1 /*
2  * Copyright (c) 2022-2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "hks_access_control_test_common.h"
17 #include "hks_test_adapt_for_de.h"
18 #include "hks_util.h"
19 
20 #include <gtest/gtest.h>
21 
22 using namespace testing::ext;
23 namespace Unittest::HksAccessControlPartTest {
24 static const uint8_t NONCE[HKS_AE_NONCE_LEN + 1] = "hahahahahaha";
25 static const uint8_t AAD[HKS_AE_AAD_LEN + 1] = "OH_authToken";
26 static uint8_t TAG[HKS_AE_TAG_LEN] = { 0 };
27 
28 static struct HksParam g_authtokenImportHmacParams[] = {
29     {
30         .tag = HKS_TAG_ALGORITHM,
31         .uint32Param = HKS_ALG_HMAC
32     }, {
33         .tag = HKS_TAG_PURPOSE,
34         .uint32Param = HKS_KEY_PURPOSE_MAC
35     }, {
36         .tag = HKS_TAG_KEY_SIZE,
37         .uint32Param = HKS_AES_KEY_SIZE_256
38     }, {
39         .tag = HKS_TAG_DIGEST,
40         .uint32Param = HKS_DIGEST_SHA256
41     }
42 };
43 
44 static struct HksParam g_authtokenHmacParams[] = {
45     {
46         .tag = HKS_TAG_ALGORITHM,
47         .uint32Param = HKS_ALG_HMAC
48     }, {
49         .tag = HKS_TAG_PURPOSE,
50         .uint32Param = HKS_KEY_PURPOSE_MAC
51     }, {
52         .tag = HKS_TAG_DIGEST,
53         .uint32Param = HKS_DIGEST_SHA256
54     }
55 };
56 
57 static struct HksParam g_authtokenImportAesParams[] = {
58     {
59         .tag = HKS_TAG_ALGORITHM,
60         .uint32Param = HKS_ALG_AES
61     }, {
62         .tag = HKS_TAG_PURPOSE,
63         .uint32Param = HKS_KEY_PURPOSE_ENCRYPT | HKS_KEY_PURPOSE_DECRYPT
64     }, {
65         .tag = HKS_TAG_KEY_SIZE,
66         .uint32Param = HKS_AES_KEY_SIZE_256
67     }, {
68         .tag = HKS_TAG_PADDING,
69         .uint32Param = HKS_PADDING_NONE
70     }, {
71         .tag = HKS_TAG_DIGEST,
72         .uint32Param = HKS_DIGEST_NONE
73     }, {
74         .tag = HKS_TAG_BLOCK_MODE,
75         .uint32Param = HKS_MODE_GCM
76     }
77 };
78 
79 static struct HksParam g_authtokenAesParams[] = {
80     {
81         .tag = HKS_TAG_ALGORITHM,
82         .uint32Param = HKS_ALG_AES
83     }, {
84         .tag = HKS_TAG_PURPOSE,
85         .uint32Param = HKS_KEY_PURPOSE_ENCRYPT
86     }, {
87         .tag = HKS_TAG_KEY_SIZE,
88         .uint32Param = HKS_AES_KEY_SIZE_256
89     }, {
90         .tag = HKS_TAG_PADDING,
91         .uint32Param = HKS_PADDING_NONE
92     }, {
93         .tag = HKS_TAG_DIGEST,
94         .uint32Param = HKS_DIGEST_NONE
95     }, {
96         .tag = HKS_TAG_BLOCK_MODE,
97         .uint32Param = HKS_MODE_GCM
98     }, {
99         .tag = HKS_TAG_ASSOCIATED_DATA,
100         .blob = {
101             .size = HKS_AE_AAD_LEN,
102             .data = (uint8_t *)AAD
103         }
104     }, {
105         .tag = HKS_TAG_NONCE,
106         .blob = {
107             .size = HKS_AE_NONCE_LEN,
108             .data = (uint8_t *)NONCE
109         }
110     }, {
111         .tag = HKS_TAG_AE_TAG,
112         .blob = {
113             .size = HKS_AE_TAG_LEN,
114             .data = (uint8_t *)TAG
115         }
116     }
117 };
118 
AuthTokenImportKey(const struct HksBlob * keyAlias,const struct HksParam * params,uint32_t paramCount,bool isMac)119 int32_t AuthTokenImportKey(const struct HksBlob *keyAlias, const struct HksParam *params, uint32_t paramCount,
120     bool isMac)
121 {
122     struct HksParamSet *importParamSet = nullptr;
123     int32_t ret = InitParamSet(&importParamSet, params, paramCount);
124     if (ret != HKS_SUCCESS) {
125         return ret;
126     }
127     const char *atKey = isMac ? HKS_DEFAULT_USER_AT_MAC_KEY : HKS_DEFAULT_USER_AT_CIPHER_KEY;
128     struct HksBlob key = {
129         SHA256_KEY_LEN,
130         const_cast<uint8_t *>(reinterpret_cast<const uint8_t *>(atKey))
131     };
132 
133     ret = HksImportKeyForDe(keyAlias, importParamSet, &key);
134     HksFreeParamSet(&importParamSet);
135     return ret;
136 }
137 
AssignAuthToken(struct HksBlob * cipherTextOutData,struct HksBlob * challenge,const IDMParams & testIDMParams,HksUserAuthToken * authTokenHal)138 static int32_t AssignAuthToken(struct HksBlob *cipherTextOutData, struct HksBlob *challenge,
139     const IDMParams &testIDMParams, HksUserAuthToken *authTokenHal)
140 {
141     uint64_t curTime = 0;
142     int32_t ret = HksElapsedRealTime(&curTime);
143     if (ret != HKS_SUCCESS) {
144         HKS_LOG_E("get elapsed real time failed!");
145         return ret;
146     }
147 
148     (void)memcpy_s(&authTokenHal->ciphertextData, AUTH_TOKEN_CIPHERTEXT_LEN,
