2 * Copyright (c) 2000 - 2015 Samsung Electronics Co.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License
17 * @author Maciej Karpiuk (m.karpiuk2@samsung.com)
20 #include <dpl/test/test_runner.h>
21 #include <dpl/test/test_runner_child.h>
22 #include <tests_common.h>
23 #include <ckm-common.h>
24 #include <ckm-privileged-common.h>
25 #include <ckm/ckm-control.h>
26 #include <ckmc/ckmc-manager.h>
27 #include <access_provider2.h>
34 const uid_t USER_APP = 5070;
35 const uid_t GROUP_APP = 5070;
36 const char* APP_PASS = "user-pass";
38 const char *XML_DEVICE_KEY = "device_key.xml";
40 const char *XML_1_okay = "XML_1_okay.xml";
41 std::string XML_1_EXPECTED_KEY_1_RSA = aliasWithLabel(ckmc_owner_id_system, "test-key1");
42 std::string XML_1_EXPECTED_KEY_1_PASSWD = "123";
43 std::string XML_1_EXPECTED_KEY_2_RSA = aliasWithLabel(ckmc_owner_id_system, "test-key2");
44 // uncomment when AES is supported (+ usage in the tests)
45 std::string XML_1_EXPECTED_KEY_3_AES = aliasWithLabel(ckmc_owner_id_system, "test-aes1");
46 std::string XML_1_EXPECTED_CERT_1 = aliasWithLabel(ckmc_owner_id_system, "test-cert1");
47 std::string XML_1_EXPECTED_DATA_1 = aliasWithLabel(ckmc_owner_id_system, "test-data1");
48 const char *XML_1_EXPECTED_DATA_1_DATA = "My secret data";
50 std::string XML_1_EXPECTED_KEY_3_RSA_PRV = aliasWithLabel(ckmc_owner_id_system, "test-encryption-prv");
51 std::string XML_1_EXPECTED_KEY_3_RSA_PUB = aliasWithLabel(ckmc_owner_id_system, "test-encryption-pub");
52 std::string XML_1_EXPECTED_ASCII_DATA = aliasWithLabel(ckmc_owner_id_system, "test-ascii-data-encryption");
53 std::string XML_1_EXPECTED_BIG_DATA = aliasWithLabel(ckmc_owner_id_system, "test-binary-data-encryption");
55 const char *XML_2_okay = "XML_2_okay.xml";
56 std::string XML_2_EXPECTED_KEY_1_RSA = aliasWithLabel(ckmc_owner_id_system, "test2-key1");
57 std::string XML_2_EXPECTED_KEY_2_RSA = aliasWithLabel(ckmc_owner_id_system, "test2-key2");
58 // uncomment when AES is supported
59 std::string XML_2_EXPECTED_KEY_3_AES = aliasWithLabel(ckmc_owner_id_system, "test2-aes1");
60 std::string XML_2_EXPECTED_CERT_1 = aliasWithLabel(ckmc_owner_id_system, "test2-cert1");
61 std::string XML_2_EXPECTED_DATA_1 = aliasWithLabel(ckmc_owner_id_system, "test2-data1");
62 const char *XML_2_EXPECTED_DATA_1_DATA = "My secret data";
64 const char *XML_3_wrong = "XML_3_wrong.xml";
65 std::string XML_3_EXPECTED_KEY_1_RSA = aliasWithLabel(ckmc_owner_id_system, "test3-key1");
66 std::string XML_3_EXPECTED_KEY_2_RSA = aliasWithLabel(ckmc_owner_id_system, "test3-key2");
67 // uncomment when AES is supported
68 std::string XML_3_EXPECTED_CERT_1 = aliasWithLabel(ckmc_owner_id_system, "test3-cert1");
69 std::string XML_3_EXPECTED_DATA_1 = aliasWithLabel(ckmc_owner_id_system, "test3-data1");
71 std::string format_src_path(const char *file)
73 return std::string(CKM_TEST_DIR) + std::string(file);
76 std::string format_dest_key_path(const char *file)
78 return std::string(CKM_RW_DATA_DIR) + std::string(file);
81 std::string format_dest_path(const char *file)
83 return std::string(CKM_RW_DATA_DIR) + std::string( "/initial_values/") + std::string(file);
86 void copy_file(const std::string &from, const std::string &to)
88 std::ifstream infile(from, std::ios_base::binary);
