David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 1 | // Copyright 2022, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Integration test for Rialto. |
| 16 | |
| 17 | use android_system_virtualizationservice::{ |
| 18 | aidl::android::system::virtualizationservice::{ |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 19 | VirtualMachineConfig::VirtualMachineConfig, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 20 | VirtualMachineRawConfig::VirtualMachineRawConfig, |
| 21 | }, |
| 22 | binder::{ParcelFileDescriptor, ProcessState}, |
| 23 | }; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 24 | use anyhow::{bail, Context, Result}; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 25 | use bssl_avf::{sha256, EcKey, EvpPKey}; |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 26 | use ciborium::value::Value; |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 27 | use client_vm_csr::generate_attestation_key_and_csr; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 28 | use coset::{CborSerializable, CoseMac0, CoseSign}; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 29 | use log::info; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 30 | use service_vm_comm::{ |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 31 | ClientVmAttestationParams, Csr, CsrPayload, EcdsaP256KeyPair, GenerateCertificateRequestParams, |
| 32 | Request, Response, VmType, |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 33 | }; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 34 | use service_vm_manager::ServiceVm; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 35 | use std::fs; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 36 | use std::fs::File; |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 37 | use std::io; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 38 | use std::panic; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 39 | use std::path::PathBuf; |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 40 | use vmclient::VmInstance; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 41 | use x509_parser::{ |
| 42 | certificate::X509Certificate, |
| 43 | der_parser::{der::parse_der, oid, oid::Oid}, |
| 44 | prelude::FromDer, |
| 45 | x509::{AlgorithmIdentifier, SubjectPublicKeyInfo, X509Version}, |
| 46 | }; |
Alice Wang | 4e082c3 | 2023-07-11 07:41:50 +0000 | [diff] [blame] | 47 | |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 48 | const UNSIGNED_RIALTO_PATH: &str = "/data/local/tmp/rialto_test/arm64/rialto_unsigned.bin"; |
| 49 | const INSTANCE_IMG_PATH: &str = "/data/local/tmp/rialto_test/arm64/instance.img"; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 50 | const TEST_CERT_CHAIN_PATH: &str = "testdata/rkp_cert_chain.der"; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 51 | |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 52 | #[test] |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 53 | fn process_requests_in_protected_vm() -> Result<()> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 54 | check_processing_requests(VmType::ProtectedVm) |
Alice Wang | 9a8b39f | 2023-04-12 15:31:48 +0000 | [diff] [blame] | 55 | } |
| 56 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 57 | #[test] |
| 58 | fn process_requests_in_non_protected_vm() -> Result<()> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 59 | check_processing_requests(VmType::NonProtectedVm) |
| 60 | } |
| 61 | |
| 62 | fn check_processing_requests(vm_type: VmType) -> Result<()> { |
| 63 | let mut vm = start_service_vm(vm_type)?; |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 64 | |
| 65 | check_processing_reverse_request(&mut vm)?; |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 66 | let key_pair = check_processing_generating_key_pair_request(&mut vm)?; |
| 67 | check_processing_generating_certificate_request(&mut vm, &key_pair.maced_public_key)?; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 68 | check_attestation_request(&mut vm, &key_pair)?; |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 69 | Ok(()) |
| 70 | } |
| 71 | |