149         cipherTextOutData->data, cipherTextOutData->size);
150     (void)memcpy_s(authTokenHal->tag, HKS_AE_TAG_LEN,
151         cipherTextOutData->data + cipherTextOutData->size, HKS_AE_TAG_LEN);
152     (void)memcpy_s(authTokenHal->iv, HKS_AE_NONCE_LEN, NONCE, HKS_AE_NONCE_LEN);
153     authTokenHal->plaintextData.time = curTime + testIDMParams.time;
154     authTokenHal->plaintextData.authType = testIDMParams.authType;
155     authTokenHal->plaintextData.authMode = testIDMParams.authMode;
156     authTokenHal->plaintextData.tokenType = testIDMParams.tokenType;
157 
158     if (memcpy_s(authTokenHal->plaintextData.challenge, TOKEN_CHALLENGE_LEN, challenge->data, challenge->size) != EOK) {
159         HKS_LOG_E("memcpy_s failed");
160         return HKS_FAILURE;
161     }
162     return HKS_SUCCESS;
163 }
164 
AuthTokenEncrypt(const IDMParams & testIDMParams,struct HksBlob * authChallenge,HksUserAuthToken * authTokenHal)165 int32_t AuthTokenEncrypt(const IDMParams &testIDMParams, struct HksBlob *authChallenge, HksUserAuthToken *authTokenHal)
166 {
167     int32_t ret = HKS_FAILURE;
168     uint8_t alias[] = "AuthToken_Encrypt_Decrypt_KeyAlias";
169     const struct HksBlob keyAlias = { sizeof(alias), alias };
170     AuthTokenImportKey(&keyAlias, g_authtokenImportAesParams, sizeof(g_authtokenImportAesParams) / sizeof(HksParam),
171         false);
172     HksCiphertextData *cipherTextData = nullptr;
173     struct HksParamSet *cipherParamSet = nullptr;
174     do {
175         cipherTextData = static_cast<struct HksCiphertextData *>(HksMalloc(AUTH_TOKEN_CIPHERTEXT_LEN));
176         if (cipherTextData == nullptr) {
177             break;
178         }
179 
180         cipherTextData->secureUid = testIDMParams.secureUid;
181         cipherTextData->enrolledId = testIDMParams.enrolledId;
182 
183         uint8_t authTokenCipher[AUTH_TOKEN_CIPHERTEXT_LEN] = {0};
184         if (memcpy_s(authTokenCipher, AUTH_TOKEN_CIPHERTEXT_LEN, cipherTextData, AUTH_TOKEN_CIPHERTEXT_LEN) != EOK) {
185             break;
186         }
187         struct HksBlob inData = { AUTH_TOKEN_CIPHERTEXT_LEN, authTokenCipher };
188 
189         ret = InitParamSet(&cipherParamSet, g_authtokenAesParams, sizeof(g_authtokenAesParams) / sizeof(HksParam));
190         if (ret != HKS_SUCCESS) {
191             break;
192         }
193 
194         /// Init
195         uint8_t handle[32] = {0};
196         struct HksBlob handleEncrypt = { 32, handle };
197         ret = HksInitForDe(&keyAlias, cipherParamSet, &handleEncrypt, nullptr);
198         if (ret != HKS_SUCCESS) {
199             break;
200         }
201         // Update & Finish
202         uint8_t cipher[HKS_AES_COMMON_SIZE] = {0};
203         struct HksBlob cipherTextOutData = { HKS_AES_COMMON_SIZE, cipher };
204         ret = TestUpdateLoopFinish(&handleEncrypt, cipherParamSet, &inData, &cipherTextOutData);
205         if (ret != HKS_SUCCESS) {
206             break;
207         }
208 
209         cipherTextOutData.size -= HKS_AE_TAG_LEN;
210         int ret = AssignAuthToken(&cipherTextOutData, authChallenge, testIDMParams, authTokenHal);
211         if (ret != HKS_SUCCESS) {
212             break;
213         }
214 
215         HKS_FREE(cipherTextData);
216         HksFreeParamSet(&cipherParamSet);
217         return ret;
218     } while (0);
219     (void)HksDeleteKeyForDe(&keyAlias, nullptr);
220     HKS_FREE(cipherTextData);
221     HksFreeParamSet(&cipherParamSet);
222     return ret;
223 }
224 
AuthTokenSign(const IDMParams & testIDMParams,HksUserAuthToken * authTokenHal,std::vector<uint8_t> & token)225 int32_t AuthTokenSign(const IDMParams &testIDMParams,  HksUserAuthToken *authTokenHal,
226     std::vector<uint8_t>& token)
227 {
228     int32_t ret = HKS_FAILURE;
229     uint8_t alias[] = "AuthToken_Sign_Verify_KeyAlias";
230     const struct HksBlob keyAlias = { sizeof(alias), alias };
231     AuthTokenImportKey(&keyAlias, g_authtokenImportHmacParams, sizeof(g_authtokenImportHmacParams) / sizeof(HksParam),
232         true);
233     struct HksParamSet *hmacParamSet = nullptr;
234     do {
235         uint8_t authTokenData[AUTH_TOKEN_DATA_LEN] = {0};
236         if (memcpy_s(authTokenData, AUTH_TOKEN_DATA_LEN, authTokenHal, AUTH_TOKEN_DATA_LEN) != EOK) {
237             break;
238         }
239         struct HksBlob inData = { AUTH_TOKEN_DATA_LEN, authTokenData };
240 
