1 /*
2 * Copyright (c) 2021, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <gtest/gtest.h>
18 #include <optional>
19 #include <string>
20 #include <vector>
21
22 #include "FakeSecureHardwareProxy.h"
23
24 // Most of libeic is tested as part of VTS since there's almost a 1:1 mapping between
25 // the HAL and libeic interfaces. This test suite is mainly for the few things which
26 // doesn't map directly.
27 //
28
29 using std::optional;
30 using std::string;
31 using std::vector;
32
33 using android::hardware::identity::AccessCheckResult;
34 using android::hardware::identity::FakeSecureHardwarePresentationProxy;
35 using android::hardware::identity::FakeSecureHardwareProvisioningProxy;
36
TEST(EicTest,AccessControlIsEnforced)37 TEST(EicTest, AccessControlIsEnforced) {
38 // First provision the credential...
39 //
40 FakeSecureHardwareProvisioningProxy provisioningProxy;
41 bool isTestCredential = false;
42 provisioningProxy.initialize(isTestCredential);
43 optional<vector<uint8_t>> credKey =
44 provisioningProxy.createCredentialKey({0x01, 0x02}, {0x03, 0x04});
45 ASSERT_TRUE(credKey.has_value());
46 string docType = "org.iso.18013.5.1.mDL";
47 ASSERT_TRUE(provisioningProxy.startPersonalization(0, {1}, docType, 125));
48
49 vector<int> acpIds = {};
50 string nameSpace = "org.iso.18013.5.1";
51 string name = "NonAccessibleElement";
52 vector<uint8_t> content = {0x63, 0x46, 0x6f, 0x6f}; // "Foo" tstr
53 ASSERT_TRUE(provisioningProxy.beginAddEntry(acpIds, nameSpace, name, content.size()));
54 optional<vector<uint8_t>> encContent =
55 provisioningProxy.addEntryValue(acpIds, nameSpace, name, content);
56 ASSERT_TRUE(encContent.has_value());
57 ASSERT_EQ(encContent->size(), content.size() + 28);
58
59 optional<vector<uint8_t>> signatureOfToBeSigned = provisioningProxy.finishAddingEntries();
60 ASSERT_TRUE(signatureOfToBeSigned.has_value());
61
62 optional<vector<uint8_t>> credData = provisioningProxy.finishGetCredentialData(docType);
63 ASSERT_TRUE(credData.has_value());
64 ASSERT_TRUE(provisioningProxy.shutdown());
65
66 // Then present data from it...
67 //
68 FakeSecureHardwarePresentationProxy presentationProxy;
69 ASSERT_TRUE(presentationProxy.initialize(0 /* sessionId */, isTestCredential, docType,
70 credData.value()));
71 AccessCheckResult res =
72 presentationProxy.startRetrieveEntryValue(nameSpace, name, 1, content.size(), acpIds);
73 ASSERT_EQ(res, AccessCheckResult::kNoAccessControlProfiles);
74
75 // Ensure that we can't get the data out if startRetrieveEntryValue() returned
76 // something other than kOk... See b/190757775 for details.
77 //
78 optional<vector<uint8_t>> decContent =
79 presentationProxy.retrieveEntryValue(encContent.value(), nameSpace, name, acpIds);
80 ASSERT_FALSE(decContent.has_value());
81 }
82
main(int argc,char ** argv)83 int main(int argc, char** argv) {
84 ::testing::InitGoogleTest(&argc, argv);
85 return RUN_ALL_TESTS();
86 }
87