David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 1 | // Copyright 2022, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Integration test for Rialto. |
| 16 | |
| 17 | use android_system_virtualizationservice::{ |
| 18 | aidl::android::system::virtualizationservice::{ |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 19 | VirtualMachineConfig::VirtualMachineConfig, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 20 | VirtualMachineRawConfig::VirtualMachineRawConfig, |
| 21 | }, |
| 22 | binder::{ParcelFileDescriptor, ProcessState}, |
| 23 | }; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 24 | use anyhow::{bail, Context, Result}; |
Alice Wang | b76b66f | 2024-03-26 08:16:23 +0000 | [diff] [blame^] | 25 | use bssl_avf::{rand_bytes, sha256, EcKey, PKey}; |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 26 | use client_vm_csr::generate_attestation_key_and_csr; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 27 | use coset::{CborSerializable, CoseMac0, CoseSign}; |
Alice Wang | 68d1140 | 2024-01-02 13:59:44 +0000 | [diff] [blame] | 28 | use hwtrust::{rkp, session::Session}; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 29 | use log::info; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 30 | use service_vm_comm::{ |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 31 | ClientVmAttestationParams, Csr, CsrPayload, EcdsaP256KeyPair, GenerateCertificateRequestParams, |
Alice Wang | d3a9640 | 2023-11-24 15:37:39 +0000 | [diff] [blame] | 32 | Request, RequestProcessingError, Response, VmType, |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 33 | }; |
Alice Wang | 1cc1350 | 2023-12-05 11:05:34 +0000 | [diff] [blame] | 34 | use service_vm_fake_chain::client_vm::{ |
| 35 | fake_client_vm_dice_artifacts, fake_sub_components, SubComponent, |
| 36 | }; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 37 | use service_vm_manager::ServiceVm; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 38 | use std::fs; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 39 | use std::fs::File; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 40 | use std::panic; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 41 | use std::path::PathBuf; |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 42 | use std::str::FromStr; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 43 | use vmclient::VmInstance; |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 44 | use x509_cert::{ |
| 45 | certificate::{Certificate, Version}, |
| 46 | der::{self, asn1, Decode, Encode}, |
| 47 | name::Name, |
| 48 | spki::{AlgorithmIdentifier, ObjectIdentifier, SubjectPublicKeyInfo}, |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 49 | }; |
Alice Wang | 4e082c3 | 2023-07-11 07:41:50 +0000 | [diff] [blame] | 50 | |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 51 | const UNSIGNED_RIALTO_PATH: &str = "/data/local/tmp/rialto_test/arm64/rialto_unsigned.bin"; |
| 52 | const INSTANCE_IMG_PATH: &str = "/data/local/tmp/rialto_test/arm64/instance.img"; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 53 | const TEST_CERT_CHAIN_PATH: &str = "testdata/rkp_cert_chain.der"; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 54 | |
Alice Wang | 0472f46 | 2024-02-06 08:53:19 +0000 | [diff] [blame] | 55 | #[cfg(dice_changes)] |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 56 | #[test] |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 57 | fn process_requests_in_protected_vm() -> Result<()> { |
Alice Wang | 0472f46 | 2024-02-06 08:53:19 +0000 | [diff] [blame] | 58 | // The test is skipped if the feature flag |dice_changes| is not enabled, because when |
| 59 | // the flag is off, the DICE chain is truncated in the pvmfw, and the service VM cannot |
| 60 | // verify the chain due to the missing entries in the chain. |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 61 | check_processing_requests(VmType::ProtectedVm) |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 62 | } |
| 63 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 64 | #[test] |
| 65 | fn process_requests_in_non_protected_vm() -> Result<()> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 66 | check_processing_requests(VmType::NonProtectedVm) |
| 67 | } |
| 68 | |
| 69 | fn check_processing_requests(vm_type: VmType) -> Result<()> { |
| 70 | let mut vm = start_service_vm(vm_type)?; |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 71 | |
| 72 | check_processing_reverse_request(&mut vm)?; |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 73 | let key_pair = check_processing_generating_key_pair_request(&mut vm)?; |