241         ret = InitParamSet(&hmacParamSet, g_authtokenHmacParams, sizeof(g_authtokenHmacParams) / sizeof(HksParam));
242         if (ret != HKS_SUCCESS) {
243             break;
244         }
245         /// Init
246         uint8_t handle[32] = {0};
247         struct HksBlob handleHMAC = { 32, handle };
248 
249         ret = HksInitForDe(&keyAlias, hmacParamSet, &handleHMAC, nullptr);
250         if (ret != HKS_SUCCESS) {
251             break;
252         }
253         // Update & Finish
254         struct HksBlob outData = { SHA256_SIGN_LEN, authTokenHal->sign };
255 
256         ret = TestUpdateFinish(&handleHMAC, hmacParamSet, HKS_KEY_PURPOSE_MAC, &inData, &outData);
257         if (ret != HKS_SUCCESS) {
258             break;
259         }
260 
261         for (uint32_t i = 0; i < AUTH_TOKEN_DATA_LEN; i++) {
262             token.push_back(authTokenData[i]);
263         }
264         for (uint32_t i = 0; i < SHA256_SIGN_LEN; i++) {
265             token.push_back(authTokenHal->sign[i]);
266         }
267         HksFreeParamSet(&hmacParamSet);
268         return ret;
269     } while (0);
270     (void)HksDeleteKeyForDe(&keyAlias, nullptr);
271     HksFreeParamSet(&hmacParamSet);
272     return ret;
273 }
274 
AppendToNewParamSet(const struct HksParamSet * paramSet,struct HksParamSet ** outParamSet)275 static int32_t AppendToNewParamSet(const struct HksParamSet *paramSet, struct HksParamSet **outParamSet)
276 {
277     int32_t ret;
278     struct HksParamSet *newParamSetTest = nullptr;
279 
280     do {
281         ret = HksCheckParamSet(paramSet, paramSet->paramSetSize);
282         if (ret != HKS_SUCCESS) {
283             break;
284         }
285 
286         ret = HksFreshParamSet(const_cast<struct HksParamSet *>(paramSet), false);
287         if (ret != HKS_SUCCESS) {
288             HKS_LOG_E("append fresh paramset failed");
289             break;
290         }
291 
292         ret = HksInitParamSet(&newParamSetTest);
293         if (ret != HKS_SUCCESS) {
294             HKS_LOG_E("append init operation param set failed");
295             break;
296         }
297 
298         ret = HksAddParams(newParamSetTest, paramSet->params, paramSet->paramsCnt);
299         if (ret != HKS_SUCCESS) {
300             HKS_LOG_E("append params failed");
301             break;
302         }
303         HKS_LOG_E("AppendToNewParamSet end ");
304 
305         *outParamSet = newParamSetTest;
306         return ret;
307     } while (0);
308 
309     HksFreeParamSet(&newParamSetTest);
310     return ret;
311 }
312 
HksBuildAuthtoken(struct HksParamSet ** initParamSet,struct HksBlob * authChallenge,const IDMParams & testIDMParams)313 int32_t HksBuildAuthtoken(struct HksParamSet **initParamSet, struct HksBlob *authChallenge,
314     const IDMParams &testIDMParams)
315 {
316     struct HksParam tmpParams;
317     std::vector<uint8_t> token;
318     HksUserAuthToken *authTokenHal = nullptr;
319 
320     authTokenHal = static_cast<struct HksUserAuthToken *>(HksMalloc(AUTH_TOKEN_LEN));
321     if (authTokenHal == nullptr) {
322         return HKS_ERROR_NULL_POINTER;
323     }
324 
325     int ret = AuthTokenEncrypt(testIDMParams, authChallenge, authTokenHal);
326     if (ret != HKS_SUCCESS) {
327         HKS_FREE(authTokenHal);
328         return ret;
329     }
330 
331     ret = AuthTokenSign(testIDMParams, authTokenHal, token);
332     HKS_FREE(authTokenHal);
333     if (ret != HKS_SUCCESS) {
334         return ret;
335     }
336 
337     uint8_t authToken[AUTH_TOKEN_LEN] = {0};
338     for (uint32_t i = 0; i < AUTH_TOKEN_LEN; i++) {
339         authToken[i] = token[i];
340     }
341     tmpParams.tag = HKS_TAG_AUTH_TOKEN;
342     tmpParams.blob.data = authToken;
343     tmpParams.blob.size = AUTH_TOKEN_LEN;
344 
345     struct HksParamSet *newParamSet = nullptr;
346 
347     ret = AppendToNewParamSet(*initParamSet, &newParamSet);
348     if (ret != HKS_SUCCESS) {
349         HKS_LOG_I("AppendToNewParamSet failed!\n");
350         return ret;
351     }
352 
353     ret = HksAddParams(newParamSet, &tmpParams, 1);
354     if (ret != 0) {
355         HKS_LOG_I("HksAddParam failed!\n");
356         return ret;
357     }
358     ret = HksBuildParamSet(&newParamSet);
359     if (ret != 0) {
360         HKS_LOG_I("HksBuildParamSet failed!\n");
361         return ret;
362     }
363 
364     *initParamSet = newParamSet;
365     return ret;
366 }
367 
