2 * Copyright (c) 2000 - 2014 Samsung Electronics Co., Ltd All Rights Reserved
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License
17 * @file ckm-common.cpp
18 * @author Krzysztof Jackiewicz (k.jackiewicz@samsung.com)
23 #include <sys/smack.h>
24 #include <ckmc/ckmc-type.h>
25 #include <ckm-common.h>
26 #include <tests_common.h>
27 #include <access_provider2.h>
28 #include <ckm/ckm-control.h>
29 #include <ckm/ckm-manager.h>
30 #include <ckmc/ckmc-control.h>
31 #include <ckmc/ckmc-manager.h>
32 #include <service_manager.h>
36 const std::string SMACK_USER_APP_PREFIX = "User::App::";
38 void generate_random(size_t random_bytes, char *output)
40 RUNNER_ASSERT(random_bytes>0 && output);
42 std::ifstream is("/dev/urandom", std::ifstream::binary);
43 RUNNER_ASSERT_MSG(is, "Failed to read /dev/urandom");
44 is.read(output, random_bytes);
45 if(static_cast<std::streamsize>(random_bytes) != is.gcount()) {
46 RUNNER_ASSERT_MSG(false,
47 "Not enough bytes read from /dev/urandom: " << random_bytes << "!=" <<
52 const char* SERVICE[] = {
53 "central-key-manager-listener.service",
54 "central-key-manager.service" };
56 void start_service(ServiceIdx idx)
58 ServiceManager sm(SERVICE[idx]);
62 void stop_service(ServiceIdx idx)
64 ServiceManager sm(SERVICE[idx]);
68 std::string getLabel() {
71 RUNNER_ASSERT_MSG(0 <= (ret = smack_new_label_from_self(&myLabel)),
72 "Failed to get smack label for self. Error: " << ret);
73 RUNNER_ASSERT_MSG(myLabel, "NULL smack label");
74 std::string result = myLabel;
79 std::string getOwnerIdFromSelf() {
80 const std::string& prefix = SMACK_USER_APP_PREFIX;
81 std::string smack = getLabel();
82 if (0 == smack.compare(0, prefix.size(), prefix))
83 return smack.substr(prefix.size(), std::string::npos);
87 std::string aliasWithLabel(const char *label, const char *alias)
92 ss << label << std::string(ckmc_label_name_separator) << alias;
95 return std::string(alias);
98 // changes process label
99 void change_label(const char* label)
101 int ret = smack_set_label_for_self(label);
102 RUNNER_ASSERT_MSG(0 == ret, "Error in smack_set_label_for_self("<<label<<"). Error: " << ret);
105 ScopedLabel::ScopedLabel(const char* label) : m_original_label(getLabel())
110 ScopedLabel::~ScopedLabel()
113 * Let it throw. If we can't restore label then remaining tests results will be
116 change_label(m_original_label.c_str());
119 const char * CKMCErrorToString(int error) {
120 #define ERRORDESCRIBE(name) case name: return #name
122 ERRORDESCRIBE(CKMC_ERROR_NONE);
123 ERRORDESCRIBE(CKMC_ERROR_INVALID_PARAMETER);
124 ERRORDESCRIBE(CKMC_ERROR_OUT_OF_MEMORY);
125 ERRORDESCRIBE(CKMC_ERROR_PERMISSION_DENIED);
126 ERRORDESCRIBE(CKMC_ERROR_SOCKET);
127 ERRORDESCRIBE(CKMC_ERROR_BAD_REQUEST);
128 ERRORDESCRIBE(CKMC_ERROR_BAD_RESPONSE);
129 ERRORDESCRIBE(CKMC_ERROR_SEND_FAILED);
130 ERRORDESCRIBE(CKMC_ERROR_RECV_FAILED);
131 ERRORDESCRIBE(CKMC_ERROR_AUTHENTICATION_FAILED);
132 ERRORDESCRIBE(CKMC_ERROR_BUFFER_TOO_SMALL);
133 ERRORDESCRIBE(CKMC_ERROR_SERVER_ERROR);
134 ERRORDESCRIBE(CKMC_ERROR_DB_LOCKED);
135 ERRORDESCRIBE(CKMC_ERROR_DB_ERROR);
