicKey;
EXPECT_CALL(mock_oem_device_cert_,
DoVerifyCertificateChain(kClientToken, _, _, _))
.WillOnce(DoAll(SetArgPointee<1>(mock_cert_public_key),
SetArgPointee<2>(kSystemId), Return(true)));
const HashAlgorithm hash_algorithm =
HashAlgorithmProtoToEnum(signed_prov_message_.hash_algorithm());
EXPECT_CALL(
*mock_cert_public_key,
VerifySignature(signed_prov_message_.oemcrypto_core_message() +
signed_prov_message_.message(),
hash_algorithm, signed_prov_message_.signature()))
.WillOnce(Return(true));
EXPECT_CALL(mock_engine_impl_, GenerateProviderDeviceDrmCertificate(
kSystemId, _, _, kDevicePublicKey, _, _))
.WillOnce(DoAll(SetArgPointee<5>(kDeviceCertificate), Return(OK)));
EXPECT_CALL(*mock_cert_public_key, Encrypt(_, _))
.WillOnce(DoAll(SaveArg<0>(&message_key_),
SetArgPointee<1>(kWrappingKey), Return(true)));
}
void ValidateMessage(std::string core_message) {
ProvisioningResponse prov_response;
// Verify the response.
ASSERT_TRUE(signed_prov_message_.ParseFromString(response_));
EXPECT_EQ(kSignature, signed_prov_message_.signature());
ASSERT_TRUE(prov_response.ParseFromString(signed_prov_message_.message()));
if (!core_message.empty()) {
EXPECT_TRUE(signed_prov_message_.has_oemcrypto_core_message());
EXPECT_EQ(signature_input_,
absl::StrCat(signed_prov_message_.oemcrypto_core_message(),
signed_prov_message_.message()));
}
EXPECT_EQ(kDevicePrivateKey,
crypto_util::DecryptAesCbc(message_key_,
prov_response.device_rsa_key_iv(),
prov_response.device_rsa_key()));
EXPECT_EQ(kDeviceCertificate, prov_response.device_certificate());
EXPECT_EQ(kNonce, prov_response.nonce());
EXPECT_EQ(kWrappingKey, prov_response.wrapping_key());
}
ClientIdentification client_id_;
ProvisioningRequest prov_request_;
SignedProvisioningMessage signed_prov_message_;
std::string signature_input_;
std::string message_key_;
std::string response_;
};
TEST_F(Provisioning30SessionImplProcessTest, InvalidMessage) {
@@ -310,8 +378,10 @@ TEST_F(Provisioning30SessionImplProcessTest, VerifySignatureFailed) {
EXPECT_CALL(mock_oem_device_cert_,
DoVerifyCertificateChain(kClientToken, _, _, _))
.WillOnce(DoAll(SetArgPointee<1>(mock_cert_public_key), Return(true)));
const HashAlgorithm hash_algorithm =
HashAlgorithmProtoToEnum(signed_prov_message_.hash_algorithm());
EXPECT_CALL(*mock_cert_public_key,
VerifySignature(signed_prov_message_.message(),
VerifySignature(signed_prov_message_.message(), hash_algorithm,
signed_prov_message_.signature()))
.WillOnce(Return(false));
@@ -334,8 +404,10 @@ TEST_F(Provisioning30SessionImplProcessTest, GenerateDeviceCertificateFailed) {
.WillOnce(DoAll(
SetArgPointee<1>(mock_cert_public_key), SetArgPointee<2>(kSystemId),
SetArgPointee<3>(kExpectedOemSerialNumber), Return(true)));
const HashAlgorithm hash_algorithm =
HashAlgorithmProtoToEnum(signed_prov_message_.hash_algorithm());
EXPECT_CALL(*mock_cert_public_key,
VerifySignature(signed_prov_message_.message(),
VerifySignature(signed_prov_message_.message(), hash_algorithm,
signed_prov_message_.signature()))
.WillOnce(Return(true));
@@ -353,54 +425,57 @@ TEST_F(Provisioning30SessionImplProcessTest, GenerateDeviceCertificateFailed) {
signed_prov_message_.SerializeAsString(), &response, &done));
}
TEST_F(Provisioning30SessionImplProcessTest, Success) {
const uint32_t kSystemId = 1234;
EXPECT_CALL(mock_service_private_key_, Decrypt(kEncryptedPrivacyKey, _))