| 72 | fn check_processing_reverse_request(vm: &mut ServiceVm) -> Result<()> { |
Alice Wang | 0486e25 | 2023-10-06 14:30:49 +0000 | [diff] [blame] | 73 | let message = "abc".repeat(500); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 74 | let request = Request::Reverse(message.as_bytes().to_vec()); |
| 75 | |
Alice Wang | fbdc85b | 2023-09-07 12:56:46 +0000 | [diff] [blame] | 76 | let response = vm.process_request(request)?; |
| 77 | info!("Received response: {response:?}."); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 78 | |
| 79 | let expected_response: Vec<u8> = message.as_bytes().iter().rev().cloned().collect(); |
| 80 | assert_eq!(Response::Reverse(expected_response), response); |
| 81 | Ok(()) |
| 82 | } |
| 83 | |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 84 | fn check_processing_generating_key_pair_request(vm: &mut ServiceVm) -> Result<EcdsaP256KeyPair> { |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 85 | let request = Request::GenerateEcdsaP256KeyPair; |
| 86 | |
| 87 | let response = vm.process_request(request)?; |
| 88 | info!("Received response: {response:?}."); |
| 89 | |
| 90 | match response { |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 91 | Response::GenerateEcdsaP256KeyPair(key_pair) => { |
| 92 | assert_array_has_nonzero(&key_pair.maced_public_key); |
| 93 | assert_array_has_nonzero(&key_pair.key_blob); |
| 94 | Ok(key_pair) |
Alice Wang | a78d3f0 | 2023-09-13 12:39:16 +0000 | [diff] [blame] | 95 | } |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 96 | _ => bail!("Incorrect response type: {response:?}"), |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 97 | } |
| 98 | } |
| 99 | |
Alice Wang | a78d3f0 | 2023-09-13 12:39:16 +0000 | [diff] [blame] | 100 | fn assert_array_has_nonzero(v: &[u8]) { |
| 101 | assert!(v.iter().any(|&x| x != 0)) |
| 102 | } |
| 103 | |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 104 | fn check_processing_generating_certificate_request( |
| 105 | vm: &mut ServiceVm, |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 106 | maced_public_key: &[u8], |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 107 | ) -> Result<()> { |
| 108 | let params = GenerateCertificateRequestParams { |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 109 | keys_to_sign: vec![maced_public_key.to_vec()], |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 110 | challenge: vec![], |
| 111 | }; |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 112 | let request = Request::GenerateCertificateRequest(params); |
| 113 | |
| 114 | let response = vm.process_request(request)?; |
| 115 | info!("Received response: {response:?}."); |
| 116 | |
| 117 | match response { |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 118 | Response::GenerateCertificateRequest(csr) => check_csr(csr), |
Alice Wang | ff5592d | 2023-09-13 15:27:39 +0000 | [diff] [blame] | 119 | _ => bail!("Incorrect response type: {response:?}"), |
Alice Wang | 9646fb3 | 2023-09-08 10:01:31 +0000 | [diff] [blame] | 120 | } |
| 121 | } |
| 122 | |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 123 | fn check_attestation_request( |
| 124 | vm: &mut ServiceVm, |
| 125 | remotely_provisioned_key_pair: &EcdsaP256KeyPair, |
| 126 | ) -> Result<()> { |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 127 | /// The following data was generated randomly with urandom. |
| 128 | const CHALLENGE: [u8; 16] = [ |
| 129 | 0x7d, 0x86, 0x58, 0x79, 0x3a, 0x09, 0xdf, 0x1c, 0xa5, 0x80, 0x80, 0x15, 0x2b, 0x13, 0x17, |
| 130 | 0x5c, |
| 131 | ]; |
| 132 | let dice_artifacts = diced_sample_inputs::make_sample_bcc_and_cdis()?; |
| 133 | let attestation_data = generate_attestation_key_and_csr(&CHALLENGE, &dice_artifacts)?; |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 134 | let cert_chain = fs::read(TEST_CERT_CHAIN_PATH)?; |
| 135 | let (remaining, cert) = X509Certificate::from_der(&cert_chain)?; |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 136 | |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 137 | // Builds the mock parameters for the client VM attestation. |