136 ERRORDESCRIBE(CKMC_ERROR_DB_ALIAS_EXISTS);
137 ERRORDESCRIBE(CKMC_ERROR_DB_ALIAS_UNKNOWN);
138 ERRORDESCRIBE(CKMC_ERROR_VERIFICATION_FAILED);
139 ERRORDESCRIBE(CKMC_ERROR_INVALID_FORMAT);
140 ERRORDESCRIBE(CKMC_ERROR_FILE_ACCESS_DENIED);
141 ERRORDESCRIBE(CKMC_ERROR_NOT_EXPORTABLE);
142 ERRORDESCRIBE(CKMC_ERROR_FILE_SYSTEM);
143 ERRORDESCRIBE(CKMC_ERROR_NOT_SUPPORTED);
144 ERRORDESCRIBE(CKMC_ERROR_UNKNOWN);
145 default: return "Error not defined";
150 std::string CKMCReadableError(int error) {
151 std::string output("Error: ");
152 output += std::to_string(error);
153 output += " Description: ";
154 output += CKMCErrorToString(error);
158 void save_data(const char* alias, const char *data, int expected_err)
160 save_data(alias, data, strlen(data), expected_err);
163 void save_data(const char* alias, const char *data, size_t len, int expected_err = CKMC_ERROR_NONE)
165 RUNNER_ASSERT(alias);
168 ckmc_raw_buffer_s buffer;
169 buffer.data = reinterpret_cast<unsigned char*>(const_cast<char*>(data));
171 ckmc_policy_s policy;
172 policy.password = NULL;
173 policy.extractable = true;
175 int ret = ckmc_save_data(alias, buffer, policy);
176 RUNNER_ASSERT_MSG(expected_err == ret, "Saving data failed. "
177 << CKMCErrorToString(ret) << " while expected: "
178 << CKMCErrorToString(expected_err));
182 ScopedSaveData::ScopedSaveData(const char* alias, const char *data, int expected_err) : m_alias(alias)
184 save_data(alias, data, expected_err);
187 ScopedSaveData::~ScopedSaveData()
190 * Let it throw. If we can't remove data then remaining tests results will be
193 check_remove_allowed(m_alias.c_str());
196 void GarbageCollector::add(const char* alias)
199 item.item_alias = std::string(alias);
200 item.owner_label = getOwnerIdFromSelf();
201 item.owner_uid = geteuid();
202 item.owner_gid = getegid();
203 m_garbage.push_back(item);
206 void GarbageCollector::save(const char* alias, const char *data, int expected_err)
208 save(alias, data, strlen(data), expected_err);
211 void GarbageCollector::save(const char* alias, const char *data, size_t len, int expected_err)
213 save_data(alias, data, len, expected_err);
215 if(CKMC_ERROR_NONE == expected_err)
219 GarbageCollector::~GarbageCollector()
221 for(auto & item : m_garbage)
224 ScopedAccessProvider ap(item.owner_label, item.owner_uid, item.owner_gid);
225 check_remove_allowed(item.item_alias.c_str());
227 // prevent exceptions in destructor
232 ScopedDBUnlock::ScopedDBUnlock(uid_t user_id, const char* passwd) : m_uid(user_id)
235 RUNNER_ASSERT_MSG(CKMC_ERROR_NONE == (temp = ckmc_unlock_user_key(user_id, passwd)), CKMCErrorToString(temp));
237 ScopedDBUnlock::~ScopedDBUnlock()
240 RUNNER_ASSERT_MSG(CKMC_ERROR_NONE == (temp = ckmc_lock_user_key(m_uid)), CKMCErrorToString(temp));
243 void check_remove_allowed(const char* alias)
245 int ret = ckmc_remove_alias(alias);
246 // remove, but ignore non existing
247 RUNNER_ASSERT_MSG((CKMC_ERROR_NONE == ret) || (CKMC_ERROR_DB_ALIAS_UNKNOWN == ret),
248 "Removing data failed: " << CKMCErrorToString(ret));
251 void check_remove_denied(const char* alias)
253 int ret = ckmc_remove_alias(alias);
