Add function that compares UDS Pubs in DICE chains
Adding a test to VtsRemotelyProvisionedComponentTests.cpp that checks
whether the root certificate's public key (UDS_pub) in the DICE chains
for RKP VM ("avf") and the primary KeyMint instance ("default").
Test: m libhwtrust_cxx
atest libkeymint_remote_prov_support_test
Change-Id: Icbde1d8727f2d1811f9930011059913d84806649
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index f0745d7..d9bd0d8 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -151,20 +151,24 @@
return corruptChain.encode();
}
-bool matching_keymint_device(const string& rp_name, std::shared_ptr<IKeyMintDevice>* keyMint) {
- auto rp_suffix = deviceSuffix(rp_name);
+template <class T>
+auto getHandle(const string& serviceName) {
+ ::ndk::SpAIBinder binder(AServiceManager_waitForService(serviceName.c_str()));
+ return T::fromBinder(binder);
+}
- vector<string> km_names = ::android::getAidlHalInstanceNames(IKeyMintDevice::descriptor);
- for (const string& km_name : km_names) {
+std::shared_ptr<IKeyMintDevice> matchingKeyMintDevice(const string& rpcName) {
+ auto rpcSuffix = deviceSuffix(rpcName);
+
+ vector<string> kmNames = ::android::getAidlHalInstanceNames(IKeyMintDevice::descriptor);
+ for (const string& kmName : kmNames) {
// If the suffix of the KeyMint instance equals the suffix of the
// RemotelyProvisionedComponent instance, assume they match.
- if (deviceSuffix(km_name) == rp_suffix && AServiceManager_isDeclared(km_name.c_str())) {
- ::ndk::SpAIBinder binder(AServiceManager_waitForService(km_name.c_str()));
- *keyMint = IKeyMintDevice::fromBinder(binder);
- return true;
+ if (deviceSuffix(kmName) == rpcSuffix && AServiceManager_isDeclared(kmName.c_str())) {
+ getHandle<IKeyMintDevice>(kmName);
}
}
- return false;
+ return nullptr;
}
} // namespace
@@ -173,8 +177,7 @@
public:
virtual void SetUp() override {
if (AServiceManager_isDeclared(GetParam().c_str())) {
- ::ndk::SpAIBinder binder(AServiceManager_waitForService(GetParam().c_str()));
- provisionable_ = IRemotelyProvisionedComponent::fromBinder(binder);
+ provisionable_ = getHandle<IRemotelyProvisionedComponent>(GetParam());
}
ASSERT_NE(provisionable_, nullptr);
auto status = provisionable_->getHardwareInfo(&rpcHardwareInfo);
@@ -210,9 +213,7 @@
std::set<std::string> uniqueIds;
for (auto hal : ::android::getAidlHalInstanceNames(IRemotelyProvisionedComponent::descriptor)) {
ASSERT_TRUE(AServiceManager_isDeclared(hal.c_str()));
- ::ndk::SpAIBinder binder(AServiceManager_waitForService(hal.c_str()));
- std::shared_ptr<IRemotelyProvisionedComponent> rpc =
- IRemotelyProvisionedComponent::fromBinder(binder);
+ auto rpc = getHandle<IRemotelyProvisionedComponent>(hal);
ASSERT_NE(rpc, nullptr);
RpcHardwareInfo hwInfo;
@@ -248,9 +249,7 @@
GTEST_SKIP() << "Strongbox is not present on this device.";
}
- ::ndk::SpAIBinder binder(AServiceManager_waitForService(DEFAULT_INSTANCE_NAME.c_str()));
- std::shared_ptr<IRemotelyProvisionedComponent> rpc =
- IRemotelyProvisionedComponent::fromBinder(binder);
+ auto rpc = getHandle<IRemotelyProvisionedComponent>(DEFAULT_INSTANCE_NAME);
ASSERT_NE(rpc, nullptr);
bytevec challenge = randomBytes(64);
@@ -263,6 +262,55 @@
ASSERT_TRUE(*result);
}
+/**
