David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 1 | // Copyright 2022, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Integration test for Rialto. |
| 16 | |
| 17 | use android_system_virtualizationservice::{ |
| 18 | aidl::android::system::virtualizationservice::{ |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 19 | VirtualMachineConfig::VirtualMachineConfig, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 20 | VirtualMachineRawConfig::VirtualMachineRawConfig, |
| 21 | }, |
| 22 | binder::{ParcelFileDescriptor, ProcessState}, |
| 23 | }; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 24 | use anyhow::{bail, Context, Result}; |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 25 | use ciborium::value::Value; |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame^] | 26 | use client_vm_csr::generate_attestation_key_and_csr; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 27 | use log::info; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 28 | use service_vm_comm::{ |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 29 | ClientVmAttestationParams, EcdsaP256KeyPair, GenerateCertificateRequestParams, Request, |
| 30 | RequestProcessingError, Response, VmType, |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 31 | }; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 32 | use service_vm_manager::ServiceVm; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 33 | use std::fs::File; |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 34 | use std::io; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 35 | use std::panic; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 36 | use std::path::PathBuf; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 37 | use vmclient::VmInstance; |
Alice Wang | 4e082c3 | 2023-07-11 07:41:50 +0000 | [diff] [blame] | 38 | |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 39 | const UNSIGNED_RIALTO_PATH: &str = "/data/local/tmp/rialto_test/arm64/rialto_unsigned.bin"; |
| 40 | const INSTANCE_IMG_PATH: &str = "/data/local/tmp/rialto_test/arm64/instance.img"; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 41 | |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 42 | #[test] |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 43 | fn process_requests_in_protected_vm() -> Result<()> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 44 | check_processing_requests(VmType::ProtectedVm) |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 45 | } |
| 46 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 47 | #[test] |
| 48 | fn process_requests_in_non_protected_vm() -> Result<()> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 49 | check_processing_requests(VmType::NonProtectedVm) |
| 50 | } |
| 51 | |
| 52 | fn check_processing_requests(vm_type: VmType) -> Result<()> { |
| 53 | let mut vm = start_service_vm(vm_type)?; |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 54 | |
| 55 | check_processing_reverse_request(&mut vm)?; |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 56 | let key_pair = check_processing_generating_key_pair_request(&mut vm)?; |
| 57 | check_processing_generating_certificate_request(&mut vm, &key_pair.maced_public_key)?; |
| 58 | check_attestation_request(&mut vm, &key_pair.key_blob)?; |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 59 | Ok(()) |
| 60 | } |
| 61 | |
| 62 | fn check_processing_reverse_request(vm: &mut ServiceVm) -> Result<()> { |
Alice Wang | 0486e25 | 2023-10-06 14:30:49 +0000 | [diff] [blame] | 63 | let message = "abc".repeat(500); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 64 | let request = Request::Reverse(message.as_bytes().to_vec()); |
| 65 | |
Alice Wang | fbdc85b | 2023-09-07 12:56:46 +0000 | [diff] [blame] | 66 | let response = vm.process_request(request)?; |
| 67 | info!("Received response: {response:?}."); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 68 | |
| 69 | let expected_response: Vec<u8> = message.as_bytes().iter().rev().cloned().collect(); |
| 70 | assert_eq!(Response::Reverse(expected_response), response); |
| 71 | Ok(()) |
| 72 | } |
| 73 | |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 74 | fn check_processing_generating_key_pair_request(vm: &mut ServiceVm) -> Result<EcdsaP256KeyPair> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 75 | let request = Request::GenerateEcdsaP256KeyPair; |
| 76 | |
| 77 | let response = vm.process_request(request)?; |
| 78 | info!("Received response: {response:?}."); |
| 79 | |
| 80 | match response { |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 81 | Response::GenerateEcdsaP256KeyPair(key_pair) => { |
| 82 | assert_array_has_nonzero(&key_pair.maced_public_key); |
| 83 | assert_array_has_nonzero(&key_pair.key_blob); |
| 84 | Ok(key_pair) |
Alice Wang | a78d3f0 | 2023-09-13 12:39:16 +0000 | [diff] [blame] | 85 | } |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 86 | _ => bail!("Incorrect response type: {response:?}"), |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 87 | } |
| 88 | } |
| 89 | |
Alice Wang | a78d3f0 | 2023-09-13 12:39:16 +0000 | [diff] [blame] | 90 | fn assert_array_has_nonzero(v: &[u8]) { |
| 91 | assert!(v.iter().any(|&x| x != 0)) |
| 92 | } |
| 93 | |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 94 | fn check_processing_generating_certificate_request( |
| 95 | vm: &mut ServiceVm, |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 96 | maced_public_key: &[u8], |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 97 | ) -> Result<()> { |
| 98 | let params = GenerateCertificateRequestParams { |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 99 | keys_to_sign: vec![maced_public_key.to_vec()], |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 100 | challenge: vec![], |