HksBuildAuthTokenSecure(struct HksParamSet * paramSet,struct HksTestGenAuthTokenParams * genAuthTokenParams,struct HksParamSet ** outParamSet)368 int32_t HksBuildAuthTokenSecure(struct HksParamSet *paramSet,
369     struct HksTestGenAuthTokenParams *genAuthTokenParams, struct HksParamSet **outParamSet)
370 {
371     if (paramSet == nullptr || genAuthTokenParams == nullptr || outParamSet == nullptr) {
372         return HKS_ERROR_NULL_POINTER;
373     }
374     struct HksParam tmpParams;
375     std::vector<uint8_t> token;
376     struct IDMParams testIDMParams = {genAuthTokenParams->secureUid,
377         genAuthTokenParams->enrolledId, genAuthTokenParams->time, genAuthTokenParams->authType};
378 
379     HksUserAuthToken *authTokenHal = nullptr;
380     authTokenHal = static_cast<struct HksUserAuthToken *>(HksMalloc(AUTH_TOKEN_LEN));
381     if (authTokenHal == nullptr) {
382         return HKS_ERROR_NULL_POINTER;
383     }
384 
385     int ret = AuthTokenEncrypt(testIDMParams, genAuthTokenParams->authChallenge, authTokenHal);
386     if (ret != HKS_SUCCESS) {
387         HKS_FREE(authTokenHal);
388         return ret;
389     }
390 
391     ret = AuthTokenSign(testIDMParams, authTokenHal, token);
392     HKS_FREE(authTokenHal);
393     if (ret != HKS_SUCCESS) {
394         return ret;
395     }
396     uint8_t authToken[AUTH_TOKEN_LEN + 1] = {0};
397     for (uint32_t i = 0; i < AUTH_TOKEN_LEN; i++) {
398         authToken[i] = token[i];
399     }
400     tmpParams.tag = HKS_TAG_AUTH_TOKEN;
401     tmpParams.blob.data = authToken;
402     tmpParams.blob.size = AUTH_TOKEN_LEN;
403     HKS_LOG_I("AuthToekn Data: %" LOG_PUBLIC "s", authToken);
404 
405     struct HksParamSet *newParamSet = nullptr;
406 
407     ret = AppendToNewParamSet(paramSet, &newParamSet);
408     if (ret != HKS_SUCCESS) {
409         HKS_LOG_I("AppendToNewParamSet failed!\n");
410         return ret;
411     }
412 
413     ret = HksAddParams(newParamSet, &tmpParams, 1);
414     if (ret != 0) {
415         HKS_LOG_I("HksAddParam failed!\n");
416         return ret;
417     }
418     ret = HksBuildParamSet(&newParamSet);
419     if (ret != 0) {
420         HKS_LOG_I("HksBuildParamSet failed!\n");
421         return ret;
422     }
423 
424     *outParamSet = newParamSet;
425     return ret;
426 }
427 
AddAuthtokenUpdateFinish(struct HksBlob * handle,struct HksParamSet * initParamSet,uint32_t posNum)428 int32_t AddAuthtokenUpdateFinish(struct HksBlob *handle,
429     struct HksParamSet *initParamSet, uint32_t posNum)
430 {
431     struct HksParam *algParam = NULL;
432     int32_t ret = HksGetParam(initParamSet, HKS_TAG_ALGORITHM, &algParam);
433     if (ret != HKS_SUCCESS) {
434         HKS_LOG_I("HksGetParam failed!\n");
435         return ret;
436     }
437 
438     struct HksBlob inData;
439     uint8_t outDataS[DATA_COMMON_SIZE] = {0};
440     struct HksBlob outDataSign = { DATA_COMMON_SIZE, outDataS };
441     (void)posNum;
442     if (algParam->uint32Param == HKS_ALG_RSA) {
443         inData = { g_inData_32.length(),
444             const_cast<uint8_t *>(reinterpret_cast<const uint8_t *>(g_inData_32.c_str())) };
445         ret = TestUpdateFinish(handle, initParamSet, HKS_KEY_PURPOSE_ENCRYPT, &inData, &outDataSign);
446     } else {
447         inData = { g_inData.length(),
448             const_cast<uint8_t *>(reinterpret_cast<const uint8_t *>(g_inData.c_str())) };
449         ret = TestUpdateLoopFinish(handle, initParamSet, &inData, &outDataSign);
450     }
451     if (ret != HKS_SUCCESS) {
452         HKS_LOG_I("TestUpdateLoopFinish failed, ret : %" LOG_PUBLIC "d", ret);
453     }
454     return ret;
455 }
456 
CheckAccessCipherTest(const TestAccessCaseParams & testCaseParams,const IDMParams & testIDMParams)457 int32_t CheckAccessCipherTest(const TestAccessCaseParams &testCaseParams,
458     const IDMParams &testIDMParams)
459 {
460     struct HksParamSet *genParamSet = nullptr;
461 
462     int32_t ret = InitParamSet(&genParamSet, testCaseParams.genParams.data(), testCaseParams.genParams.size());
463     if (ret != HKS_SUCCESS) {
464         HKS_LOG_I("InitParamSet(gen) failed, ret : %" LOG_PUBLIC "d", ret);
465         return ret;
466     }
467     uint8_t alias[] = "testCheckAuth";
468     struct HksBlob keyAlias = { sizeof(alias), alias };
469     ret = HksGenerateKeyForDe(&keyAlias, genParamSet, nullptr);
470     if (ret != HKS_SUCCESS) {
471         HksFreeParamSet(&genParamSet);
472         HKS_LOG_I("HksGenerateKey failed, ret : %" LOG_PUBLIC "d", ret);