+ * Verify that if a protected VM (also called `avf` or RKP VM) implementation exists, then the
+ * protected VM and the primary KeyMint (also called 'default') implementation's DICE certificate
+ * chain has the same root public key, i.e., the same UDS public key
+ */
+// @VsrTest = 7.1-003.001
+TEST(NonParameterizedTests, equalUdsPubInDiceCertChainForRkpVmAndPrimaryKeyMintInstances) {
+ int apiLevel = get_vsr_api_level();
+ if (apiLevel < 202504) {
+ if (!AServiceManager_isDeclared(RKPVM_INSTANCE_NAME.c_str())) {
+ GTEST_SKIP() << "The RKP VM (" << RKPVM_INSTANCE_NAME
+ << ") is not present on this device.";
+ }
+ } else {
+ ASSERT_TRUE(AServiceManager_isDeclared(RKPVM_INSTANCE_NAME.c_str()));
+ }
+
+ auto rkpVmRpc = getHandle<IRemotelyProvisionedComponent>(RKPVM_INSTANCE_NAME);
+ ASSERT_NE(rkpVmRpc, nullptr) << "The RKP VM (" << RKPVM_INSTANCE_NAME
+ << ") RPC is unavailable.";
+
+ RpcHardwareInfo hardwareInfo;
+ auto status = rkpVmRpc->getHardwareInfo(&hardwareInfo);
+ if (!status.isOk()) {
+ GTEST_SKIP() << "The RKP VM is not supported on this system.";
+ }
+
+ bytevec rkpVmChallenge = randomBytes(MAX_CHALLENGE_SIZE);
+ bytevec rkpVmCsr;
+ auto rkpVmStatus =
+ rkpVmRpc->generateCertificateRequestV2({} /* keysToSign */, rkpVmChallenge, &rkpVmCsr);
+ ASSERT_TRUE(rkpVmStatus.isOk()) << rkpVmStatus.getDescription();
+
+ auto primaryKeyMintRpc = getHandle<IRemotelyProvisionedComponent>(DEFAULT_INSTANCE_NAME);
+ ASSERT_NE(primaryKeyMintRpc, nullptr)
+ << "The Primary KeyMint (" << DEFAULT_INSTANCE_NAME << ") RPC is unavailable.";
+
+ bytevec primaryKeyMintChallenge = randomBytes(MAX_CHALLENGE_SIZE);
+ bytevec primaryKeyMintCsr;
+ auto primaryKeyMintStatus = primaryKeyMintRpc->generateCertificateRequestV2(
+ {} /* keysToSign */, primaryKeyMintChallenge, &primaryKeyMintCsr);
+ ASSERT_TRUE(primaryKeyMintStatus.isOk()) << primaryKeyMintStatus.getDescription();
+
+ auto equal = compareRootPublicKeysInDiceChains(rkpVmCsr, RKPVM_INSTANCE_NAME, primaryKeyMintCsr,
+ DEFAULT_INSTANCE_NAME);
+ ASSERT_TRUE(equal) << equal.message();
+ ASSERT_TRUE(*equal) << "Primary KeyMint and RKP VM RPCs have different UDS public keys";
+}
+
using GetHardwareInfoTests = VtsRemotelyProvisionedComponentTests;
INSTANTIATE_REM_PROV_AIDL_TEST(GetHardwareInfoTests);
@@ -336,9 +384,8 @@
*/
TEST_P(GenerateKeyTests, generateAndUseEcdsaP256Key_prodMode) {
// See if there is a matching IKeyMintDevice for this IRemotelyProvisionedComponent.
- std::shared_ptr<IKeyMintDevice> keyMint;
- if (!matching_keymint_device(GetParam(), &keyMint)) {
- // No matching IKeyMintDevice.
+ auto keyMint = matchingKeyMintDevice(GetParam());
+ if (!keyMint) {
GTEST_SKIP() << "Skipping key use test as no matching KeyMint device found";
return;
}
@@ -931,9 +978,8 @@
// @VsrTest = 3.10-015
TEST_P(CertificateRequestV2Test, DeviceInfo) {
// See if there is a matching IKeyMintDevice for this IRemotelyProvisionedComponent.
- std::shared_ptr<IKeyMintDevice> keyMint;
- if (!matching_keymint_device(GetParam(), &keyMint)) {
- // No matching IKeyMintDevice.
+ std::shared_ptr<IKeyMintDevice> keyMint = matchingKeyMintDevice(GetParam());
+ if (!keyMint) {
GTEST_SKIP() << "Skipping key use test as no matching KeyMint device found";
return;
}