.WillOnce(DoAll(SetArgPointee<1>(kPrivacyKey), Return(true)));
MockRsaPublicKey* mock_cert_public_key = new MockRsaPublicKey;
EXPECT_CALL(mock_oem_device_cert_,
DoVerifyCertificateChain(kClientToken, _, _, _))
.WillOnce(DoAll(SetArgPointee<1>(mock_cert_public_key),
SetArgPointee<2>(kSystemId), Return(true)));
EXPECT_CALL(*mock_cert_public_key,
VerifySignature(signed_prov_message_.message(),
signed_prov_message_.signature()))
.WillOnce(Return(true));
EXPECT_CALL(mock_engine_impl_, GenerateProviderDeviceDrmCertificate(
kSystemId, _, _, kDevicePublicKey, _, _))
.WillOnce(DoAll(SetArgPointee<5>(kDeviceCertificate), Return(OK)));
std::string message_key;
EXPECT_CALL(*mock_cert_public_key, Encrypt(_, _))
.WillOnce(DoAll(SaveArg<0>(&message_key), SetArgPointee<1>(kWrappingKey),
Return(true)));
std::string message;
EXPECT_CALL(mock_service_private_key_, GenerateSignature(_, _))
.WillOnce(DoAll(SaveArg<0>(&message), SetArgPointee<1>(kSignature),
Return(true)));
std::string response;
TEST_F(Provisioning30SessionImplProcessTest, SuccessWithCoreMessage) {
ProcessMessage(kCoreMessage);
bool done;
ASSERT_EQ(OK, session_impl_.ProcessMessage(
signed_prov_message_.SerializeAsString(), &response, &done));
// Verify the response.
EXPECT_TRUE(done);
SignedProvisioningMessage signed_prov_message;
ASSERT_TRUE(signed_prov_message.ParseFromString(response));
EXPECT_EQ(message, signed_prov_message.message());
EXPECT_EQ(kSignature, signed_prov_message.signature());
ProvisioningResponse prov_response;
ASSERT_TRUE(prov_response.ParseFromString(message));
EXPECT_EQ(
kDevicePrivateKey,
crypto_util::DecryptAesCbc(message_key, prov_response.device_rsa_key_iv(),
prov_response.device_rsa_key()));
EXPECT_EQ(kDeviceCertificate, prov_response.device_certificate());
EXPECT_EQ(kNonce, prov_response.nonce());
EXPECT_EQ(kWrappingKey, prov_response.wrapping_key());
EXPECT_CALL(mock_service_private_key_, GenerateSignature(_, _, _))
.WillOnce(DoAll(SaveArg<0>(&signature_input_),
SetArgPointee<2>(kSignature), Return(true)));
ASSERT_EQ(
OK, session_impl_.ProcessMessage(signed_prov_message_.SerializeAsString(),
&response_, &done));
ASSERT_TRUE(done);
ValidateMessage(kCoreMessage);
}
TEST_F(Provisioning30SessionImplProcessTest, SuccessWithEmptyCoreMessage) {
ProcessMessage(kEmptyCoreMessage);
bool done;
EXPECT_CALL(mock_service_private_key_, GenerateSignature(_, _, _))
.WillOnce(DoAll(SaveArg<0>(&signature_input_),
SetArgPointee<2>(kSignature), Return(true)));
ASSERT_EQ(
OK, session_impl_.ProcessMessage(signed_prov_message_.SerializeAsString(),
&response_, &done));
ASSERT_TRUE(done);
ValidateMessage(kEmptyCoreMessage);
}
TEST_F(Provisioning30SessionImplProcessTest, FailedWithInvalidCoreMessage) {
ProcessMessage(kInvalidCoreMessage);
bool done;
ASSERT_EQ(INTERNAL_ERROR,
session_impl_.ProcessMessage(
signed_prov_message_.SerializeAsString(), &response_, &done));
ASSERT_FALSE(done);
}
TEST_F(Provisioning30SessionImplProcessTest, VerifyHashAlgorithmInResponse) {
const HashAlgorithm hash_algorithm = HashAlgorithm::kSha256;
signed_prov_message_.set_hash_algorithm(
HashAlgorithmEnumToProto(hash_algorithm));
ProcessMessage(kCoreMessage);
bool done;
EXPECT_CALL(mock_service_private_key_, GenerateSignature(_, _, _))
.WillOnce(DoAll(SaveArg<0>(&signature_input_),
SetArgPointee<2>(kSignature), Return(true)));
ASSERT_EQ(
