commit 4244d01c84bc8e4f112d27c490558336c8090ff6
author Karuna Wadhera <kwadhera@google.com> Wed Sep 04 14:41:07 2024 +0000
committer Cherrypicker Worker <android-build-cherrypicker-worker@google.com> Tue Sep 10 17:02:36 2024 +0000
tree 624937d014aec3e46f0a629ea8b2944b3f90e2d0
parent 50ad48020025c0a3552fbb1c701a9d3b73e33beb

Add an option to allow/disallow degenerate DICE chains

Bug: 323246910
Test: Manual testing of `rkp_factory_extraction_tool` with/without
 `allow_degenerate=false` on a device with a degenerate DICE chain.
(cherry picked from https://android-review.googlesource.com/q/commit:fbfc9399d4e521d9ee83db1dc5db75b53320e0ef)
Merged-In: I69475209174cd8870bc0e3a8e52d325b6414d7a6
Change-Id: I69475209174cd8870bc0e3a8e52d325b6414d7a6

provisioner/rkp_factory_extraction_lib.cpp

diff --git a/provisioner/rkp_factory_extraction_lib.cpp b/provisioner/rkp_factory_extraction_lib.cpp
index ec70d08..2c2614d 100644
--- a/provisioner/rkp_factory_extraction_lib.cpp
+++ b/provisioner/rkp_factory_extraction_lib.cpp
@@ -224,7 +224,8 @@
 }
 
 CborResult<cppbor::Array> getCsrV3(std::string_view componentName,
-                                   IRemotelyProvisionedComponent* irpc, bool selfTest) {
+                                   IRemotelyProvisionedComponent* irpc, bool selfTest,
+                                   bool allowDegenerate) {
     std::vector<uint8_t> csr;
     std::vector<MacedPublicKey> emptyKeys;
     const std::vector<uint8_t> challenge = generateChallenge();
@@ -237,7 +238,8 @@
     }
 
     if (selfTest) {
-        auto result = verifyFactoryCsr(/*keysToSign=*/cppbor::Array(), csr, irpc, challenge);
+        auto result =
+            verifyFactoryCsr(/*keysToSign=*/cppbor::Array(), csr, irpc, challenge, allowDegenerate);
         if (!result) {
             std::cerr << "Self test failed for IRemotelyProvisionedComponent '" << componentName
                       << "'. Error message: '" << result.message() << "'." << std::endl;
@@ -249,7 +251,7 @@
 }
 
 CborResult<Array> getCsr(std::string_view componentName, IRemotelyProvisionedComponent* irpc,
-                         bool selfTest) {
+                         bool selfTest, bool allowDegenerate) {
     RpcHardwareInfo hwInfo;
     auto status = irpc->getHardwareInfo(&hwInfo);
     if (!status.isOk()) {
@@ -264,7 +266,7 @@
         }
         return getCsrV1(componentName, irpc);
     } else {
-        return getCsrV3(componentName, irpc, selfTest);
+        return getCsrV3(componentName, irpc, selfTest, allowDegenerate);
     }
 }