| 138 | // The `csr` and `remotely_provisioned_key_blob` parameters are extracted from the same |
| 139 | // libraries as in production. |
| 140 | // The `remotely_provisioned_cert` parameter is an RKP certificate extracted from a test |
| 141 | // certificate chain retrieved from RKPD. |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 142 | let params = ClientVmAttestationParams { |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 143 | csr: attestation_data.csr.clone().into_cbor_vec()?, |
| 144 | remotely_provisioned_key_blob: remotely_provisioned_key_pair.key_blob.to_vec(), |
| 145 | remotely_provisioned_cert: cert_chain[..(cert_chain.len() - remaining.len())].to_vec(), |
Alice Wang | de6bee5 | 2023-11-10 09:58:40 +0000 | [diff] [blame] | 146 | }; |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 147 | let request = Request::RequestClientVmAttestation(params); |
| 148 | |
| 149 | let response = vm.process_request(request)?; |
| 150 | info!("Received response: {response:?}."); |
| 151 | |
| 152 | match response { |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 153 | Response::RequestClientVmAttestation(certificate) => { |
| 154 | check_certificate_for_client_vm( |
| 155 | &certificate, |
| 156 | &remotely_provisioned_key_pair.maced_public_key, |
| 157 | &attestation_data.csr, |
| 158 | &cert, |
| 159 | )?; |
| 160 | Ok(()) |
| 161 | } |
Alice Wang | 74eb78b | 2023-11-09 16:13:10 +0000 | [diff] [blame] | 162 | _ => bail!("Incorrect response type: {response:?}"), |
| 163 | } |
| 164 | } |
| 165 | |
Alice Wang | 20b8ebc | 2023-11-17 09:54:47 +0000 | [diff] [blame] | 166 | fn check_certificate_for_client_vm( |
| 167 | certificate: &[u8], |
| 168 | maced_public_key: &[u8], |
| 169 | csr: &Csr, |
| 170 | parent_certificate: &X509Certificate, |
| 171 | ) -> Result<()> { |
| 172 | let cose_mac = CoseMac0::from_slice(maced_public_key)?; |
| 173 | let authority_public_key = EcKey::from_cose_public_key(&cose_mac.payload.unwrap()).unwrap(); |
| 174 | let (remaining, cert) = X509Certificate::from_der(certificate)?; |
| 175 | assert!(remaining.is_empty()); |
| 176 | |
| 177 | // Checks the certificate signature against the authority public key. |
| 178 | const ECDSA_WITH_SHA_256: Oid<'static> = oid!(1.2.840 .10045 .4 .3 .2); |
| 179 | let expected_algorithm = |
| 180 | AlgorithmIdentifier { algorithm: ECDSA_WITH_SHA_256, parameters: None }; |
| 181 | assert_eq!(expected_algorithm, cert.signature_algorithm); |
| 182 | let digest = sha256(cert.tbs_certificate.as_ref()).unwrap(); |
| 183 | authority_public_key |
| 184 | .ecdsa_verify(cert.signature_value.as_ref(), &digest) |
| 185 | .expect("Failed to verify the certificate signature with the authority public key"); |
| 186 | |
| 187 | // Checks that the certificate's subject public key is equal to the key in the CSR. |
| 188 | let cose_sign = CoseSign::from_slice(&csr.signed_csr_payload)?; |
| 189 | let csr_payload = |
| 190 | cose_sign.payload.as_ref().and_then(|v| CsrPayload::from_cbor_slice(v).ok()).unwrap(); |
| 191 | let subject_public_key = EcKey::from_cose_public_key(&csr_payload.public_key).unwrap(); |
| 192 | let expected_spki_data = |
| 193 | EvpPKey::try_from(subject_public_key).unwrap().subject_public_key_info().unwrap(); |
| 194 | let (remaining, expected_spki) = SubjectPublicKeyInfo::from_der(&expected_spki_data)?; |
| 195 | assert!(remaining.is_empty()); |
| 196 | assert_eq!(&expected_spki, cert.public_key()); |
| 197 | |
| 198 | // Checks the certificate extension. |
| 199 | const ATTESTATION_EXTENSION_OID: Oid<'static> = oid!(1.3.6 .1 .4 .1 .11129 .2 .1 .29 .1); |
| 200 | let extensions = cert.extensions(); |
| 201 | assert_eq!(1, extensions.len()); |
| 202 | let extension = &extensions[0]; |
| 203 | assert_eq!(ATTESTATION_EXTENSION_OID, extension.oid); |
| 204 | assert!(!extension.critical); |
| 205 | let (remaining, extension) = parse_der(extension.value)?; |
| 206 | assert!(remaining.is_empty()); |
| 207 | let attestation_ext = extension.as_sequence()?; |
| 208 | assert_eq!(1, attestation_ext.len()); |
| 209 | assert_eq!(csr_payload.challenge, attestation_ext[0].as_slice()?); |
| 210 | |