473         return ret;
474     }
475 
476     struct HksParamSet *initParamSet = nullptr;
477     ret = InitParamSet(&initParamSet, testCaseParams.initParams.data(), testCaseParams.initParams.size());
478     if (ret != HKS_SUCCESS) {
479         HKS_LOG_I("InitParamSet(init) failed, ret : %" LOG_PUBLIC "d", ret);
480         return ret;
481     }
482     uint8_t challenge[32] = {0};
483     struct HksBlob challengeBlob = { 32, challenge };
484 
485     uint8_t tmpHandle[32] = {0};
486     struct HksBlob handle = { 32, tmpHandle };
487     ret = HksInitForDe(&keyAlias, initParamSet, &handle, &challengeBlob);
488     if (ret != HKS_SUCCESS) {
489         return ret;
490     }
491 
492     ret = HksBuildAuthtoken(&initParamSet, &challengeBlob, testIDMParams);
493     if (ret != HKS_SUCCESS) {
494         HKS_LOG_I("HksBuildAuthtoken failed, ret : %" LOG_PUBLIC "d", ret);
495         HksDeleteKeyForDe(&keyAlias, genParamSet);
496         return ret;
497     }
498     ret = AddAuthtokenUpdateFinish(&handle, initParamSet, 0);
499 
500     HksFreeParamSet(&genParamSet);
501     HksFreeParamSet(&initParamSet);
502     (void)HksDeleteKeyForDe(&keyAlias, nullptr);
503 
504     return (ret == testCaseParams.initResult) ? HKS_SUCCESS : HKS_FAILURE;
505 }
506 
CheckAccessHmacTest(const TestAccessCaseParams & testCaseParams,const IDMParams & testIDMParams)507 int32_t CheckAccessHmacTest(const TestAccessCaseParams &testCaseParams,
508     const IDMParams &testIDMParams)
509 {
510     struct HksParamSet *genParamSet = nullptr;
511     int32_t ret = InitParamSet(&genParamSet, testCaseParams.genParams.data(), testCaseParams.genParams.size());
512     if (ret != HKS_SUCCESS) {
513         return ret;
514     }
515     uint8_t alias[] = "testCheckAuth";
516     struct HksBlob keyAlias = { sizeof(alias), alias };
517     ret = HksGenerateKeyForDe(&keyAlias, genParamSet, nullptr);
518     if (ret != HKS_SUCCESS) {
519         HksFreeParamSet(&genParamSet);
520         HKS_LOG_I("HksGenerateKey failed, ret : %" LOG_PUBLIC "d", ret);
521         return ret;
522     }
523 
524     struct HksParamSet *initParamSet = nullptr;
525     ret = InitParamSet(&initParamSet, testCaseParams.initParams.data(), testCaseParams.initParams.size());
526     if (ret != HKS_SUCCESS) {
527         return ret;
528     }
529     uint8_t challenge[32] = {0};
530     struct HksBlob challengeBlob = { 32, challenge };
531 
532     uint8_t handle[32] = {0};
533     struct HksBlob handleHMAC = { 32, handle };
534     ret = HksInitForDe(&keyAlias, initParamSet, &handleHMAC, &challengeBlob);
535     if (ret != HKS_SUCCESS) {
536         HksDeleteKeyForDe(&keyAlias, genParamSet);
537         return ret;
538     }
539 
540     ret = HksBuildAuthtoken(&initParamSet, &challengeBlob, testIDMParams);
541     if (ret != HKS_SUCCESS) {
542         HksDeleteKeyForDe(&keyAlias, genParamSet);
543         return ret;
544     }
545 
546     struct HksBlob inData = { g_inData.length(),
547         const_cast<uint8_t *>(reinterpret_cast<const uint8_t *>(g_inData.c_str())) };
548     uint8_t out[HMAC_COMMON_SIZE] = {0};
549     struct HksBlob outData = { HMAC_COMMON_SIZE, out };
550     ret = TestUpdateFinish(&handleHMAC, initParamSet, HKS_KEY_PURPOSE_MAC, &inData, &outData);
551     if (ret != HKS_SUCCESS) {
552         HKS_LOG_I("TestUpdateFinish failed, ret : %" LOG_PUBLIC "d", ret);
553         HksDeleteKeyForDe(&keyAlias, genParamSet);
554         return ret;
555     }
556 
557     /* 3. Delete Key */
558     ret = HksDeleteKeyForDe(&keyAlias, genParamSet);
559     if (ret != HKS_SUCCESS) {
560         HksDeleteKeyForDe(&keyAlias, genParamSet);
561         return ret;
562     }
563 
564     return (ret == testCaseParams.initResult) ? HKS_SUCCESS : HKS_FAILURE;
565 }
566 
UpdateAndFinishForAgreeTest(const struct HksBlob * handle,struct HksParamSet * initParamSet,struct HksParamSet * finishParamSet,struct HksBlob * publicKey)567 static int32_t UpdateAndFinishForAgreeTest(const struct HksBlob *handle, struct HksParamSet *initParamSet,
568     struct HksParamSet *finishParamSet, struct HksBlob *publicKey)
569 {
570     struct HksBlob inData = { g_inData.length(),
571         const_cast<uint8_t *>(reinterpret_cast<const uint8_t *>(g_inData.c_str())) };
572 
573     uint8_t outDataU[ECDH_COMMON_SIZE] = {0};
574     struct HksBlob outDataUpdate = { ECDH_COMMON_SIZE, outDataU };
575     int32_t ret = HksUpdateForDe(handle, initParamSet, publicKey, &outDataUpdate);
