Allows testing of secret persistence across reboot (and non-persistence
across factory reset).
Move some test code into a library for re-use.
Test: Manual
Change-Id: I23772692d2de652f6d4a8e5659186bd9c1c06b72
ConstraintSpec constructor will take enum instead of boolean for missing
action.
Test: atest VtsSecretkeeperTargetTest
Bug: 291213394
Change-Id: I55fb0d8ef1fccca5feedf1fd368854ffb7eafaaf
1. Add a test to check Access control in Secretkeeper HAL: Construct
dice chains with different security version and check that the secret
is accessible with upgraded dice chain && DicePolicyError is thrown
when the access is requested using a dice chain with lower security
version.
2. Re-enable test #replay_protection_out_of_seq_req_not_accepted - This
was disabled because the method would not panic when run on
devices without Sk HAL, causing test failure. Refactor the test to
check the error instead of unwrapping.
Many methods of SkClient struct are refactored to return Error (also
introduced in this patch) instead of panicking on error.
Test: atest VtsSecretkeeperTargetTest
Bug: 291224769
Bug: 317416663
Change-Id: I646783e034064f81625a978a2bcacf143ff60c87
Change the spec for DiceCertChainInitialPayload, removing the map &
directly equating it to bstr .cbor PubKey. Also mandate it to stick to
Core Deterministic Encoding Requirements. The deterministic encoding is
essential to ensure DicePolicies can be applied on the root key.
Test: Builds
Bug: 319613231
Change-Id: I5e12ecbcbae84ae608d784a12f8ae4afc49b5a9d
VTS (being the client of Sk) will use dice_chain as the identity.
Consequently we can use the sealing policy constructed out of this
identity & no more need to use HYPOTHETICAL_DICE_POLICY hack.
For sample identity, we create dice_sample module which constructs an
example dice chain (in Explicit key chain format), along with secrets.
Test: Secretkeeper VTS
Bug: 291224769
Change-Id: Ia1d1a92391d3ee455bf9fe254770b4a9bd08cb12
NewApi is a lint check that you don't call framework methods that were
introduced in versions later than your min_sdk_version. We want to
make this an error, so we're baselineing all existing issues.
This cl was generated automatically, by taking all the NewApi issues
from the reference baselines, and all the non-NewApi issues from the
existing checked in baselines.
Bug: 268261262
Test: Presubmits
Change-Id: I3e4bcd76bad422513d48712303ce5c857511d9be
As we make Dice policy work with explicit key format of dice chain, the
hard coded policy needs to change to be compatible with hard coded
explicit key chain in the TA.
Test: VTS
Bug: 291213394
Change-Id: Ib3740d8f12f0a5f4e680bd215170bc96596fbe06
Use rdroidtest for running tests as it now supports parameterized
tests (aosp/2885268) and has an attribute macro (aosp/2890086).
Also rustfmt.
Test: VtsSecretkeeperTargetTest
Change-Id: I9570a7f33a6ff7dbf7cb7238fa3770dedb990e8c
This test does not account for potentially missing Sk HAL. Ideally, the
test should pass on those devices too (since Sk is an optional HAL at
the moment).
This test uses should_panic expecting the client code to panic on
processing the message, but that code is never executed because the
backend is not present & the method doesn't panic & the test fails.
As a mitigation, #ignore the test.
Bug: 317416663
Test: VTS show "IGNORED"
Change-Id: I2f1bb45361943f22d8cadc929059c65cb3120f3f
SecretId is a parameter in deleteIds() method, which will be invoked by
host (Android). Restrict the size to 64 bytes to avoid unnecessarily
large bytes making it to HAL & TA.
Test: atest VtsSecretkeeperTargetTest
Bug: 317374882
Change-Id: Ieb34fee4efd11636bee133fe9132c1d739d08a1c
Various small wording changes to attempt to clarify some of the
details of the Secretkeeper API.
While I'm here: fix error code naming inconsistency.
Bug: 291224769
Test: N/A
Change-Id: I956b549bc5bf4d2b964dde9867430cb4778e445b
Add test coverage for replay protection in Secretkeeper. Test that:
1. Sk implementation encrypts/decrypts messages using correct
sequence_numbers.
