Merge "KeyMint VTS: re-order auth failure arms" into main am: 2ef3749cba am: e865448a4e am: a88395ee44 am: ee4bcc968c am: 090155dcc2
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2750968
Change-Id: Ibc1b54043b8a57afd47c4fb255b7ba2dbaa9d6aa
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/security/keymint/aidl/vts/functional/AuthTest.cpp b/security/keymint/aidl/vts/functional/AuthTest.cpp
index d5c6d2a..eb5db68 100644
--- a/security/keymint/aidl/vts/functional/AuthTest.cpp
+++ b/security/keymint/aidl/vts/functional/AuthTest.cpp
@@ -350,14 +350,14 @@
// Wait for long enough that the hardware auth token expires.
sleep(timeout_secs + 1);
- if (!timestamp_token_required_) {
- // KeyMint implementation has its own clock, and can immediately detect timeout.
- EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
- Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
- } else {
- // KeyMint implementation has no clock, so only detects timeout via timestamp token provided
- // on update()/finish().
- ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
+
+ auto begin_result = Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat);
+ if (begin_result == ErrorCode::OK) {
+ // If begin() succeeds despite the out-of-date HAT, that must mean that the KeyMint
+ // device doesn't have its own clock. In that case, it only detects timeout via a
+ // timestamp token provided on update()/finish()
+ ASSERT_TRUE(timestamp_token_required_);
+
secureclock::TimeStampToken time_token;
EXPECT_EQ(ErrorCode::OK,
GetReturnErrorCode(clock_->generateTimeStamp(challenge_, &time_token)));
@@ -365,6 +365,9 @@
string output;
EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
Finish(message, {} /* signature */, &output, hat, time_token));
+ } else {
+ // The KeyMint implementation may have its own clock that can immediately detect timeout.
+ ASSERT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED, begin_result);
}
}