255 CKMC_ERROR_PERMISSION_DENIED == ret,
256 "App with different label shouldn't have rights to remove this data. "
257 << CKMCReadableError(ret));
260 void check_remove_not_visible(const char* alias)
262 int ret = ckmc_remove_alias(alias);
264 CKMC_ERROR_DB_ALIAS_UNKNOWN == ret,
265 "App with different label shouldn't have rights to see this data. "
266 << CKMCReadableError(ret));
269 void check_read(const char* alias,
271 const char *test_data,
275 ckmc_raw_buffer_s* buffer = NULL;
276 int ret = ckmc_get_data(aliasWithLabel(label, alias).c_str(), NULL, &buffer);
277 RUNNER_ASSERT_MSG(expected_code == ret, "Getting data failed. "
278 "Expected " << CKMCErrorToString(expected_code) << ", "
279 "while result " << CKMCErrorToString(ret));
281 if(expected_code == CKMC_ERROR_NONE)
283 // compare data with expected
286 "Extracted data length do not match expected data length (encrypted?):" <<
287 buffer->size << "!=" << len);
290 memcmp(const_cast<const char*>(reinterpret_cast<char*>(buffer->data)),
291 test_data, buffer->size) == 0,
292 "Extracted data do not match expected data (encrypted?).");
294 ckmc_buffer_free(buffer);
298 void check_read(const char* alias, const char *label, const char *test_data, int expected_code)
300 check_read(alias, label, test_data, strlen(test_data), expected_code);
303 void check_read_allowed(const char* alias, const char *data)
305 // try to read previously saved data - label taken implicitly
306 check_read(alias, NULL, data);
309 void check_read_not_visible(const char* alias)
311 // try to read previously saved data - label taken implicitly
313 ckmc_raw_buffer_s* buffer = NULL;
314 int ret = ckmc_get_data(alias, NULL, &buffer);
315 RUNNER_ASSERT_MSG(CKMC_ERROR_DB_ALIAS_UNKNOWN == ret,
316 "App with different label shouldn't have rights to see this data. " << CKMCErrorToString(ret));
317 ckmc_buffer_free(buffer);
321 void check_key(const char *alias, int expected_error, ckmc_key_type_e expected_type)
323 ckmc_key_s *test_key = NULL;
324 int temp = ckmc_get_key(alias, 0, &test_key);
326 expected_error == temp,
327 "received: " << CKMCReadableError(temp) << " while expected: " << CKMCReadableError(expected_error));
328 if(expected_type != CKMC_KEY_NONE)
331 test_key->key_type == expected_type,
332 "received type: " << test_key->key_type << " while expected type: " << expected_type);
334 ckmc_key_free(test_key);
336 void check_key_allowed(const char *alias, ckmc_key_type_e expected_type)
338 check_key(alias, CKMC_ERROR_NONE, expected_type);
340 void check_key_not_visible(const char *alias)
342 check_key(alias, CKMC_ERROR_DB_ALIAS_UNKNOWN);
344 void check_cert_allowed(const char *alias)
346 ckmc_cert_s *test_cert = NULL;
347 int temp = ckmc_get_cert(alias, 0, &test_cert);
348 ckmc_cert_free(test_cert);
349 RUNNER_ASSERT_MSG(CKMC_ERROR_NONE == temp, CKMCReadableError(temp));
352 void check_cert_not_visible(const char *alias)
354 ckmc_cert_s *test_cert = NULL;
355 int temp = ckmc_get_cert(alias, 0, &test_cert);
356 ckmc_cert_free(test_cert);
357 RUNNER_ASSERT_MSG(CKMC_ERROR_DB_ALIAS_UNKNOWN == temp,