576     if (ret != HKS_SUCCESS) {
577         return ret;
578     }
579 
580     uint8_t outDataF[ECDH_COMMON_SIZE] = {0};
581     struct HksBlob outDataFinish = { ECDH_COMMON_SIZE, outDataF };
582     ret = HksFinishForDe(handle, finishParamSet, (const struct HksBlob *)&inData, &outDataFinish);
583     return ret;
584 }
585 
CheckAccessAgreeTest(const TestAccessCaseParams & testCaseParams,struct HksParamSet * finishParamSet,const IDMParams & testIDMParams)586 int32_t CheckAccessAgreeTest(const TestAccessCaseParams &testCaseParams, struct HksParamSet *finishParamSet,
587     const IDMParams &testIDMParams)
588 {
589     struct HksParamSet *genParamSet = nullptr;
590     int32_t ret = InitParamSet(&genParamSet, testCaseParams.genParams.data(), testCaseParams.genParams.size());
591     if (ret != HKS_SUCCESS) {
592         return ret;
593     }
594     uint8_t alias[] = "testCheckAuth";
595     struct HksBlob keyAlias = { sizeof(alias), alias };
596     ret = HksGenerateKeyForDe(&keyAlias, genParamSet, nullptr);
597     if (ret != HKS_SUCCESS) {
598         HksFreeParamSet(&genParamSet);
599         return ret;
600     }
601 
602     uint8_t pubKey[4096] = {0};
603     struct HksBlob publicKey = { 4096, pubKey };
604     ret = HksExportPublicKeyForDe(&keyAlias, genParamSet, &publicKey);
605     if (ret != HKS_SUCCESS) {
606         return HKS_FAILURE;
607     }
608     struct HksParamSet *initParamSet = nullptr;
609     ret = InitParamSet(&initParamSet, testCaseParams.initParams.data(), testCaseParams.initParams.size());
610     if (ret != HKS_SUCCESS) {
611         return ret;
612     }
613     uint8_t challenge[32] = {0};
614     struct HksBlob challengeBlob = { 32, challenge };
615 
616     uint8_t handleU[32] = {0};
617     struct HksBlob handle = { 32, handleU };
618     ret = HksInitForDe(&keyAlias, initParamSet, &handle, &challengeBlob);
619     if (ret != HKS_SUCCESS) {
620         return HKS_FAILURE;
621     }
622 
623     ret = HksBuildAuthtoken(&initParamSet, &challengeBlob, testIDMParams);
624     if (ret != HKS_SUCCESS) {
625         HksDeleteKeyForDe(&keyAlias, genParamSet);
626         return ret;
627     }
628 
629     ret = UpdateAndFinishForAgreeTest((const struct HksBlob *)&handle, initParamSet, finishParamSet, &publicKey);
630     if (ret != HKS_SUCCESS) {
631         return HKS_FAILURE;
632     }
633 
634     return (ret == testCaseParams.initResult) ? HKS_SUCCESS : HKS_FAILURE;
635 }
636 
UpdateAndFinishForDeriveTest(const struct HksBlob * handleDerive,struct HksParamSet * initParamSet,struct HksParamSet * finishParamSet)637 static int32_t UpdateAndFinishForDeriveTest(const struct HksBlob *handleDerive, struct HksParamSet *initParamSet,
638     struct HksParamSet *finishParamSet)
639 {
640     struct HksBlob inData = { g_inData.length(),
641         const_cast<uint8_t *>(reinterpret_cast<const uint8_t *>(g_inData.c_str())) };
642 
643     uint8_t tmpOut[DERIVE_COMMON_SIZE] = {0};
644     struct HksBlob outData = { DERIVE_COMMON_SIZE, tmpOut };
645     int32_t ret = HksUpdateForDe(handleDerive, initParamSet, &inData, &outData);
646     if (ret != HKS_SUCCESS) {
647         return ret;
648     }
649 
650     uint8_t outDataD[DERIVE_COMMON_SIZE] = {0};
651     struct HksBlob outDataDerive = { DERIVE_COMMON_SIZE, outDataD };
652     ret = HksFinishForDe(handleDerive, finishParamSet, &inData, &outDataDerive);
653     return ret;
654 }
655 
CheckAccessDeriveTest(const TestAccessCaseParams & testCaseParams,struct HksParamSet * finishParamSet,const IDMParams & testIDMParams)656 int32_t CheckAccessDeriveTest(const TestAccessCaseParams &testCaseParams, struct HksParamSet *finishParamSet,
657     const IDMParams &testIDMParams)
658 {
659     struct HksParamSet *genParamSet = nullptr;
660     struct HksParamSet *initParamSet = nullptr;
661     int32_t ret = InitParamSet(&genParamSet, testCaseParams.genParams.data(), testCaseParams.genParams.size());
662     if (ret != HKS_SUCCESS) {
663         return ret;
664     }
665     uint8_t alias[] = "testCheckAuth";
666     struct HksBlob keyAlias = { sizeof(alias), alias };
667     ret = HksGenerateKeyForDe(&keyAlias, genParamSet, nullptr);
668     if (ret != HKS_SUCCESS) {
669         HksFreeParamSet(&genParamSet);
670         return ret;
671     }
672 
673     ret = InitParamSet(&initParamSet, testCaseParams.initParams.data(), testCaseParams.initParams.size());
674     if (ret != HKS_SUCCESS) {