| 101 | }; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 102 | let request = Request::GenerateCertificateRequest(params); |
| 103 | |
| 104 | let response = vm.process_request(request)?; |
| 105 | info!("Received response: {response:?}."); |
| 106 | |
| 107 | match response { |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 108 | Response::GenerateCertificateRequest(csr) => check_csr(csr), |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 109 | _ => bail!("Incorrect response type: {response:?}"), |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 110 | } |
| 111 | } |
| 112 | |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 113 | fn check_attestation_request(vm: &mut ServiceVm, key_blob: &[u8]) -> Result<()> { |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame^] | 114 | /// The following data was generated randomly with urandom. |
| 115 | const CHALLENGE: [u8; 16] = [ |
| 116 | 0x7d, 0x86, 0x58, 0x79, 0x3a, 0x09, 0xdf, 0x1c, 0xa5, 0x80, 0x80, 0x15, 0x2b, 0x13, 0x17, |
| 117 | 0x5c, |
| 118 | ]; |
| 119 | let dice_artifacts = diced_sample_inputs::make_sample_bcc_and_cdis()?; |
| 120 | let attestation_data = generate_attestation_key_and_csr(&CHALLENGE, &dice_artifacts)?; |
| 121 | |
| 122 | let params = ClientVmAttestationParams { |
| 123 | csr: attestation_data.csr.into_cbor_vec()?, |
| 124 | remotely_provisioned_key_blob: key_blob.to_vec(), |
| 125 | }; |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 126 | let request = Request::RequestClientVmAttestation(params); |
| 127 | |
| 128 | let response = vm.process_request(request)?; |
| 129 | info!("Received response: {response:?}."); |
| 130 | |
| 131 | match response { |
| 132 | // TODO(b/309441500): Check the certificate once it is implemented. |
| 133 | Response::Err(RequestProcessingError::OperationUnimplemented) => Ok(()), |
| 134 | _ => bail!("Incorrect response type: {response:?}"), |
| 135 | } |
| 136 | } |
| 137 | |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 138 | /// TODO(b/300625792): Check the CSR with libhwtrust once the CSR is complete. |
| 139 | fn check_csr(csr: Vec<u8>) -> Result<()> { |
| 140 | let mut reader = io::Cursor::new(csr); |
| 141 | let csr: Value = ciborium::from_reader(&mut reader)?; |
| 142 | match csr { |
| 143 | Value::Array(arr) => { |
| 144 | assert_eq!(4, arr.len()); |
| 145 | } |
| 146 | _ => bail!("Incorrect CSR format: {csr:?}"), |
| 147 | } |
| 148 | Ok(()) |
| 149 | } |
| 150 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 151 | fn start_service_vm(vm_type: VmType) -> Result<ServiceVm> { |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 152 | android_logger::init_once( |
| 153 | android_logger::Config::default().with_tag("rialto").with_min_level(log::Level::Debug), |
| 154 | ); |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 155 | // Redirect panic messages to logcat. |
| 156 | panic::set_hook(Box::new(|panic_info| { |
| 157 | log::error!("{}", panic_info); |
| 158 | })); |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 159 | // We need to start the thread pool for Binder to work properly, especially link_to_death. |
| 160 | ProcessState::start_thread_pool(); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 161 | ServiceVm::start_vm(vm_instance(vm_type)?, vm_type) |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 162 | } |
| 163 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 164 | fn vm_instance(vm_type: VmType) -> Result<VmInstance> { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 165 | match vm_type { |
Alice Wang | 1d9a587 | 2023-09-06 14:32:36 +0000 | [diff] [blame] | 166 | VmType::ProtectedVm => { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 167 | service_vm_manager::protected_vm_instance(PathBuf::from(INSTANCE_IMG_PATH)) |
Alice Wang | 1d9a587 | 2023-09-06 14:32:36 +0000 | [diff] [blame] | 168 | } |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 169 | VmType::NonProtectedVm => nonprotected_vm_instance(), |
| 170 | } |
| 171 | } |
| 172 | |
| 173 | fn nonprotected_vm_instance() -> Result<VmInstance> { |
| 174 | let rialto = File::open(UNSIGNED_RIALTO_PATH).context("Failed to open Rialto kernel binary")?; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 175 | let config = VirtualMachineConfig::RawConfig(VirtualMachineRawConfig { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 176 | name: String::from("Non protected rialto"), |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 177 | bootloader: Some(ParcelFileDescriptor::new(rialto)), |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 178 | protectedVm: false, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 179 | memoryMib: 300, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 180 | platformVersion: "~1.0".to_string(), |
Inseob Kim | 6ef8097 | 2023-07-20 17:23:36 +0900 | [diff] [blame] | 181 | ..Default::default() |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 182 | }); |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 183 | let console = Some(service_vm_manager::android_log_fd()?); |
| 184 | let log = Some(service_vm_manager::android_log_fd()?); |
| 185 | let virtmgr = vmclient::VirtualizationService::new().context("Failed to spawn VirtMgr")?; |
| 186 | let service = virtmgr.connect().context("Failed to connect to VirtMgr")?; |
| 187 | info!("Connected to VirtMgr for service VM"); |
| 188 | VmInstance::create(service.as_ref(), &config, console, /* consoleIn */ None, log, None) |
| 189 | .context("Failed to create VM") |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 190 | } |