OK, session_impl_.ProcessMessage(signed_prov_message_.SerializeAsString(),
&response_, &done));
ASSERT_TRUE(done);
SignedProvisioningMessage signed_response;
signed_response.ParseFromString(response_);
EXPECT_EQ(signed_response.hash_algorithm(),
signed_prov_message_.hash_algorithm());
}
} // namespace widevine

90
provisioning_sdk/internal/provisioning_engine_impl.cc
View File

@@ -10,6 +10,7 @@
#include <stddef.h>
#include <time.h>
#include <limits>
#include <memory>
#include <string>
@@ -22,6 +23,7 @@
#include "common/crypto_util.h"
#include "common/drm_root_certificate.h"
#include "common/drm_service_certificate.h"
#include "common/hash_algorithm_util.h"
#include "common/random_util.h"
#include "common/rsa_key.h"
#include "provisioning_sdk/internal/certificates/root_oem_certificates.h"
@@ -38,7 +40,8 @@ const size_t kContextEncryptionIvSize(16);
const size_t kContextMacKeySize(32);
bool GenerateCertificate(DrmCertificate::Type type, uint32_t system_id,
const std::string& provider_id, const std::string& serial_number,
const std::string& provider_id,
const std::string& serial_number,
const std::string& public_key,
const RsaPrivateKey& signing_key,
const SignedDrmCertificate& signer,
@@ -63,8 +66,10 @@ bool GenerateCertificate(DrmCertificate::Type type, uint32_t system_id,
LOG(WARNING) << "Error serializing DrmCertificate.";
return false;
}
if (!signing_key.GenerateSignature(signed_cert.drm_certificate(),
signed_cert.mutable_signature())) {
if (!signing_key.GenerateSignature(
signed_cert.drm_certificate(),
HashAlgorithmProtoToEnum(signed_cert.hash_algorithm()),
signed_cert.mutable_signature())) {
LOG(WARNING) << "Failed to generate signature for DrmCertificate.";
return false;
}
@@ -105,7 +110,8 @@ ProvisioningEngineImpl::ProvisioningEngineImpl()
ProvisioningEngineImpl::~ProvisioningEngineImpl() {}
ProvisioningStatus ProvisioningEngineImpl::Initialize(
CertificateType certificate_type, const std::string& drm_service_certificate,
CertificateType certificate_type,
const std::string& drm_service_certificate,
const std::string& service_private_key,
const std::string& service_private_key_passphrase,
const std::string& provisioning_drm_certificate,
@@ -173,7 +179,8 @@ ProvisioningStatus ProvisioningEngineImpl::Initialize(
}
ProvisioningStatus ProvisioningEngineImpl::SetCertificateStatusList(
const std::string& certificate_status_list, uint32_t expiration_period_seconds) {
const std::string& certificate_status_list,
uint32_t expiration_period_seconds) {
if (certificate_status_list.empty()) {
LOG(WARNING) << "Empty certificate_status_list.";
return INVALID_STATUS_LIST;
@@ -187,6 +194,7 @@ ProvisioningStatus ProvisioningEngineImpl::SetCertificateStatusList(
if (!drm_root_public_key_->VerifySignature(
signed_cert_status_list.certificate_status_list(),
HashAlgorithmProtoToEnum(signed_cert_status_list.hash_algorithm()),
signed_cert_status_list.signature())) {
LOG_WITH_PROTO("Signature verification failed", signed_cert_status_list);
return INVALID_STATUS_LIST;
@@ -236,7 +244,8 @@ ProvisioningStatus ProvisioningEngineImpl::SetCertificateStatusList(
}
ProvisioningStatus ProvisioningEngineImpl::GenerateDrmIntermediateCertificate(
uint32_t system_id, const std::string& public_key, std::string* certificate) const {
uint32_t system_id, const std::string& public_key,
std::string* certificate) const {
auto intermediate_public_key =