| 74 | check_processing_generating_certificate_request(&mut vm, &key_pair.maced_public_key)?; |
Alice Wang | d3a9640 | 2023-11-24 15:37:39 +0000 | [diff] [blame] | 75 | check_attestation_request(&mut vm, &key_pair, vm_type)?; |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 76 | Ok(()) |
| 77 | } |
| 78 | |
| 79 | fn check_processing_reverse_request(vm: &mut ServiceVm) -> Result<()> { |
Alice Wang | 0486e25 | 2023-10-06 14:30:49 +0000 | [diff] [blame] | 80 | let message = "abc".repeat(500); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 81 | let request = Request::Reverse(message.as_bytes().to_vec()); |
| 82 | |
Alice Wang | fbdc85b | 2023-09-07 12:56:46 +0000 | [diff] [blame] | 83 | let response = vm.process_request(request)?; |
| 84 | info!("Received response: {response:?}."); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 85 | |
| 86 | let expected_response: Vec<u8> = message.as_bytes().iter().rev().cloned().collect(); |
| 87 | assert_eq!(Response::Reverse(expected_response), response); |
| 88 | Ok(()) |
| 89 | } |
| 90 | |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 91 | fn check_processing_generating_key_pair_request(vm: &mut ServiceVm) -> Result<EcdsaP256KeyPair> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 92 | let request = Request::GenerateEcdsaP256KeyPair; |
| 93 | |
| 94 | let response = vm.process_request(request)?; |
| 95 | info!("Received response: {response:?}."); |
| 96 | |
| 97 | match response { |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 98 | Response::GenerateEcdsaP256KeyPair(key_pair) => { |
| 99 | assert_array_has_nonzero(&key_pair.maced_public_key); |
| 100 | assert_array_has_nonzero(&key_pair.key_blob); |
| 101 | Ok(key_pair) |
Alice Wang | a78d3f0 | 2023-09-13 12:39:16 +0000 | [diff] [blame] | 102 | } |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 103 | _ => bail!("Incorrect response type: {response:?}"), |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 104 | } |
| 105 | } |
| 106 | |
Alice Wang | a78d3f0 | 2023-09-13 12:39:16 +0000 | [diff] [blame] | 107 | fn assert_array_has_nonzero(v: &[u8]) { |
| 108 | assert!(v.iter().any(|&x| x != 0)) |
| 109 | } |
| 110 | |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 111 | fn check_processing_generating_certificate_request( |
| 112 | vm: &mut ServiceVm, |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 113 | maced_public_key: &[u8], |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 114 | ) -> Result<()> { |
| 115 | let params = GenerateCertificateRequestParams { |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 116 | keys_to_sign: vec![maced_public_key.to_vec()], |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 117 | challenge: vec![], |
| 118 | }; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 119 | let request = Request::GenerateCertificateRequest(params); |
| 120 | |
| 121 | let response = vm.process_request(request)?; |
| 122 | info!("Received response: {response:?}."); |
| 123 | |
| 124 | match response { |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 125 | Response::GenerateCertificateRequest(csr) => check_csr(csr), |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 126 | _ => bail!("Incorrect response type: {response:?}"), |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 127 | } |
| 128 | } |
| 129 | |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 130 | fn check_attestation_request( |
| 131 | vm: &mut ServiceVm, |
| 132 | remotely_provisioned_key_pair: &EcdsaP256KeyPair, |
Alice Wang | d3a9640 | 2023-11-24 15:37:39 +0000 | [diff] [blame] | 133 | vm_type: VmType, |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 134 | ) -> Result<()> { |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 135 | /// The following data was generated randomly with urandom. |
| 136 | const CHALLENGE: [u8; 16] = [ |
| 137 | 0x7d, 0x86, 0x58, 0x79, 0x3a, 0x09, 0xdf, 0x1c, 0xa5, 0x80, 0x80, 0x15, 0x2b, 0x13, 0x17, |
| 138 | 0x5c, |
| 139 | ]; |
Alice Wang | 4ac9c8b | 2023-12-05 16:23:14 +0000 | [diff] [blame] | 140 | let dice_artifacts = fake_client_vm_dice_artifacts()?; |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 141 | let attestation_data = generate_attestation_key_and_csr(&CHALLENGE, &dice_artifacts)?; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 142 | let cert_chain = fs::read(TEST_CERT_CHAIN_PATH)?; |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 143 | // The certificate chain contains several certificates, but we only need the first one. |
| 144 | // Parsing the data with trailing data always fails with a `TrailingData` error. |
| 145 | let cert_len: usize = match Certificate::from_der(&cert_chain).unwrap_err().kind() { |