| 211 | // Checks other fields on the certificate |
| 212 | assert_eq!(X509Version::V3, cert.version()); |
| 213 | assert_eq!(parent_certificate.validity(), cert.validity()); |
| 214 | assert_eq!( |
| 215 | String::from("CN=Android Protected Virtual Machine Key"), |
| 216 | cert.subject().to_string() |
| 217 | ); |
| 218 | assert_eq!(parent_certificate.subject(), cert.issuer()); |
| 219 | |
| 220 | Ok(()) |
| 221 | } |
| 222 | |
Alice Wang | f7c0f94 | 2023-09-14 09:33:04 +0000 | [diff] [blame] | 223 | /// TODO(b/300625792): Check the CSR with libhwtrust once the CSR is complete. |
| 224 | fn check_csr(csr: Vec<u8>) -> Result<()> { |
| 225 | let mut reader = io::Cursor::new(csr); |
| 226 | let csr: Value = ciborium::from_reader(&mut reader)?; |
| 227 | match csr { |
| 228 | Value::Array(arr) => { |
| 229 | assert_eq!(4, arr.len()); |
| 230 | } |
| 231 | _ => bail!("Incorrect CSR format: {csr:?}"), |
| 232 | } |
| 233 | Ok(()) |
| 234 | } |
| 235 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 236 | fn start_service_vm(vm_type: VmType) -> Result<ServiceVm> { |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 237 | android_logger::init_once( |
| 238 | android_logger::Config::default().with_tag("rialto").with_min_level(log::Level::Debug), |
| 239 | ); |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 240 | // Redirect panic messages to logcat. |
| 241 | panic::set_hook(Box::new(|panic_info| { |
| 242 | log::error!("{}", panic_info); |
| 243 | })); |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 244 | // We need to start the thread pool for Binder to work properly, especially link_to_death. |
| 245 | ProcessState::start_thread_pool(); |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 246 | ServiceVm::start_vm(vm_instance(vm_type)?, vm_type) |
Alice Wang | 17dc76e | 2023-09-06 09:43:52 +0000 | [diff] [blame] | 247 | } |
| 248 | |
Alice Wang | e910b90 | 2023-09-07 10:35:12 +0000 | [diff] [blame] | 249 | fn vm_instance(vm_type: VmType) -> Result<VmInstance> { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 250 | match vm_type { |
Alice Wang | 1d9a587 | 2023-09-06 14:32:36 +0000 | [diff] [blame] | 251 | VmType::ProtectedVm => { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 252 | service_vm_manager::protected_vm_instance(PathBuf::from(INSTANCE_IMG_PATH)) |
Alice Wang | 1d9a587 | 2023-09-06 14:32:36 +0000 | [diff] [blame] | 253 | } |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 254 | VmType::NonProtectedVm => nonprotected_vm_instance(), |
| 255 | } |
| 256 | } |
| 257 | |
| 258 | fn nonprotected_vm_instance() -> Result<VmInstance> { |
| 259 | let rialto = File::open(UNSIGNED_RIALTO_PATH).context("Failed to open Rialto kernel binary")?; |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 260 | let config = VirtualMachineConfig::RawConfig(VirtualMachineRawConfig { |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 261 | name: String::from("Non protected rialto"), |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 262 | bootloader: Some(ParcelFileDescriptor::new(rialto)), |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 263 | protectedVm: false, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 264 | memoryMib: 300, |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 265 | platformVersion: "~1.0".to_string(), |
Inseob Kim | 6ef8097 | 2023-07-20 17:23:36 +0900 | [diff] [blame] | 266 | ..Default::default() |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 267 | }); |
Alice Wang | a635769 | 2023-09-07 14:59:37 +0000 | [diff] [blame] | 268 | let console = Some(service_vm_manager::android_log_fd()?); |
| 269 | let log = Some(service_vm_manager::android_log_fd()?); |
| 270 | let virtmgr = vmclient::VirtualizationService::new().context("Failed to spawn VirtMgr")?; |
| 271 | let service = virtmgr.connect().context("Failed to connect to VirtMgr")?; |
| 272 | info!("Connected to VirtMgr for service VM"); |
| 273 | VmInstance::create(service.as_ref(), &config, console, /* consoleIn */ None, log, None) |
| 274 | .context("Failed to create VM") |
David Brazdil | 66fc120 | 2022-07-04 21:48:45 +0100 | [diff] [blame] | 275 | } |