358 "App with different label shouldn't have rights to see this cert. " << CKMCErrorToString(temp));
361 void allow_access(const char* alias, const char* accessor, int permissionMask)
363 // data removal should revoke this access
364 int ret = ckmc_set_permission(alias, accessor, permissionMask);
365 RUNNER_ASSERT_MSG(CKMC_ERROR_NONE == ret, "Trying to allow access returned: "
366 << CKMCErrorToString(ret));
369 void allow_access_negative(const char* alias, const char* accessor, int permissionMask, int expectedCode)
371 // data removal should revoke this access
372 int ret = ckmc_set_permission(alias, accessor, permissionMask);
373 RUNNER_ASSERT_MSG(expectedCode == ret, "Trying to allow access returned "
374 << CKMCErrorToString(ret) << ", while expected: "
375 << CKMCErrorToString(expectedCode));
378 void deny_access(const char* alias, const char* accessor)
380 int ret = ckmc_set_permission(alias, accessor, CKMC_PERMISSION_NONE);
381 RUNNER_ASSERT_MSG(CKMC_ERROR_NONE == ret, "Denying access failed. Error: "
382 << CKMCErrorToString(ret));
385 void deny_access_negative(const char* alias, const char* accessor, int expectedCode)
387 int ret = ckmc_set_permission(alias, accessor, CKMC_PERMISSION_NONE);
388 RUNNER_ASSERT_MSG(expectedCode == ret, "Denying access failed. "
389 << CKMCErrorToString(ret) << ", while expected: "
390 << CKMCErrorToString(expectedCode));
393 void unlock_user_data(uid_t user_id, const char *passwd)
396 auto control = CKM::Control::create();
397 RUNNER_ASSERT_MSG(CKM_API_SUCCESS == (ret = control->unlockUserKey(user_id, passwd)),
398 "Error=" << CKM::ErrorToString(ret));
401 void remove_user_data(uid_t user_id)
403 auto control = CKM::Control::create();
404 control->lockUserKey(user_id);
405 control->removeUserData(user_id);
408 void reset_user_data(uid_t user_id, const char *passwd)
410 remove_user_data(user_id);
411 unlock_user_data(user_id, passwd);
414 ckmc_raw_buffer_s prepare_message_buffer(const char * input)
416 ckmc_raw_buffer_s retval;
417 retval.data = const_cast<unsigned char *>(reinterpret_cast<const unsigned char *>(input));
418 retval.size = strlen(input);
422 void check_alias_list(const CKM::AliasVector& expected)
424 ckmc_alias_list_s *aliasList = NULL;
425 int ret = ckmc_get_data_alias_list(&aliasList);
426 RUNNER_ASSERT_MSG(ret == 0, "Failed to get the list of data aliases. " << ret << " / " << CKMCErrorToString(ret));
428 CKM::AliasVector actual;
429 ckmc_alias_list_s *plist = aliasList;
432 actual.push_back(plist->alias);
435 ckmc_alias_list_all_free(aliasList);
437 RUNNER_ASSERT_MSG(expected == actual, "Actual list of aliases differ from expected list.");
440 size_t count_aliases(alias_type_ type, size_t minimum_initial_element_count)
442 ckmc_alias_list_s *aliasList = NULL;
447 ec = ckmc_get_key_alias_list(&aliasList);
451 ec = ckmc_get_cert_alias_list(&aliasList);
455 ec = ckmc_get_data_alias_list(&aliasList);
458 RUNNER_ASSERT_MSG(false, "Unsupported value ALIAS_KEY == " << (int)type);
461 if(ec == CKMC_ERROR_DB_ALIAS_UNKNOWN)
464 RUNNER_ASSERT_MSG(ec == CKMC_ERROR_NONE,
465 "Error: alias list failed, ec: " << CKMCErrorToString(ec));