| 146 | der::ErrorKind::TrailingData { decoded, .. } => decoded.try_into().unwrap(), |
| 147 | e => bail!("Unexpected error: {e}"), |
| 148 | }; |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 149 | |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 150 | // Builds the mock parameters for the client VM attestation. |
| 151 | // The `csr` and `remotely_provisioned_key_blob` parameters are extracted from the same |
| 152 | // libraries as in production. |
| 153 | // The `remotely_provisioned_cert` parameter is an RKP certificate extracted from a test |
| 154 | // certificate chain retrieved from RKPD. |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 155 | let params = ClientVmAttestationParams { |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 156 | csr: attestation_data.csr.clone().into_cbor_vec()?, |
| 157 | remotely_provisioned_key_blob: remotely_provisioned_key_pair.key_blob.to_vec(), |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 158 | remotely_provisioned_cert: cert_chain[..cert_len].to_vec(), |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 159 | }; |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 160 | let request = Request::RequestClientVmAttestation(params); |
| 161 | |
| 162 | let response = vm.process_request(request)?; |
| 163 | info!("Received response: {response:?}."); |
| 164 | |
| 165 | match response { |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 166 | Response::RequestClientVmAttestation(certificate) => { |
Alice Wang | d3a9640 | 2023-11-24 15:37:39 +0000 | [diff] [blame] | 167 | // The end-to-end test for non-protected VM attestation works because both the service |
| 168 | // VM and the client VM use the same fake DICE chain. |
| 169 | assert_eq!(vm_type, VmType::NonProtectedVm); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 170 | check_certificate_for_client_vm( |
| 171 | &certificate, |
| 172 | &remotely_provisioned_key_pair.maced_public_key, |
| 173 | &attestation_data.csr, |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 174 | &Certificate::from_der(&cert_chain[..cert_len]).unwrap(), |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 175 | )?; |
| 176 | Ok(()) |
| 177 | } |
Alice Wang | d3a9640 | 2023-11-24 15:37:39 +0000 | [diff] [blame] | 178 | Response::Err(RequestProcessingError::InvalidDiceChain) => { |
| 179 | // The end-to-end test for protected VM attestation doesn't work because the service VM |
| 180 | // compares the fake DICE chain in the CSR with the real DICE chain. |
| 181 | // We cannot generate a valid DICE chain with the same payloads up to pvmfw. |
| 182 | assert_eq!(vm_type, VmType::ProtectedVm); |
| 183 | Ok(()) |
| 184 | } |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 185 | _ => bail!("Incorrect response type: {response:?}"), |
| 186 | } |
| 187 | } |
| 188 | |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 189 | fn check_vm_components(vm_components: &asn1::SequenceOf<asn1::Any, 4>) -> Result<()> { |
Alice Wang | 1cc1350 | 2023-12-05 11:05:34 +0000 | [diff] [blame] | 190 | let expected_components = fake_sub_components(); |
| 191 | assert_eq!(expected_components.len(), vm_components.len()); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 192 | for (i, expected_component) in expected_components.iter().enumerate() { |
| 193 | check_vm_component(vm_components.get(i).unwrap(), expected_component)?; |
Alice Wang | 1cc1350 | 2023-12-05 11:05:34 +0000 | [diff] [blame] | 194 | } |
| 195 | Ok(()) |
| 196 | } |
| 197 | |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 198 | fn check_vm_component(vm_component: &asn1::Any, expected_component: &SubComponent) -> Result<()> { |
| 199 | let vm_component = vm_component.decode_as::<asn1::SequenceOf<asn1::Any, 4>>().unwrap(); |
Alice Wang | 1cc1350 | 2023-12-05 11:05:34 +0000 | [diff] [blame] | 200 | assert_eq!(4, vm_component.len()); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 201 | let name = vm_component.get(0).unwrap().decode_as::<asn1::Utf8StringRef>().unwrap(); |
| 202 | assert_eq!(expected_component.name, name.as_ref()); |
| 203 | let version = vm_component.get(1).unwrap().decode_as::<u64>().unwrap(); |
| 204 | assert_eq!(expected_component.version, version); |
| 205 | let code_hash = vm_component.get(2).unwrap().decode_as::<asn1::OctetString>().unwrap(); |
| 206 | assert_eq!(expected_component.code_hash, code_hash.as_bytes()); |
| 207 | let authority_hash = vm_component.get(3).unwrap().decode_as::<asn1::OctetString>().unwrap(); |
| 208 | assert_eq!(expected_component.authority_hash, authority_hash.as_bytes()); |
Alice Wang | 1cc1350 | 2023-12-05 11:05:34 +0000 | [diff] [blame] | 209 | Ok(()) |
| 210 | } |
