1 /*
2  * Copyright (C) 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 /**
18  * This app tests the API in app/keymaster/secure_storage_manager.h. To run this
19  * test, include trusty/user/app/keymaster/device_unittest in
20  * TRUSTY_ALL_USER_TASKS, and it will be start once an RPMB proxy becomes
21  * available.
22  *
23  * Different application has different namespace, so this would not affect the
24  * keymaster app's RPMB storage.
25  */
26 
27 #include <assert.h>
28 #include <malloc.h>
29 #include <stdio.h>
30 #include <string.h>
31 
32 #define typeof(x) __typeof__(x)
33 #include <lib/storage/storage.h>
34 #include <lib/unittest/unittest.h>
35 #include <trusty_unittest.h>
36 
37 #include <keymaster/UniquePtr.h>
38 #include <keymaster/android_keymaster_utils.h>
39 #include "second_imei_attestation.h"
40 #include "secure_storage_manager.h"
41 
42 #include "trusty_logger.h"
43 
44 #define DATA_SIZE 1000
45 #define CHAIN_LENGTH 3
46 
47 #define TLOG_TAG "km_storage_test"
48 
49 using keymaster::AttestationKeySlot;
50 using keymaster::calculate_luhn_checksum_digit;
51 using keymaster::CertificateChain;
52 using keymaster::kAttestationUuidSize;
53 using keymaster::KeymasterKeyBlob;
54 using keymaster::kProductIdSize;
55 using keymaster::SecureStorageManager;
56 using keymaster::validate_second_imei;
57 
NewRandBuf(uint32_t size)58 uint8_t* NewRandBuf(uint32_t size) {
59     uint8_t* buf = new uint8_t[size];
60     if (buf == nullptr) {
61         return nullptr;
62     }
63     for (uint8_t* i = buf;
64          reinterpret_cast<size_t>(i) < reinterpret_cast<size_t>(buf) + size;
65          i++) {
66         *i = static_cast<uint8_t>(rand() % UINT8_MAX);
67     }
68     return buf;
69 }
70 
TestKeyStorage(SecureStorageManager * ss_manager,AttestationKeySlot key_slot)71 void TestKeyStorage(SecureStorageManager* ss_manager,
72                     AttestationKeySlot key_slot) {
73     keymaster_error_t error = KM_ERROR_OK;
74     keymaster::UniquePtr<uint8_t[]> write_key;
75     KeymasterKeyBlob key_blob;
76     bool key_exists = false;
77 
78     write_key.reset(NewRandBuf(DATA_SIZE));
79     ASSERT_NE(nullptr, write_key.get());
80 
81     error = ss_manager->WriteKeyToStorage(key_slot, write_key.get(), DATA_SIZE);
82     ASSERT_EQ(KM_ERROR_OK, error);
83 
84     key_blob = ss_manager->ReadKeyFromStorage(key_slot, &error);
85     ASSERT_EQ(KM_ERROR_OK, error);
86     ASSERT_EQ(DATA_SIZE, key_blob.key_material_size);
87     ASSERT_NE(nullptr, write_key.get());
88     ASSERT_NE(nullptr, key_blob.key_material);
89     ASSERT_EQ(0, memcmp(write_key.get(), key_blob.key_material, DATA_SIZE));
90 
91     error = ss_manager->AttestationKeyExists(key_slot, &key_exists);
92     ASSERT_EQ(KM_ERROR_OK, error);
93     ASSERT_EQ(true, key_exists);
94 
95 test_abort:;
96 }
97 
TestCertChainStorage(SecureStorageManager * ss_manager,AttestationKeySlot key_slot,bool chain_exists)98 void TestCertChainStorage(SecureStorageManager* ss_manager,
99                           AttestationKeySlot key_slot,
100                           bool chain_exists) {
101     keymaster_error_t error = KM_ERROR_OK;
102     keymaster::UniquePtr<uint8_t[]> write_cert[CHAIN_LENGTH];
103     unsigned int i = 0;
104     uint32_t cert_chain_length;
105     CertificateChain chain;
106 
107     for (i = 0; i < CHAIN_LENGTH; ++i) {
108         write_cert[i].reset(NewRandBuf(DATA_SIZE));
109         ASSERT_NE(nullptr, write_cert[i].get());
110 
111         error = ss_manager->WriteCertToStorage(key_slot, write_cert[i].get(),
112                                                DATA_SIZE, i);
113         ASSERT_EQ(KM_ERROR_OK, error);
114 
115         error = ss_manager->ReadCertChainLength(key_slot, &cert_chain_length);
116         ASSERT_EQ(KM_ERROR_OK, error);