675         return ret;
676     }
677     uint8_t challenge[32] = {0};
678     struct HksBlob challengeBlob = { 32, challenge };
679     // Init
680     uint8_t handleD[32] = {0};
681     struct HksBlob handleDerive = { 32, handleD };
682     ret = HksInitForDe(&keyAlias, initParamSet, &handleDerive, &challengeBlob);
683     if (ret != HKS_SUCCESS) {
684         HksDeleteKeyForDe(&keyAlias, genParamSet);
685         return ret;
686     }
687 
688     ret = HksBuildAuthtoken(&initParamSet, &challengeBlob, testIDMParams);
689     if (ret != HKS_SUCCESS) {
690         HksDeleteKeyForDe(&keyAlias, genParamSet);
691         return ret;
692     }
693 
694     ret = UpdateAndFinishForDeriveTest((const struct HksBlob *)&handleDerive, initParamSet, finishParamSet);
695     if (ret != HKS_SUCCESS) {
696         HksDeleteKeyForDe(&keyAlias, genParamSet);
697         return ret;
698     }
699 
700     HksDeleteKeyForDe(&keyAlias, genParamSet);
701     return (ret == testCaseParams.initResult) ? HKS_SUCCESS : HKS_FAILURE;
702 }
703 
ConstructRsaKeyPair(const struct HksBlob * nDataBlob,const struct HksBlob * dDataBlob,const struct HksBlob * eDataBlob,uint32_t keySize,struct HksBlob * outKey)704 int32_t ConstructRsaKeyPair(const struct HksBlob *nDataBlob, const struct HksBlob *dDataBlob,
705     const struct HksBlob *eDataBlob, uint32_t keySize, struct HksBlob *outKey)
706 {
707     struct HksKeyMaterialRsa material;
708     material.keyAlg = HKS_ALG_RSA;
709     material.keySize = keySize;
710     material.nSize = nDataBlob->size;
711     material.eSize = eDataBlob->size;
712     material.dSize = dDataBlob->size;
713 
714     uint32_t size = sizeof(material) + material.nSize + material.eSize + material.dSize;
715     uint8_t *data = static_cast<uint8_t *>(HksMalloc(size));
716     if (data == nullptr) {
717         return HKS_ERROR_MALLOC_FAIL;
718     }
719 
720     // copy struct material
721     if (memcpy_s(data, size, &material, sizeof(material)) != EOK) {
722         HKS_FREE(data);
723         return HKS_ERROR_BAD_STATE;
724     }
725 
726     uint32_t offset = sizeof(material);
727     // copy nData
728     if (memcpy_s(data + offset, size - offset, nDataBlob->data, nDataBlob->size) != EOK) {
729         HKS_FREE(data);
730         return HKS_ERROR_BAD_STATE;
731     }
732     offset += material.nSize;
733 
734     // copy eData
735     if (memcpy_s(data + offset, size - offset, eDataBlob->data, eDataBlob->size) != EOK) {
736             HKS_FREE(data);
737             return HKS_ERROR_BAD_STATE;
738     }
739     offset += material.eSize;
740 
741     // copy dData
742     if (memcpy_s(data + offset, size - offset, dDataBlob->data, dDataBlob->size) != EOK) {
743         HKS_FREE(data);
744         return HKS_ERROR_BAD_STATE;
745     }
746 
747     outKey->data = data;
748     outKey->size = size;
749     return HKS_SUCCESS;
750 }
751 
ConstructEd25519KeyPair(uint32_t keySize,uint32_t alg,struct HksBlob * ed25519PubData,struct HksBlob * ed25519PrivData,struct HksBlob * outKey)752 int32_t ConstructEd25519KeyPair(uint32_t keySize, uint32_t alg, struct HksBlob *ed25519PubData,
753     struct HksBlob *ed25519PrivData, struct HksBlob *outKey)
754 {
755     struct HksKeyMaterial25519 material;
756     material.keyAlg = (enum HksKeyAlg)alg;
757     material.keySize = keySize;
758     material.pubKeySize = ed25519PubData->size;
759     material.priKeySize = ed25519PrivData->size;
760     material.reserved = 0;
761 
762     uint32_t size = sizeof(material) + material.pubKeySize + material.priKeySize;
763     uint8_t *data = static_cast<uint8_t *>(HksMalloc(size));
764     if (data == nullptr) {
765         return HKS_ERROR_MALLOC_FAIL;
766     }
767 
768     // copy struct material
769     if (memcpy_s(data, size, &material, sizeof(material)) != EOK) {
770         HKS_FREE(data);
771         return HKS_ERROR_BAD_STATE;
772     }
773 
774     uint32_t offset = sizeof(material);
775     // copy publicData
776     if (memcpy_s(data + offset, size - offset, ed25519PubData, ed25519PubData->size) != EOK) {
777         HKS_FREE(data);
778         return HKS_ERROR_BAD_STATE;
779     }
780     offset += material.pubKeySize;
781 
782     // copy privateData
783     if (memcpy_s(data + offset, size - offset, ed25519PrivData, ed25519PrivData->size) != EOK) {
784         HKS_FREE(data);
785         return HKS_ERROR_BAD_STATE;
786     }
787 
788     outKey->data = data;
789     outKey->size = size;
