1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "Keymaster4_1HidlTest.h"
18
19 #include <keymasterV4_1/authorization_set.h>
20
21 namespace android::hardware::keymaster::V4_1::test {
22
23 using std::string;
24
25 using EarlyBootKeyTest = Keymaster4_1HidlTest;
26
27 // Because VTS tests are run on fully-booted machines, we can only run negative tests for early boot
28 // keys, which cannot be created or used after /data is mounted. This is the only test we can run
29 // in the normal case. The positive test will have to be done by the Android system, when it
30 // creates/uses early boot keys during boot. It should fail to boot if the early boot key usage
31 // fails.
TEST_P(EarlyBootKeyTest,CannotCreateEarlyBootKeys)32 TEST_P(EarlyBootKeyTest, CannotCreateEarlyBootKeys) {
33 auto [aesKeyData, hmacKeyData, rsaKeyData, ecdsaKeyData] =
34 CreateTestKeys(TAG_EARLY_BOOT_ONLY, ErrorCode::EARLY_BOOT_ENDED);
35
36 CheckedDeleteKeyData(&aesKeyData);
37 CheckedDeleteKeyData(&hmacKeyData);
38 CheckedDeleteKeyData(&rsaKeyData);
39 CheckedDeleteKeyData(&ecdsaKeyData);
40 }
41
42 // This is a more comprenhensive test, but it can only be run on a machine which is still in early
43 // boot stage, which no proper Android device is by the time we can run VTS. To use this,
44 // un-disable it and modify vold to remove the call to earlyBootEnded(). Running the test will end
45 // early boot, so you'll have to reboot between runs.
TEST_P(EarlyBootKeyTest,DISABLED_FullTest)46 TEST_P(EarlyBootKeyTest, DISABLED_FullTest) {
47 // Should be able to create keys, since early boot has not ended
48 auto [aesKeyData, hmacKeyData, rsaKeyData, ecdsaKeyData] =
49 CreateTestKeys(TAG_EARLY_BOOT_ONLY, ErrorCode::OK);
50
51 // TAG_EARLY_BOOT_ONLY should be in hw-enforced.
52 EXPECT_TRUE(contains(aesKeyData.characteristics.hardwareEnforced, TAG_EARLY_BOOT_ONLY));
53 EXPECT_TRUE(contains(hmacKeyData.characteristics.hardwareEnforced, TAG_EARLY_BOOT_ONLY));
54 EXPECT_TRUE(contains(rsaKeyData.characteristics.hardwareEnforced, TAG_EARLY_BOOT_ONLY));
55 EXPECT_TRUE(contains(ecdsaKeyData.characteristics.hardwareEnforced, TAG_EARLY_BOOT_ONLY));
56
57 // Should be able to use keys, since early boot has not ended
58 EXPECT_EQ(ErrorCode::OK, UseAesKey(aesKeyData.blob));
59 EXPECT_EQ(ErrorCode::OK, UseHmacKey(hmacKeyData.blob));
60 EXPECT_EQ(ErrorCode::OK, UseRsaKey(rsaKeyData.blob));
61 EXPECT_EQ(ErrorCode::OK, UseEcdsaKey(ecdsaKeyData.blob));
62
63 // End early boot
64 Return<ErrorCode> earlyBootResult = keymaster().earlyBootEnded();
65 EXPECT_TRUE(earlyBootResult.isOk());
66 EXPECT_EQ(earlyBootResult, ErrorCode::OK);
67
68 // Should not be able to use already-created keys.
69 EXPECT_EQ(ErrorCode::EARLY_BOOT_ENDED, UseAesKey(aesKeyData.blob));
70 EXPECT_EQ(ErrorCode::EARLY_BOOT_ENDED, UseHmacKey(hmacKeyData.blob));
71 EXPECT_EQ(ErrorCode::EARLY_BOOT_ENDED, UseRsaKey(rsaKeyData.blob));
72 EXPECT_EQ(ErrorCode::EARLY_BOOT_ENDED, UseEcdsaKey(ecdsaKeyData.blob));
73
74 CheckedDeleteKeyData(&aesKeyData);
75 CheckedDeleteKeyData(&hmacKeyData);
76 CheckedDeleteKeyData(&rsaKeyData);
77 CheckedDeleteKeyData(&ecdsaKeyData);
78
79 // Should not be able to create new keys
80 std::tie(aesKeyData, hmacKeyData, rsaKeyData, ecdsaKeyData) =
81 CreateTestKeys(TAG_EARLY_BOOT_ONLY, ErrorCode::EARLY_BOOT_ENDED);
82
83 CheckedDeleteKeyData(&aesKeyData);
84 CheckedDeleteKeyData(&hmacKeyData);
85 CheckedDeleteKeyData(&rsaKeyData);
86 CheckedDeleteKeyData(&ecdsaKeyData);
87 }
88
89 INSTANTIATE_KEYMASTER_4_1_HIDL_TEST(EarlyBootKeyTest);
90
91 } // namespace android::hardware::keymaster::V4_1::test
92