rsa_key_factory_->CreateFromPkcs1PublicKey(public_key);
if (!intermediate_public_key) return INVALID_INTERMEDIATE_PUBLIC_KEY;
@@ -247,8 +256,8 @@ ProvisioningStatus ProvisioningEngineImpl::GenerateDrmIntermediateCertificate(
LOG(WARNING) << "Failed to generate serial_number.";
return INTERNAL_ERROR;
}
if (!GenerateCertificate(DrmCertificate::DEVICE_MODEL, system_id, std::string(),
serial_number, public_key,
if (!GenerateCertificate(DrmCertificate::DEVICE_MODEL, system_id,
std::string(), serial_number, public_key,
*provisioning_private_key_,
signed_provisioning_cert_, certificate)) {
return INTERNAL_ERROR;
@@ -318,7 +327,8 @@ ProvisioningStatus ProvisioningEngineImpl::GenerateDeviceDrmCertificate(
ProvisioningStatus ProvisioningEngineImpl::GenerateProviderDeviceDrmCertificate(
uint32_t system_id, const std::string& oem_ca_serial_number,
const std::string& provider_id, const std::string& public_key,
const std::string& certificate_serial_number, std::string* certificate) const {
const std::string& certificate_serial_number,
std::string* certificate) const {
// |oem_ca_serial_number| could be empty if it is called directly from
// ProvisioningEngine::GenerateDeviceDrmCertificate.
DCHECK(!certificate_serial_number.empty());
@@ -365,40 +375,67 @@ std::shared_ptr<ProvisionedDeviceInfo> ProvisioningEngineImpl::GetDeviceInfo(
}
ProvisioningStatus ProvisioningEngineImpl::StoreContext(
const std::string& context_data, ProvisioningContext* context) const {
DCHECK(context);
const std::string& context_data,
SignedProvisioningContext* signed_context) const {
DCHECK(signed_context);
ProvisioningContextKeyData key_data;
if (!RandomBytes(kContextEncryptionKeySize,
key_data.mutable_encryption_key()) ||
!RandomBytes(kContextEncryptionIvSize,
key_data.mutable_encryption_iv()) ||
!RandomBytes(kContextMacKeySize, key_data.mutable_mac_key())) {
key_data.mutable_encryption_iv())) {
LOG(ERROR) << "Failed to generate random context key data.";
return INTERNAL_ERROR;
}
context->set_context_data(crypto_util::EncryptAesCbc(
const DrmServiceCertificate* service_cert =
DrmServiceCertificate::GetDefaultDrmServiceCertificateOrDie();
ProvisioningContext context;
context.set_context_data(crypto_util::EncryptAesCbc(
key_data.encryption_key(), key_data.encryption_iv(), context_data));
context->set_mac(crypto_util::CreateSignatureHmacSha256(
key_data.mac_key(), context->context_data()));
if (!DrmServiceCertificate::GetDefaultDrmServiceCertificateOrDie()
->public_key()
->Encrypt(key_data.SerializeAsString(),
context->mutable_key_data())) {
if (!service_cert->public_key()->Encrypt(key_data.SerializeAsString(),
context.mutable_key_data())) {
LOG(WARNING) << "Context key data encryption failed";
return INTERNAL_ERROR;
}
signed_context->set_provisioning_context(context.SerializeAsString());
if (!service_cert->private_key()->GenerateSignature(
signed_context->provisioning_context(),
HashAlgorithmProtoToEnum(signed_context->hash_algorithm()),
signed_context->mutable_signature())) {
LOG(WARNING) << "Failed to generate signature for ProvisioningContext.";
return INTERNAL_ERROR;
}
return OK;
}
ProvisioningStatus ProvisioningEngineImpl::RetrieveContext(
const ProvisioningContext& context, std::string* context_data) const {
const SignedProvisioningContext& signed_context,
std::string* context_data) const {
DCHECK(context_data);