467 ckmc_alias_list_s *plist = aliasList;
468 size_t return_count = 0;
474 ckmc_alias_list_all_free(aliasList);
477 return_count >= minimum_initial_element_count,
478 "Error: alias list failed, current element count: " << return_count <<
479 " while expected minimal count of " << minimum_initial_element_count <<
485 std::string sharedDatabase(const CKM::Alias & alias)
487 return aliasWithLabel(ckmc_owner_id_system, alias.c_str());
490 ckmc_raw_buffer_s* createRandomBufferCAPI(size_t random_bytes)
492 ckmc_raw_buffer_s* buffer = NULL;
493 char* data = static_cast<char*>(malloc(random_bytes*sizeof(char)));
495 generate_random(random_bytes, data);
496 int ret = ckmc_buffer_new(reinterpret_cast<unsigned char*>(data), random_bytes, &buffer);
497 RUNNER_ASSERT_MSG(ret == CKMC_ERROR_NONE, "Buffer creation failed: " << CKMCErrorToString(ret));
501 CKM::RawBuffer createRandomBuffer(size_t random_bytes)
503 char buffer[random_bytes];
504 generate_random(random_bytes, buffer);
505 return CKM::RawBuffer(buffer, buffer + random_bytes);
508 ckmc_key_s *generate_AES_key(size_t lengthBits, const char *passwd)
510 ckmc_key_s *retval = reinterpret_cast<ckmc_key_s *>(malloc(sizeof(ckmc_key_s)));
511 RUNNER_ASSERT(retval != NULL);
513 RUNNER_ASSERT(lengthBits%8 == 0);
514 char *char_key_AES = reinterpret_cast<char*>(malloc(lengthBits/8));
515 RUNNER_ASSERT(char_key_AES != NULL);
516 generate_random(lengthBits/8, char_key_AES);
518 retval->raw_key = reinterpret_cast<unsigned char *>(char_key_AES);
519 retval->key_size = lengthBits/8;
520 retval->key_type = CKMC_KEY_AES;
521 retval->password = passwd?strdup(passwd):NULL;
526 void validate_AES_key(ckmc_key_s *analyzed)
528 RUNNER_ASSERT_MSG(analyzed, "provided key is NULL");
529 RUNNER_ASSERT_MSG(analyzed->raw_key != NULL, "provided key is empty");
530 RUNNER_ASSERT_MSG(analyzed->key_size==(128/8) ||
531 analyzed->key_size==(192/8) ||
532 analyzed->key_size==(256/8), "provided key length is invalid");
533 RUNNER_ASSERT_MSG(analyzed->key_type = CKMC_KEY_AES, "expected AES key, while got: " << analyzed->key_type);
536 void compare_AES_keys(ckmc_key_s *first, ckmc_key_s *second)
538 validate_AES_key(first);
539 validate_AES_key(second);
541 (first->key_size==second->key_size) &&
542 (memcmp(first->raw_key, second->raw_key, first->key_size)==0),
543 "data has been modified in key manager");
544 // bypassing password intentionally
547 ParamListPtr createParamListPtr()
549 ckmc_param_list_h list = NULL;
550 assert_positive(ckmc_param_list_new, &list);
551 return ParamListPtr(list, ckmc_param_list_free);
554 void assert_buffers_equal(const ckmc_raw_buffer_s b1, const ckmc_raw_buffer_s b2, bool equal)
557 RUNNER_ASSERT_MSG(b1.size == b2.size, "Buffer size differs: " << b1.size << "!=" << b2.size);
558 RUNNER_ASSERT_MSG(0 == memcmp(b1.data, b2.data, b1.size), "Buffer contents differ");
560 RUNNER_ASSERT_MSG(b1.size != b2.size || 0 != memcmp(b1.data, b2.data, b1.size),
561 "Buffers should be different");
565 RawBufferPtr create_raw_buffer(ckmc_raw_buffer_s* buffer)
567 return RawBufferPtr(buffer, ckmc_buffer_free);