| 211 | |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 212 | fn check_certificate_for_client_vm( |
| 213 | certificate: &[u8], |
| 214 | maced_public_key: &[u8], |
| 215 | csr: &Csr, |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 216 | parent_certificate: &Certificate, |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 217 | ) -> Result<()> { |
| 218 | let cose_mac = CoseMac0::from_slice(maced_public_key)?; |
Alice Wang | be7a4b1 | 2023-12-01 11:53:36 +0000 | [diff] [blame] | 219 | let authority_public_key = |
| 220 | EcKey::from_cose_public_key_slice(&cose_mac.payload.unwrap()).unwrap(); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 221 | let cert = Certificate::from_der(certificate).unwrap(); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 222 | |
| 223 | // Checks the certificate signature against the authority public key. |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 224 | const ECDSA_WITH_SHA_256: ObjectIdentifier = |
| 225 | ObjectIdentifier::new_unwrap("1.2.840.10045.4.3.2"); |
| 226 | let expected_algorithm = AlgorithmIdentifier { oid: ECDSA_WITH_SHA_256, parameters: None }; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 227 | assert_eq!(expected_algorithm, cert.signature_algorithm); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 228 | let tbs_cert = cert.tbs_certificate; |
| 229 | let digest = sha256(&tbs_cert.to_der().unwrap()).unwrap(); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 230 | authority_public_key |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 231 | .ecdsa_verify(cert.signature.raw_bytes(), &digest) |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 232 | .expect("Failed to verify the certificate signature with the authority public key"); |
| 233 | |
| 234 | // Checks that the certificate's subject public key is equal to the key in the CSR. |
| 235 | let cose_sign = CoseSign::from_slice(&csr.signed_csr_payload)?; |
| 236 | let csr_payload = |
| 237 | cose_sign.payload.as_ref().and_then(|v| CsrPayload::from_cbor_slice(v).ok()).unwrap(); |
Alice Wang | be7a4b1 | 2023-12-01 11:53:36 +0000 | [diff] [blame] | 238 | let subject_public_key = EcKey::from_cose_public_key_slice(&csr_payload.public_key).unwrap(); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 239 | let expected_spki_data = |
Alice Wang | eb77f7d | 2023-12-01 09:13:58 +0000 | [diff] [blame] | 240 | PKey::try_from(subject_public_key).unwrap().subject_public_key_info().unwrap(); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 241 | let expected_spki = SubjectPublicKeyInfo::from_der(&expected_spki_data).unwrap(); |
| 242 | assert_eq!(expected_spki, tbs_cert.subject_public_key_info); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 243 | |
| 244 | // Checks the certificate extension. |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 245 | const ATTESTATION_EXTENSION_OID: ObjectIdentifier = |
| 246 | ObjectIdentifier::new_unwrap("1.3.6.1.4.1.11129.2.1.29.1"); |
| 247 | let extensions = tbs_cert.extensions.unwrap(); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 248 | assert_eq!(1, extensions.len()); |
| 249 | let extension = &extensions[0]; |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 250 | assert_eq!(ATTESTATION_EXTENSION_OID, extension.extn_id); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 251 | assert!(!extension.critical); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 252 | let attestation_ext = |
| 253 | asn1::SequenceOf::<asn1::Any, 3>::from_der(extension.extn_value.as_bytes()).unwrap(); |
Alice Wang | 1cc1350 | 2023-12-05 11:05:34 +0000 | [diff] [blame] | 254 | assert_eq!(3, attestation_ext.len()); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 255 | let challenge = attestation_ext.get(0).unwrap().decode_as::<asn1::OctetString>().unwrap(); |
| 256 | assert_eq!(csr_payload.challenge, challenge.as_bytes()); |
| 257 | let is_vm_secure = attestation_ext.get(1).unwrap().decode_as::<bool>().unwrap(); |
Alice Wang | d3a9640 | 2023-11-24 15:37:39 +0000 | [diff] [blame] | 258 | assert!( |
| 259 | !is_vm_secure, |
| 260 | "The VM shouldn't be secure as the last payload added in the test is in Debug mode" |
| 261 | ); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 262 | let vm_components = |
| 263 | attestation_ext.get(2).unwrap().decode_as::<asn1::SequenceOf<asn1::Any, 4>>().unwrap(); |
| 264 | check_vm_components(&vm_components)?; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 265 | |
| 266 | // Checks other fields on the certificate |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 267 | assert_eq!(Version::V3, tbs_cert.version); |