const DrmServiceCertificate* service_cert =
DrmServiceCertificate::GetDefaultDrmServiceCertificateOrDie();
if (!service_cert->public_key()->VerifySignature(
signed_context.provisioning_context(),
HashAlgorithmProtoToEnum(signed_context.hash_algorithm()),
signed_context.signature())) {
LOG(WARNING) << "ProvisioningContext signature verification failed.";
return INVALID_CONTEXT;
}
ProvisioningContext context;
if (!context.ParseFromString(signed_context.provisioning_context())) {
LOG(WARNING) << "Invalid context.";
return INVALID_CONTEXT;
}
std::string serialized_key_data;
if (!DrmServiceCertificate::GetDefaultDrmServiceCertificateOrDie()
->private_key()
->Decrypt(context.key_data(), &serialized_key_data)) {
if (!service_cert->private_key()->Decrypt(context.key_data(),
&serialized_key_data)) {
LOG(WARNING) << "Could not decrypt context key data";
return INVALID_CONTEXT_KEY_DATA;
}
@@ -411,11 +448,6 @@ ProvisioningStatus ProvisioningEngineImpl::RetrieveContext(
LOG(WARNING) << "Invalid context key data.";
return INVALID_CONTEXT_KEY_DATA;
}
if (!crypto_util::VerifySignatureHmacSha256(key_data.mac_key(), context.mac(),
context.context_data())) {
LOG(WARNING) << "Provisioning context MAC verification failed.";
return INVALID_CONTEXT;
}
*context_data = crypto_util::DecryptAesCbc(key_data.encryption_key(),
key_data.encryption_iv(),
context.context_data());

34
provisioning_sdk/internal/provisioning_engine_impl.h
View File

@@ -12,13 +12,14 @@
#define PROVISIONING_SDK_INTERNAL_PROVISIONING_ENGINE_IMPL_H_
#include <stdint.h>
#include <map>
#include <memory>
#include <string>
#include <utility>
#include <cstdint>
#include "base/thread_annotations.h"
#include "absl/base/thread_annotations.h"
#include "absl/synchronization/mutex.h"
#include "common/certificate_type.h"
#include "common/drm_root_certificate.h"
@@ -61,7 +62,8 @@ class ProvisioningEngineImpl {
// derivation of Stable Per-Origin IDentifiers.
// * Returns OK on success, or an appropriate error status code otherwise.
ProvisioningStatus Initialize(
CertificateType certificate_type, const std::string& drm_service_certificate,
CertificateType certificate_type,
const std::string& drm_service_certificate,
const std::string& service_private_key,
const std::string& service_private_key_passphrase,
const std::string& provisioning_drm_certificate,
@@ -77,7 +79,8 @@ class ProvisioningEngineImpl {
// (creation_time_seconds). Zero means it will never expire.
// * Returns OK on success, or an appropriate error status code otherwise.
ProvisioningStatus SetCertificateStatusList(
const std::string& certificate_status_list, uint32_t expiration_period_seconds);
const std::string& certificate_status_list,
uint32_t expiration_period_seconds);
// Generate an intermediate DRM certificate.
// * |system_id| is the Widevine system ID for the type of device.
@@ -91,7 +94,8 @@ class ProvisioningEngineImpl {
// engines, including this one, by invoking
// |AddIntermediatedrmcertificate| on all active ProvisioningEngine(s).
ProvisioningStatus GenerateDrmIntermediateCertificate(
uint32_t system_id, const std::string& public_key, std::string* certificate) const;
uint32_t system_id, const std::string& public_key,
std::string* certificate) const;
// Add an intermediate DRM certificate to the provisioning engine. This is
// usually done once for each supported device type.