117         if (chain_exists) {
118             ASSERT_EQ(3, cert_chain_length);
119         } else {
120             ASSERT_EQ(i + 1, cert_chain_length);
121         }
122     }
123 
124     error = ss_manager->ReadCertChainFromStorage(key_slot, &chain);
125     ASSERT_EQ(KM_ERROR_OK, error);
126     ASSERT_EQ(CHAIN_LENGTH, chain.entry_count);
127     for (i = 0; i < CHAIN_LENGTH; ++i) {
128         ASSERT_EQ(DATA_SIZE, chain.entries[i].data_length);
129         ASSERT_EQ(0, memcmp(write_cert[i].get(), chain.entries[i].data,
130                             DATA_SIZE));
131     }
132 
133 test_abort:;
134 }
135 
TestCertStorageInvalid(SecureStorageManager * ss_manager,AttestationKeySlot key_slot)136 void TestCertStorageInvalid(SecureStorageManager* ss_manager,
137                             AttestationKeySlot key_slot) {
138     keymaster_error_t error = KM_ERROR_OK;
139     keymaster::UniquePtr<uint8_t[]> write_cert;
140     uint32_t cert_chain_length;
141 
142     // Clear existing certificate chain
143     error = ss_manager->DeleteKey(key_slot, true);
144     error = ss_manager->ReadCertChainLength(key_slot, &cert_chain_length);
145     ASSERT_EQ(KM_ERROR_OK, error);
146     ASSERT_EQ(0, cert_chain_length);
147 
148     // Try to write to index (chain_length + 1)
149     write_cert.reset(NewRandBuf(DATA_SIZE));
150     ASSERT_NE(nullptr, write_cert.get());
151     error = ss_manager->WriteCertToStorage(key_slot, write_cert.get(),
152                                            DATA_SIZE, 1);
153     ASSERT_EQ(KM_ERROR_INVALID_ARGUMENT, error);
154 
155     // Verify that cert chain length didn't change
156     error = ss_manager->ReadCertChainLength(key_slot, &cert_chain_length);
157     ASSERT_EQ(KM_ERROR_OK, error);
158     ASSERT_EQ(0, cert_chain_length);
159 
160 test_abort:;
161 }
162 
DeleteAttestationData(SecureStorageManager * ss_manager)163 void DeleteAttestationData(SecureStorageManager* ss_manager) {
164     keymaster_error_t error = KM_ERROR_OK;
165     uint32_t cert_chain_length;
166     bool key_exists;
167 
168     error = ss_manager->DeleteAllAttestationData();
169     ASSERT_EQ(KM_ERROR_OK, error);
170 
171     error = ss_manager->ReadCertChainLength(AttestationKeySlot::kRsa,
172                                             &cert_chain_length);
173     ASSERT_EQ(KM_ERROR_OK, error);
174     ASSERT_EQ(0, cert_chain_length);
175     error = ss_manager->ReadCertChainLength(AttestationKeySlot::kEcdsa,
176                                             &cert_chain_length);
177     ASSERT_EQ(KM_ERROR_OK, error);
178     ASSERT_EQ(0, cert_chain_length);
179 
180     error = ss_manager->AttestationKeyExists(AttestationKeySlot::kRsa,
181                                              &key_exists);
182     ASSERT_EQ(KM_ERROR_OK, error);
183     ASSERT_EQ(false, key_exists);
184     error = ss_manager->AttestationKeyExists(AttestationKeySlot::kEcdsa,
185                                              &key_exists);
186     ASSERT_EQ(KM_ERROR_OK, error);
187     ASSERT_EQ(false, key_exists);
188 
189 test_abort:;
190 }
191 
TestUuidStorage(SecureStorageManager * ss_manager)192 void TestUuidStorage(SecureStorageManager* ss_manager) {
193     keymaster_error_t error = KM_ERROR_OK;
194     keymaster::UniquePtr<uint8_t[]> write_uuid;
195     keymaster::UniquePtr<uint8_t[]> read_uuid(
196             new uint8_t[kAttestationUuidSize]);
197 
198     error = ss_manager->DeleteAttestationUuid();
199     ASSERT_EQ(KM_ERROR_OK, error);
200 
201     write_uuid.reset(NewRandBuf(kAttestationUuidSize));
202     ASSERT_NE(nullptr, write_uuid.get());
203 
204     error = ss_manager->WriteAttestationUuid((const uint8_t*)write_uuid.get());
205     ASSERT_EQ(KM_ERROR_OK, error);
206 
207     error = ss_manager->ReadAttestationUuid(read_uuid.get());