| 268 | assert_eq!(parent_certificate.tbs_certificate.validity, tbs_cert.validity); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 269 | assert_eq!( |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 270 | Name::from_str("CN=Android Protected Virtual Machine Key").unwrap(), |
| 271 | tbs_cert.subject |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 272 | ); |
Alice Wang | 6a504ef | 2023-12-21 15:37:55 +0000 | [diff] [blame] | 273 | assert_eq!(parent_certificate.tbs_certificate.subject, tbs_cert.issuer); |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 274 | |
| 275 | Ok(()) |
| 276 | } |
| 277 | |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 278 | fn check_csr(csr: Vec<u8>) -> Result<()> { |
Alice Wang | 68d1140 | 2024-01-02 13:59:44 +0000 | [diff] [blame] | 279 | let _csr = rkp::Csr::from_cbor(&Session::default(), &csr[..]).context("Failed to parse CSR")?; |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 280 | Ok(()) |
| 281 | } |
| 282 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 283 | fn start_service_vm(vm_type: VmType) -> Result<ServiceVm> { |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 284 | android_logger::init_once( |
Jeff Vander Stoep | d9dda0c | 2024-02-07 14:27:06 +0100 | [diff] [blame] | 285 | android_logger::Config::default() |
| 286 | .with_tag("rialto") |
| 287 | .with_max_level(log::LevelFilter::Debug), |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 288 | ); |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 289 | // Redirect panic messages to logcat. |
| 290 | panic::set_hook(Box::new(|panic_info| { |
| 291 | log::error!("{}", panic_info); |
| 292 | })); |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 293 | // We need to start the thread pool for Binder to work properly, especially link_to_death. |
| 294 | ProcessState::start_thread_pool(); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 295 | ServiceVm::start_vm(vm_instance(vm_type)?, vm_type) |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 296 | } |
| 297 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 298 | fn vm_instance(vm_type: VmType) -> Result<VmInstance> { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 299 | match vm_type { |
Alice Wang | 1d9a587 | 2023-09-06 14:32:36 +0000 | [diff] [blame] | 300 | VmType::ProtectedVm => { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 301 | service_vm_manager::protected_vm_instance(PathBuf::from(INSTANCE_IMG_PATH)) |
Alice Wang | 1d9a587 | 2023-09-06 14:32:36 +0000 | [diff] [blame] | 302 | } |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 303 | VmType::NonProtectedVm => nonprotected_vm_instance(), |
| 304 | } |
| 305 | } |
| 306 | |
| 307 | fn nonprotected_vm_instance() -> Result<VmInstance> { |
| 308 | let rialto = File::open(UNSIGNED_RIALTO_PATH).context("Failed to open Rialto kernel binary")?; |
Alice Wang | b76b66f | 2024-03-26 08:16:23 +0000 | [diff] [blame^] | 309 | // Do not use `#allocateInstanceId` to generate the instance ID because the method |
| 310 | // also adds an instance ID to the database it manages. |
| 311 | // This is not necessary for this test. |
| 312 | let mut instance_id = [0u8; 64]; |
| 313 | rand_bytes(&mut instance_id).unwrap(); |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 314 | let config = VirtualMachineConfig::RawConfig(VirtualMachineRawConfig { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 315 | name: String::from("Non protected rialto"), |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 316 | bootloader: Some(ParcelFileDescriptor::new(rialto)), |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 317 | protectedVm: false, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 318 | memoryMib: 300, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 319 | platformVersion: "~1.0".to_string(), |
Alice Wang | b76b66f | 2024-03-26 08:16:23 +0000 | [diff] [blame^] | 320 | instanceId: instance_id, |
Inseob Kim | 6ef8097 | 2023-07-20 17:23:36 +0900 | [diff] [blame] | 321 | ..Default::default() |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 322 | }); |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 323 | let console = Some(service_vm_manager::android_log_fd()?); |
| 324 | let log = Some(service_vm_manager::android_log_fd()?); |
| 325 | let virtmgr = vmclient::VirtualizationService::new().context("Failed to spawn VirtMgr")?; |
| 326 | let service = virtmgr.connect().context("Failed to connect to VirtMgr")?; |
| 327 | info!("Connected to VirtMgr for service VM"); |
| 328 | VmInstance::create(service.as_ref(), &config, console, /* consoleIn */ None, log, None) |
| 329 | .context("Failed to create VM") |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 330 | } |