@@ -123,26 +127,30 @@ class ProvisioningEngineImpl {
// Virtual for mocking.
virtual ProvisioningStatus GenerateDeviceDrmCertificate(
uint32_t system_id, const std::string& oem_ca_serial_number,
const std::string& public_key, const std::string& certificate_serial_number,
const std::string& public_key,
const std::string& certificate_serial_number,
std::string* certificate) const;
// Internal version of the method above. Allows specifying |provider_id|.
virtual ProvisioningStatus GenerateProviderDeviceDrmCertificate(
uint32_t system_id, const std::string& oem_ca_serial_number,
const std::string& provider_id, const std::string& public_key,
const std::string& certificate_serial_number, std::string* certificate) const;
const std::string& certificate_serial_number,
std::string* certificate) const;
// Get the device info for the given |system_id|.
virtual std::shared_ptr<ProvisionedDeviceInfo> GetDeviceInfo(
uint32_t system_id) const;
// Encrypt, store, and sign context/state data.
virtual ProvisioningStatus StoreContext(const std::string& context_data,
ProvisioningContext* context) const;
virtual ProvisioningStatus StoreContext(
const std::string& context_data,
SignedProvisioningContext* context) const;
// Verify, decrypt, and retrieve context/state data.
virtual ProvisioningStatus RetrieveContext(const ProvisioningContext& context,
std::string* context_data) const;
virtual ProvisioningStatus RetrieveContext(
const SignedProvisioningContext& context,
std::string* context_data) const;
const DrmRootCertificate* drm_root_certificate() const {
return drm_root_certificate_.get();
@@ -154,6 +162,7 @@ class ProvisioningEngineImpl {
friend class ProvisioningEngineImplTest;
friend class ProvisioningEngineImplProvTest;
friend class Sigma101ProvisioningSessionImplTest;
friend class Sigma210ProvisioningSessionImplTest;
ProvisioningEngineImpl(const ProvisioningEngineImpl&) = delete;
ProvisioningEngineImpl& operator=(const ProvisioningEngineImpl&) = delete;
@@ -189,10 +198,11 @@ class ProvisioningEngineImpl {
mutable absl::Mutex cert_status_mutex_;
// POSIX time, in seconds, when the list would be expired.
uint32_t certificate_expiration_seconds_utc_ GUARDED_BY(cert_status_mutex_);
uint32_t certificate_expiration_seconds_utc_
ABSL_GUARDED_BY(cert_status_mutex_);
// Maps with system_id as the key.
std::map<uint32_t, DeviceCertificateStatus> certificate_status_map_
GUARDED_BY(cert_status_mutex_);
ABSL_GUARDED_BY(cert_status_mutex_);
struct IntermediateCertificateInfo {
SignedDrmCertificate signed_drm_certificate;
std::shared_ptr<ProvisionedDeviceInfo> device_info;

78
provisioning_sdk/internal/provisioning_engine_impl_test.cc
View File

@@ -8,7 +8,7 @@
#include "provisioning_sdk/internal/provisioning_engine_impl.h"
#include <time.h>
#include <ctime>
#include <memory>
#include "glog/logging.h"
@@ -69,14 +69,14 @@ namespace widevine {
class MockDrmRootCertificate : public DrmRootCertificate {
public:
MockDrmRootCertificate()
: DrmRootCertificate(kCertificateTypeTesting, std::string(), std::string(),
kDrmRootPublicKey,
: DrmRootCertificate(kCertificateTypeTesting, std::string(),
std::string(), kDrmRootPublicKey,
std::unique_ptr<RsaKeyFactory>()) {}
MOCK_CONST_METHOD3(VerifyCertificate,
Status(const std::string& serialized_cert,
SignedDrmCertificate* signed_drm_cert,
DrmCertificate* drm_cert));
MOCK_METHOD(Status, VerifyCertificate,
(const std::string& serialized_cert,
SignedDrmCertificate* signed_drm_cert, DrmCertificate* drm_cert),
(const, override));
};
class ProvisioningEngineImplTest : public ::testing::Test {