208     ASSERT_EQ(KM_ERROR_OK, error);
209     ASSERT_NE(nullptr, read_uuid.get());
210     ASSERT_EQ(0, memcmp(write_uuid.get(), read_uuid.get(), kProductIdSize));
211 
212     error = ss_manager->DeleteAttestationUuid();
213     ASSERT_EQ(KM_ERROR_OK, error);
214 
215 test_abort:;
216 }
217 
TestProductIdStorage(SecureStorageManager * ss_manager)218 void TestProductIdStorage(SecureStorageManager* ss_manager) {
219     keymaster_error_t error = KM_ERROR_OK;
220     keymaster::UniquePtr<uint8_t[]> write_productid;
221     keymaster::UniquePtr<uint8_t[]> read_productid(new uint8_t[kProductIdSize]);
222 
223     error = ss_manager->DeleteProductId();
224     ASSERT_EQ(KM_ERROR_OK, error);
225 
226     write_productid.reset(NewRandBuf(kProductIdSize));
227     ASSERT_NE(nullptr, write_productid.get());
228 
229     error = ss_manager->SetProductId((const uint8_t*)write_productid.get());
230     ASSERT_EQ(KM_ERROR_OK, error);
231 
232     error = ss_manager->ReadProductId(read_productid.get());
233     ASSERT_EQ(KM_ERROR_OK, error);
234     ASSERT_NE(nullptr, read_productid.get());
235     ASSERT_EQ(0, memcmp(write_productid.get(), read_productid.get(),
236                         kProductIdSize));
237 
238     error = ss_manager->DeleteProductId();
239     ASSERT_EQ(KM_ERROR_OK, error);
240 
241 test_abort:;
242 }
243 
TestProductIdStoragePreventOverwrite(SecureStorageManager * ss_manager)244 void TestProductIdStoragePreventOverwrite(SecureStorageManager* ss_manager) {
245     keymaster_error_t error = KM_ERROR_OK;
246     keymaster::UniquePtr<uint8_t[]> write_productid;
247     keymaster::UniquePtr<uint8_t[]> overwrite_productid;
248     keymaster::UniquePtr<uint8_t[]> read_productid(new uint8_t[kProductIdSize]);
249 
250     error = ss_manager->DeleteProductId();
251     ASSERT_EQ(KM_ERROR_OK, error);
252 
253     write_productid.reset(NewRandBuf(kProductIdSize));
254     ASSERT_NE(nullptr, write_productid.get());
255 
256     error = ss_manager->SetProductId((const uint8_t*)write_productid.get());
257     ASSERT_EQ(KM_ERROR_OK, error);
258 
259     overwrite_productid.reset(NewRandBuf(kProductIdSize));
260     error = ss_manager->SetProductId((const uint8_t*)write_productid.get());
261     ASSERT_EQ(KM_ERROR_INVALID_ARGUMENT, error);
262 
263     error = ss_manager->ReadProductId(read_productid.get());
264     ASSERT_EQ(KM_ERROR_OK, error);
265     ASSERT_NE(nullptr, read_productid.get());
266     ASSERT_EQ(0, memcmp(write_productid.get(), read_productid.get(),
267                         kProductIdSize));
268 
269     error = ss_manager->DeleteProductId();
270     ASSERT_EQ(KM_ERROR_OK, error);
271 
272 test_abort:;
273 }
274 
TestLuhnChecksumCalculation()275 void TestLuhnChecksumCalculation() {
276     ASSERT_EQ(0u, calculate_luhn_checksum_digit(0));
277     ASSERT_EQ(3, calculate_luhn_checksum_digit(7992739871ul));
278     ASSERT_EQ(3, calculate_luhn_checksum_digit(7992739871ul));
279     ASSERT_EQ(6, calculate_luhn_checksum_digit(735423462345ul));
280     ASSERT_EQ(4, calculate_luhn_checksum_digit(721367498765427ul));
281 test_abort:;
282 }
283 
toBlob(const char * str)284 keymaster_blob_t toBlob(const char* str) {
285     return {reinterpret_cast<const uint8_t*>(str), strlen(str)};
286 }
287 
TestSecondImeiValidation()288 void TestSecondImeiValidation() {
289     // First IMEI used throughout the test
290     const uint64_t first_imei = 721367498765404;
291     // Sequential IMEI
292     const char* second_imei = "721367498765412";
293     // Valid IMEI, but not a sequential one
294     const char* second_imei_not_seq = "721367498765420";
295     // Invalid IMEI, not a sequential one.
296     const char* invalid_imei = "721367498765437";
297     // Invalid IMEI: Sequential to first_imei but the checksum digit is wrong.