790     return HKS_SUCCESS;
791 }
792 
ConstructDsaKeyPair(uint32_t keySize,const struct TestDsaKeyParams * params,struct HksBlob * outKey)793 int32_t ConstructDsaKeyPair(uint32_t keySize, const struct TestDsaKeyParams *params, struct HksBlob *outKey)
794 {
795     struct HksKeyMaterialDsa material;
796     material.keyAlg = HKS_ALG_DSA;
797     material.keySize = keySize;
798     material.xSize = params->xData->size;
799     material.ySize = params->yData->size;
800     material.pSize = params->pData->size;
801     material.qSize = params->qData->size;
802     material.gSize = params->gData->size;
803 
804     uint32_t size = sizeof(material) + material.xSize + material.ySize +
805         material.pSize + material.qSize + material.gSize;
806     uint8_t *data = static_cast<uint8_t *>(HksMalloc(size));
807     if (data == nullptr) {
808         return HKS_ERROR_MALLOC_FAIL;
809     }
810 
811     // copy struct material
812     if (memcpy_s(data, size, &material, sizeof(material)) != EOK) {
813         HKS_FREE(data);
814         return HKS_ERROR_BAD_STATE;
815     }
816 
817     uint32_t offset = sizeof(material);
818     // copy xData
819     if (memcpy_s(data + offset, size - offset, params->xData->data, params->xData->size) != EOK) {
820         HKS_FREE(data);
821         return HKS_ERROR_BAD_STATE;
822     }
823 
824     offset += material.xSize;
825     // copy yData
826     if (memcpy_s(data + offset, size - offset, params->yData->data, params->yData->size) != EOK) {
827         HKS_FREE(data);
828         return HKS_ERROR_BAD_STATE;
829     }
830     offset += material.ySize;
831 
832     // copy pData
833     if (memcpy_s(data + offset, size - offset, params->pData->data, params->pData->size) != EOK) {
834         HKS_FREE(data);
835         return HKS_ERROR_BAD_STATE;
836     }
837     offset += material.pSize;
838 
839     // copy qData
840     if (memcpy_s(data + offset, size - offset, params->qData->data, params->qData->size) != EOK) {
841         HKS_FREE(data);
842         return HKS_ERROR_BAD_STATE;
843     }
844     offset += material.qSize;
845 
846     // copy gData
847     if (memcpy_s(data + offset, size - offset, params->gData->data, params->gData->size) != EOK) {
848         HKS_FREE(data);
849         return HKS_ERROR_BAD_STATE;
850     }
851 
852     outKey->data = data;
853     outKey->size = size;
854     return HKS_SUCCESS;
855 }
856 
GenParamSetAuthTest(struct HksParamSet ** paramOutSet,const struct HksParamSet * genParamSet)857 int32_t GenParamSetAuthTest(struct HksParamSet **paramOutSet, const struct HksParamSet *genParamSet)
858 {
859     struct HksParam localSecureKey = {
860         .tag = HKS_TAG_SYMMETRIC_KEY_DATA,
861         .blob = { .size = KEY_PARAMSET_SIZE, .data = static_cast<uint8_t *>(HksMalloc(KEY_PARAMSET_SIZE)) }
862     };
863     if (localSecureKey.blob.data == nullptr) {
864         return HKS_ERROR_MALLOC_FAIL;
865     }
866 
867     int32_t ret = HksInitParamSet(paramOutSet);
868     EXPECT_EQ(ret, HKS_SUCCESS) << "HksInitParamSet failed.";
869 
870     struct HksParam *algParam = nullptr;
871     ret = HksGetParam(genParamSet, HKS_TAG_ALGORITHM, &algParam);
872     EXPECT_EQ(ret, HKS_SUCCESS) << "HksGetParam alg failed.";
873 
874     if (algParam->uint32Param == HKS_ALG_AES || algParam->uint32Param == HKS_ALG_SM4) {
875         localSecureKey.tag = HKS_TAG_SYMMETRIC_KEY_DATA;
876     } else if (algParam->uint32Param == HKS_ALG_RSA || algParam->uint32Param == HKS_ALG_SM2 ||
877         algParam->uint32Param == HKS_ALG_ECC || algParam->uint32Param == HKS_ALG_DSA ||
878         algParam->uint32Param == HKS_ALG_X25519 || algParam->uint32Param == HKS_ALG_ED25519 ||
879         algParam->uint32Param == HKS_ALG_DH) {
880         localSecureKey.tag = HKS_TAG_ASYMMETRIC_PUBLIC_KEY_DATA;
881     } else if (algParam->uint32Param == HKS_ALG_HMAC || algParam->uint32Param == HKS_ALG_SM3 ||
882         algParam->uint32Param == HKS_ALG_HKDF || algParam->uint32Param == HKS_ALG_PBKDF2) {
883         localSecureKey.tag = HKS_TAG_ASYMMETRIC_PRIVATE_KEY_DATA;
884     } else {
885         localSecureKey.tag = HKS_TAG_SYMMETRIC_KEY_DATA;
886     }
887 
888     ret = HksAddParams(*paramOutSet, &localSecureKey, 1);
889     EXPECT_EQ(ret, HKS_SUCCESS) << "HksAddParams failed.";
890     ret = HksBuildParamSet(paramOutSet);
891     EXPECT_EQ(ret, HKS_SUCCESS) << "HksAddParams failed.";
892 
893     return ret;
894 }
895 }
896