@@ -87,11 +87,11 @@ class ProvisioningEngineImplTest : public ::testing::Test {
test_keys.private_test_key_2_2048_bits(), kServicePrivateKeyPassphrase,
&service_private_key_);
TestDrmCertificates test_certificates;
service_certificate_ = test_certificates.test_service_certificate();
service_certificate_ = test_certificates.test_service_certificate_no_type();
}
ProvisioningStatus CheckDeviceStatus(uint32_t system_id,
const std::string& oem_ca_serial_number) {
ProvisioningStatus CheckDeviceStatus(
uint32_t system_id, const std::string& oem_ca_serial_number) {
return engine_impl_.CheckDeviceStatus(system_id, oem_ca_serial_number);
}
@@ -177,7 +177,8 @@ class ProvisioningEngineImplProvTest : public ProvisioningEngineImplTest {
ByMove(std::unique_ptr<RsaPublicKey>(mock_root_public_key_))));
}
ProvisioningStatus Initialize(const std::string& provisioning_drm_certificate) {
ProvisioningStatus Initialize(
const std::string& provisioning_drm_certificate) {
return engine_impl_.Initialize(
kCertificateTypeTesting, service_certificate_, service_private_key_,
kServicePrivateKeyPassphrase, provisioning_drm_certificate,
@@ -268,44 +269,33 @@ class ProvisioningEngineImplContextTest
TEST_F(ProvisioningEngineImplContextTest, ContextStoreAndRetrieveSuccess) {
const char kContextData[] = "I dislike tacky orange things";
ProvisioningContext context;
ASSERT_EQ(OK, engine_impl_.StoreContext(kContextData, &context));
EXPECT_NE(kContextData, context.context_data());
EXPECT_FALSE(context.mac().empty());
SignedProvisioningContext signed_context;
ASSERT_EQ(OK, engine_impl_.StoreContext(kContextData, &signed_context));
EXPECT_FALSE(signed_context.signature().empty());
std::string context_data;
ASSERT_EQ(OK, engine_impl_.RetrieveContext(context, &context_data));
ASSERT_EQ(OK, engine_impl_.RetrieveContext(signed_context, &context_data));
EXPECT_EQ(kContextData, context_data);
}
TEST_F(ProvisioningEngineImplContextTest, ContextStoreAndRetrieveFailBadData) {
const char kContextData[] = "Climate change is not a hoax";
ProvisioningContext context;
ASSERT_EQ(OK, engine_impl_.StoreContext(kContextData, &context));
++(*context.mutable_context_data())[5];
SignedProvisioningContext signed_context;
ASSERT_EQ(OK, engine_impl_.StoreContext(kContextData, &signed_context));
++(*signed_context.mutable_provisioning_context())[5];
std::string context_data;
ASSERT_EQ(INVALID_CONTEXT,
engine_impl_.RetrieveContext(context, &context_data));
}
TEST_F(ProvisioningEngineImplContextTest, ContextStoreAndRetrieveFailBadMac) {
const char kContextData[] = "No one wants coal anymore";
ProvisioningContext context;
ASSERT_EQ(OK, engine_impl_.StoreContext(kContextData, &context));
++(*context.mutable_mac())[5];
std::string context_data;
ASSERT_EQ(INVALID_CONTEXT,
engine_impl_.RetrieveContext(context, &context_data));
engine_impl_.RetrieveContext(signed_context, &context_data));
}
TEST_F(ProvisioningEngineImplContextTest,
ContextStoreAndRetrieveFailBadKeyData) {
ContextStoreAndRetrieveFailBadSignature) {
const char kContextData[] = "No one wants coal anymore";
ProvisioningContext context;
ASSERT_EQ(OK, engine_impl_.StoreContext(kContextData, &context));
++(*context.mutable_key_data())[5];
SignedProvisioningContext signed_context;
ASSERT_EQ(OK, engine_impl_.StoreContext(kContextData, &signed_context));
++(*signed_context.mutable_signature())[5];
std::string context_data;
ASSERT_EQ(INVALID_CONTEXT_KEY_DATA,
engine_impl_.RetrieveContext(context, &context_data));
ASSERT_EQ(INVALID_CONTEXT,
engine_impl_.RetrieveContext(signed_context, &context_data));
}