298     const char* invalid_seq_imei = "721367498765415";
299     ASSERT_EQ(true, validate_second_imei(toBlob(second_imei), first_imei));
300 
301     ASSERT_EQ(false,
302               validate_second_imei(toBlob(second_imei_not_seq), first_imei));
303     ASSERT_EQ(false, validate_second_imei(toBlob(invalid_imei), first_imei));
304     ASSERT_EQ(false,
305               validate_second_imei(toBlob(invalid_seq_imei), first_imei));
306 test_abort:;
307 }
308 
309 typedef struct {
310     SecureStorageManager* ss_manager;
311 } KeymasterTest_t;
312 
KeymasterTest_SetUp(KeymasterTest_t * state)313 static void KeymasterTest_SetUp(KeymasterTest_t* state) {
314     state->ss_manager = SecureStorageManager::get_instance();
315 
316     DeleteAttestationData(state->ss_manager);
317 }
318 
KeymasterTest_TearDown(KeymasterTest_t * state)319 static void KeymasterTest_TearDown(KeymasterTest_t* state) {
320     DeleteAttestationData(state->ss_manager);
321 }
322 
TEST_F(KeymasterTest,TestKeyStorageRsa)323 TEST_F(KeymasterTest, TestKeyStorageRsa) {
324     TestKeyStorage(_state->ss_manager, AttestationKeySlot::kRsa);
325 }
326 
TEST_F(KeymasterTest,TestKeyStorageEcdsa)327 TEST_F(KeymasterTest, TestKeyStorageEcdsa) {
328     TestKeyStorage(_state->ss_manager, AttestationKeySlot::kEcdsa);
329 }
330 
TEST_F(KeymasterTest,TestCertChainStorageRsa)331 TEST_F(KeymasterTest, TestCertChainStorageRsa) {
332     TestCertChainStorage(_state->ss_manager, AttestationKeySlot::kRsa, false);
333 }
334 
TEST_F(KeymasterTest,TestCertChainStorageEcdsa)335 TEST_F(KeymasterTest, TestCertChainStorageEcdsa) {
336     TestCertChainStorage(_state->ss_manager, AttestationKeySlot::kEcdsa, false);
337 }
338 
TEST_F(KeymasterTest,TestRewriteKey)339 TEST_F(KeymasterTest, TestRewriteKey) {
340     TestKeyStorage(_state->ss_manager, AttestationKeySlot::kRsa);
341     // Rewriting keys should work
342     TestKeyStorage(_state->ss_manager, AttestationKeySlot::kRsa);
343 }
344 
TEST_F(KeymasterTest,TestRewriteChain)345 TEST_F(KeymasterTest, TestRewriteChain) {
346     TestCertChainStorage(_state->ss_manager, AttestationKeySlot::kRsa, false);
347     TestCertChainStorage(_state->ss_manager, AttestationKeySlot::kRsa, true);
348 }
349 
TEST_F(KeymasterTest,TestCertStorageInvalid)350 TEST_F(KeymasterTest, TestCertStorageInvalid) {
351     TestCertStorageInvalid(_state->ss_manager, AttestationKeySlot::kRsa);
352 }
353 
TEST_F(KeymasterTest,TestUuidStorage)354 TEST_F(KeymasterTest, TestUuidStorage) {
355     TestUuidStorage(_state->ss_manager);
356 }
357 
TEST_F(KeymasterTest,TestProductIdStorage)358 TEST_F(KeymasterTest, TestProductIdStorage) {
359     TestProductIdStorage(_state->ss_manager);
360 }
361 
TEST_F(KeymasterTest,TestLuhnChecksumCalculation)362 TEST_F(KeymasterTest, TestLuhnChecksumCalculation) {
363     TestLuhnChecksumCalculation();
364 }
365 
TEST_F(KeymasterTest,TestSecondImeiValidation)366 TEST_F(KeymasterTest, TestSecondImeiValidation) {
367     TestSecondImeiValidation();
368 }
369 
370 #ifndef KEYMASTER_DEBUG
TEST_F(KeymasterTest,TestProductIdStoragePreventOverwrite)371 TEST_F(KeymasterTest, TestProductIdStoragePreventOverwrite) {
372     TestProductIdStoragePreventOverwrite(_state->ss_manager);
373 }
374 #endif
375 
keymaster_test(struct unittest * test)376 static bool keymaster_test(struct unittest* test) {
377     return RUN_ALL_TESTS();
378 }
379 
380 #define PORT_BASE "com.android.keymaster-unittest"
381 
main(void)382 int main(void) {
383     keymaster::TrustyLogger::initialize();
384 
385     struct unittest keymaster_unittest = {
386             .port_name = PORT_BASE,
387             .run_test = keymaster_test,
388     };
389     struct unittest* keymaster_unittest_p = &keymaster_unittest;
390     return unittest_main(&keymaster_unittest_p, 1);
391 }
392