89 RUNNER_ASSERT_MSG(infile, "Input file " << from << " does not exist.");
90 std::ofstream outfile(to, std::ios_base::binary);
91 RUNNER_ASSERT_MSG(outfile, "Output file " << to << " does not exist. Reinstall key-manager.");
92 outfile << infile.rdbuf();
95 void restart_key_manager()
97 stop_service(MANAGER);
98 start_service(MANAGER);
101 void test_exists(const std::string& name, bool expected) {
102 bool file_exists = (access( name.c_str(), F_OK ) != -1);
103 RUNNER_ASSERT_MSG(file_exists == expected,
104 "File " << name << " status: " << file_exists <<
105 " while expected: " << expected);
111 RUNNER_TEST_GROUP_INIT(T60_INITIAL_VALUES);
113 RUNNER_TEST(T6001_init)
117 // copy to the initial-values folder
118 // check XML file exists
119 // restart the key-manager
120 // check XML file doesn't exist
122 copy_file(format_src_path(XML_DEVICE_KEY), format_dest_key_path(XML_DEVICE_KEY));
123 copy_file(format_src_path(XML_1_okay), format_dest_path(XML_1_okay));
124 copy_file(format_src_path(XML_2_okay), format_dest_path(XML_2_okay));
125 copy_file(format_src_path(XML_3_wrong), format_dest_path(XML_3_wrong));
127 test_exists(format_dest_path(XML_1_okay), true);
128 test_exists(format_dest_path(XML_2_okay), true);
129 test_exists(format_dest_path(XML_3_wrong), true);
131 restart_key_manager();
133 test_exists(format_dest_path(XML_1_okay), false);
134 test_exists(format_dest_path(XML_2_okay), false);
135 test_exists(format_dest_path(XML_3_wrong), false);
138 RUNNER_TEST(T6010_PARSE_XML_FILE_AT_STARTUP)
141 // check items existence as system service
143 // check items existence as TEST_LABEL
145 // check items existence as TEST_LABEL_2
149 ScopedAccessProvider ap(SYSTEM_LABEL);
150 ap.applyAndSwithToUser(0, 0);
151 check_key(XML_1_EXPECTED_KEY_1_RSA.c_str(), CKMC_ERROR_NOT_EXPORTABLE);
152 check_key_allowed(XML_1_EXPECTED_KEY_2_RSA.c_str(), CKMC_KEY_RSA_PRIVATE);
153 check_key_allowed(XML_1_EXPECTED_KEY_3_AES.c_str(), CKMC_KEY_AES);
154 check_cert_allowed(XML_1_EXPECTED_CERT_1.c_str());
155 check_read_allowed(XML_1_EXPECTED_DATA_1.c_str(), XML_1_EXPECTED_DATA_1_DATA);
160 ScopedDBUnlock unlock(USER_APP, APP_PASS);
161 ScopedAccessProvider ap(TEST_LABEL);
162 ap.applyAndSwithToUser(USER_APP, GROUP_APP);
164 check_key(XML_1_EXPECTED_KEY_1_RSA.c_str(), CKMC_ERROR_NOT_EXPORTABLE);
165 check_key_not_visible(XML_1_EXPECTED_KEY_2_RSA.c_str());
166 check_key_allowed(XML_1_EXPECTED_KEY_3_AES.c_str(), CKMC_KEY_AES);
167 check_cert_not_visible(XML_1_EXPECTED_CERT_1.c_str());
168 check_read_allowed(XML_1_EXPECTED_DATA_1.c_str(), XML_1_EXPECTED_DATA_1_DATA);
173 ScopedDBUnlock unlock(USER_APP, APP_PASS);
174 ScopedAccessProvider ap(TEST_LABEL_2);
175 ap.applyAndSwithToUser(USER_APP, GROUP_APP);
177 check_key_not_visible(XML_1_EXPECTED_KEY_1_RSA.c_str());
178 check_key_allowed(XML_1_EXPECTED_KEY_2_RSA.c_str(), CKMC_KEY_RSA_PRIVATE);
179 check_key_allowed(XML_1_EXPECTED_KEY_3_AES.c_str(), CKMC_KEY_AES);
180 check_cert_allowed(XML_1_EXPECTED_CERT_1.c_str());
181 check_read_allowed(XML_1_EXPECTED_DATA_1.c_str(), XML_1_EXPECTED_DATA_1_DATA);
185 RUNNER_TEST(T6020_PARSE_TWO_XML_FILES_AT_STARTUP)
188 // check items existence as system service
189 check_key(XML_1_EXPECTED_KEY_1_RSA.c_str(), CKMC_ERROR_NOT_EXPORTABLE);