class ProvisioningEngineImplGeneralTest
@@ -365,7 +355,7 @@ class ProvisioningEngineImplGeneralTest
cert_status_list_.SerializeAsString());
EXPECT_CALL(*mock_root_public_key_,
VerifySignature(
StrEq(signed_cert_status_list.certificate_status_list()),
StrEq(signed_cert_status_list.certificate_status_list()), _,
"cert_status_list_signature"))
.WillOnce(Return(true));
signed_cert_status_list.set_signature("cert_status_list_signature");
@@ -395,7 +385,7 @@ TEST_F(ProvisioningEngineImplGeneralTest,
signed_cert_status_list.set_certificate_status_list(
cert_status_list_.SerializeAsString());
EXPECT_CALL(*mock_root_public_key_,
VerifySignature(_, "cert_status_list_signature"))
VerifySignature(_, _, "cert_status_list_signature"))
.WillOnce(Return(false));
signed_cert_status_list.set_signature("cert_status_list_signature");
ASSERT_EQ(INVALID_STATUS_LIST,
@@ -440,7 +430,7 @@ TEST_F(ProvisioningEngineImplGeneralTest, UpdateCertificateStatusList) {
signed_cert_status_list.set_certificate_status_list(
cert_status_list_.SerializeAsString());
EXPECT_CALL(*mock_root_public_key_,
VerifySignature(_, "cert_status_list_signature"))
VerifySignature(_, _, "cert_status_list_signature"))
.WillOnce(Return(true));
signed_cert_status_list.set_signature("cert_status_list_signature");
ASSERT_EQ(OK, engine_impl_.SetCertificateStatusList(
@@ -476,9 +466,9 @@ TEST_F(ProvisioningEngineImplGeneralTest, GenerateDrmIntermediateCertificate) {
CreateFromPkcs1PublicKey(kIntermediatePublicKey))
.WillOnce(
Return(ByMove(std::unique_ptr<RsaPublicKey>(new MockRsaPublicKey))));
EXPECT_CALL(*mock_prov_private_key_, GenerateSignature(_, _))
EXPECT_CALL(*mock_prov_private_key_, GenerateSignature(_, _, _))
.WillOnce(DoAll(SaveArg<0>(&drm_certificate),
SetArgPointee<1>(kSignature), Return(true)));
SetArgPointee<2>(kSignature), Return(true)));
std::string certificate;
ASSERT_EQ(OK, engine_impl_.GenerateDrmIntermediateCertificate(
kSystemId, kIntermediatePublicKey, &certificate));
@@ -634,7 +624,7 @@ TEST_F(ProvisioningEngineImplGeneralTest, ExpiredCertificateStatusList) {
signed_cert_status_list.set_certificate_status_list(
cert_status_list_.SerializeAsString());
EXPECT_CALL(*mock_root_public_key_,
VerifySignature(_, "cert_status_list_signature"))
VerifySignature(_, _, "cert_status_list_signature"))
.WillOnce(Return(true));
signed_cert_status_list.set_signature("cert_status_list_signature");
ASSERT_EQ(OK, engine_impl_.SetCertificateStatusList(
@@ -706,9 +696,9 @@ TEST_F(ProvisioningEngineImplGeneralTest, GenerateDeviceDrmCertificate) {
// Intermediate private key expectation.
std::string drm_certificate;
EXPECT_CALL(*mock_intermediate_private_key, GenerateSignature(_, _))
EXPECT_CALL(*mock_intermediate_private_key, GenerateSignature(_, _, _))
.WillOnce(DoAll(SaveArg<0>(&drm_certificate),
SetArgPointee<1>(kSignature), Return(true)));
SetArgPointee<2>(kSignature), Return(true)));
std::string certificate;
EXPECT_EQ(OK, engine_impl_.GenerateDeviceDrmCertificate(
kSystemId, kOemSerialNumber0, kDevicePublicKey,

3
provisioning_sdk/internal/provisioning_session_impl.cc
View File

@@ -26,7 +26,8 @@ ProvisioningSessionImpl::ProvisioningSessionImpl(
ProvisioningSessionImpl::~ProvisioningSessionImpl() {}
ProvisioningStatus ProvisioningSessionImpl::Initialize(
const std::string& device_drm_public_key, const std::string& device_drm_private_key) {
const std::string& device_drm_public_key,
const std::string& device_drm_private_key) {
auto rsa_public_key =
rsa_key_factory_->CreateFromPkcs1PublicKey(device_drm_public_key);
if (!rsa_public_key) return INVALID_DRM_DEVICE_PUBLIC_KEY;