2. Out of order messages are not accepted.
3. The sequence numbers are per-connection ie, new SeqNum is used for a
fresh connection.
Also, refactor code. SeqNumbers are maintained by
libsecretkeeper_client. Have sk_client use a handle to SkSession for
SecretManagement requests. Replay protection tests however require more
fine grained control of SeqNums. For these we have introduced
`secret_management_request_custom_aad()` method.
Bug: 316126411
Test: atest VtsSecretkeeperTargetTest
Change-Id: I385856c04e185d2b300d59a1b54cb8f09cbf836f
Introduce sequence number in Secretkeeper packets to prevent replay of
packets with a session.
Bug: 316126411
Test: VTS
Change-Id: I20a5d8489e988bdcbe9058495ab56ed18a07b946
Calling binder::get_interface(name) for a name that isn't declared may
take multiple seconds before failing. Restrict to looking for instance
names that are declared.
Also add a rustfmt.toml file, copied from system/secretkeeper/
Bug: 291228655
Test: VtsSecretkeeperTargetTest on Cuttlefish and Pixel8
Change-Id: I9972bc782fe99f5dc5c2dc3b74fa12a0e000ea6c
When a LocalTa instance is used in a fuzzer, it gets dropped at the end
of processing each fuzz input. This makes the `mpsc::channel`s fail,
so update to cope with this.
Bug: 316075932
Test: run fuzzer on Cuttlefish
Change-Id: I069f441013e269f652cbe1ff3053606f9bcb2dfd
Move nonsecure implementation code out of main.rs and into a new
secretkeeper_nonsecure library, to allow re-use in both the nonsecure
service and the new fuzzer.
The fuzzer drops the `LocalTa` instance on each input, so adjust the
error path to cope with this happening (the channels will fail).
Test: build, fuzz
Bug: 291228655
Change-Id: Ibe2ca5db9a9c8eed129ac5a90de85b933ab256a0
- Look for either /default or /nonsecure instances.
- Only run a `deleteAll()` test on a /nonsecure instance.
- Delete IDs on client drop to ensure a consistent state.
- Use a config that ensures tests are run single-threaded, to ensure a
consistent state.
- Shift to using types not raw arrays.
- Add a macro for common test setup.
- Add helper methods to reduce the amount of copy-pasta in the VTS
tests.
- Use these helpers to create some additional tests.
Test: VtsSecretkeeperTargetTest
Bug: 291224769
Change-Id: Icff0bba1bcdd66b18398ed4b64ebd2c6bc0de7e7
Also move error codes from separate `ErrorCode.aidl` file to be inline
ERROR_ constants instead.
Bug: 291224769
Test: VtsSecretkeeperTargetTest
Change-Id: I1b0f3f3b5a7c5e891da3022444bf6c7925850550
All request messages are encrypted, but response messages have an outer
unencrypted layer, with an inner response (and the result values inside
that).
Make the SecretManagement.cddl file clearer to reflect that, and make
the schema valid along the way.
Move the outer (unencrypted) error code values into `ErrorCode.aidl` and
use them as service-specific error codes, thus reducing the number of
error types from 3 to 2.
Bug: 291228560
Test: VtsSecretkeeperTargetTest
Test: validate CDDL with https://atacama.informatik.uni-bremen.de/
Change-Id: I46c5bfd7e40b03919d7d3779b265b3bb3ff1ce1e
Test Store/Get api of SecretManagement HAL. We use a hard coded
hypothetical chain & a dice policy (which the dice chain matches
against) for testing the store/get functionality.
This patch also adds required error codes in SecretManagement.cddl
Bug: 291224769
Test: atest VtsSecretkeeperTargetTest
Change-Id: I0aa2dfc7413791e9de62a6e753bda4ab2f813d2c
We introduce InMemoryStore, an implementation of KeyValueStore trait.
This can be used for implementing backends that VTS can run against.
Bug: 291224769
Test: atest VtsSecretkeeperTargetTest
Change-Id: Id109ee3bd38ec0979953b6285019c97d418172ef
