KeyMint: new version number in attestation
For the time being, allow the version number in the attestation record
to be 100 even if the AIDL version is 2, so that implementations don't
have to update both versions simultaneously.
Bug: 194358913
Test: TreeHugger, VtsAidlKeyMintTargetTest
Change-Id: I9aae69327a62014e286ce30ca2a4d91c4c280714
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 6140df1..3695f1e 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -127,6 +127,16 @@
return attest_rec;
}
+void check_attestation_version(uint32_t attestation_version, int32_t aidl_version) {
+ // Version numbers in attestation extensions should be a multiple of 100.
+ EXPECT_EQ(attestation_version % 100, 0);
+
+ // The multiplier should never be higher than the AIDL version, but can be less
+ // (for example, if the implementation is from an earlier version but the HAL service
+ // uses the default libraries and so reports the current AIDL version).
+ EXPECT_TRUE((attestation_version / 100) <= aidl_version);
+}
+
bool avb_verification_enabled() {
char value[PROPERTY_VALUE_MAX];
return property_get("ro.boot.vbmeta.device_state", value, "") != 0;
@@ -223,6 +233,15 @@
vendor_patch_level_ = getVendorPatchlevel();
}
+int32_t KeyMintAidlTestBase::AidlVersion() {
+ int32_t version = 0;
+ auto status = keymint_->getInterfaceVersion(&version);
+ if (!status.isOk()) {
+ ADD_FAILURE() << "Failed to determine interface version";
+ }
+ return version;
+}
+
void KeyMintAidlTestBase::SetUp() {
if (AServiceManager_isDeclared(GetParam().c_str())) {
::ndk::SpAIBinder binder(AServiceManager_waitForService(GetParam().c_str()));
@@ -1304,7 +1323,8 @@
verify_subject(cert.get(), subject, self_signed);
}
-bool verify_attestation_record(const string& challenge, //
+bool verify_attestation_record(int32_t aidl_version, //
+ const string& challenge, //
const string& app_id, //
AuthorizationSet expected_sw_enforced, //
AuthorizationSet expected_hw_enforced, //
@@ -1342,7 +1362,7 @@
EXPECT_EQ(ErrorCode::OK, error);
if (error != ErrorCode::OK) return false;
- EXPECT_EQ(att_attestation_version, 100U);
+ check_attestation_version(att_attestation_version, aidl_version);
vector<uint8_t> appId(app_id.begin(), app_id.end());
// check challenge and app id only if we expects a non-fake certificate
@@ -1353,7 +1373,7 @@
expected_sw_enforced.push_back(TAG_ATTESTATION_APPLICATION_ID, appId);
}
- EXPECT_EQ(att_keymint_version, 100U);
+ check_attestation_version(att_keymint_version, aidl_version);
EXPECT_EQ(security_level, att_keymint_security_level);
EXPECT_EQ(security_level, att_attestation_security_level);