190 check_key(XML_2_EXPECTED_KEY_1_RSA.c_str(), CKMC_ERROR_NOT_EXPORTABLE);
191 check_key_allowed(XML_1_EXPECTED_KEY_2_RSA.c_str(), CKMC_KEY_RSA_PRIVATE);
192 check_key_allowed(XML_2_EXPECTED_KEY_2_RSA.c_str(), CKMC_KEY_RSA_PRIVATE);
193 check_key_allowed(XML_1_EXPECTED_KEY_3_AES.c_str(), CKMC_KEY_AES);
194 check_key_allowed(XML_2_EXPECTED_KEY_3_AES.c_str(), CKMC_KEY_AES);
195 check_cert_allowed(XML_1_EXPECTED_CERT_1.c_str());
196 check_cert_allowed(XML_2_EXPECTED_CERT_1.c_str());
197 check_read_allowed(XML_1_EXPECTED_DATA_1.c_str(), XML_1_EXPECTED_DATA_1_DATA);
198 check_read_allowed(XML_2_EXPECTED_DATA_1.c_str(), XML_2_EXPECTED_DATA_1_DATA);
201 RUNNER_TEST(T6030_PARSE_FAIL_XML_AT_STARTUP)
204 // check items existence as system service - nothing should be available
205 check_key_not_visible(XML_3_EXPECTED_KEY_1_RSA.c_str());
206 check_key_not_visible(XML_3_EXPECTED_KEY_2_RSA.c_str());
207 check_cert_not_visible(XML_3_EXPECTED_CERT_1.c_str());
208 check_read_not_visible(XML_3_EXPECTED_DATA_1.c_str());
211 RUNNER_TEST(T6040_CHECK_KEYS_VALID)
214 // check if key can create & verify signature
215 ckmc_raw_buffer_s msg_buff = prepare_message_buffer("Raz ugryzla misia pszczola..");
216 ckmc_hash_algo_e hash_algo = CKMC_HASH_SHA256;
217 ckmc_rsa_padding_algo_e pad_algo = CKMC_PKCS1_PADDING;
218 ckmc_raw_buffer_s *signature = NULL;
221 CKMC_ERROR_NONE == (temp = ckmc_create_signature(
222 XML_1_EXPECTED_KEY_2_RSA.c_str(),
228 CKMCReadableError(temp));
232 CKMC_ERROR_AUTHENTICATION_FAILED == (temp = ckmc_verify_signature(
233 XML_1_EXPECTED_KEY_1_RSA.c_str(),
239 CKMCReadableError(temp));
243 CKMC_ERROR_NONE == (temp = ckmc_verify_signature(
244 XML_1_EXPECTED_KEY_1_RSA.c_str(),
245 XML_1_EXPECTED_KEY_1_PASSWD.c_str(),
250 CKMCReadableError(temp));
252 ckmc_buffer_free(signature);
255 RUNNER_TEST(T6050_ENCRYPTED_KEY)
258 // to encrypt using RSA OAEP: openssl rsautl -encrypt -oaep -pubin -inkey pub.key -in input.txt -out cipher.out
259 // to decrypt RSA OAEP cipher: openssl rsautl -decrypt -oaep -in cipher.out -out plaintext -inkey priv.key
261 // check if encrypted private key is present
262 // check if public key is present
264 // extract the private, encrypted key
265 // extract the public key
266 // create signature using the public key
267 // verify signature using the decrypted private key
270 check_key_allowed(XML_1_EXPECTED_KEY_3_RSA_PRV.c_str(), CKMC_KEY_RSA_PRIVATE);
271 check_key_allowed(XML_1_EXPECTED_KEY_3_RSA_PUB.c_str(), CKMC_KEY_RSA_PUBLIC);
274 ckmc_raw_buffer_s msg_buff = prepare_message_buffer("Raz ugryzla misia pszczola..");
275 ckmc_hash_algo_e hash_algo = CKMC_HASH_SHA256;
276 ckmc_rsa_padding_algo_e pad_algo = CKMC_PKCS1_PADDING;
277 ckmc_raw_buffer_s *signature = NULL;
280 CKMC_ERROR_NONE == (temp = ckmc_create_signature(
281 XML_1_EXPECTED_KEY_3_RSA_PRV.c_str(),
287 CKMCReadableError(temp));
291 CKMC_ERROR_NONE == (temp = ckmc_verify_signature(
292 XML_1_EXPECTED_KEY_3_RSA_PUB.c_str(),
298 CKMCReadableError(temp));
300 ckmc_buffer_free(signature);
303 RUNNER_TEST(T6060_ENCRYPTED_ASCII_DATA)
306 // to encrypt using RSA OAEP: openssl rsautl -encrypt -oaep -pubin -inkey pub.key -in input.txt -out cipher.out
307 // to decrypt RSA OAEP cipher: openssl rsautl -decrypt -oaep -in cipher.out -out plaintext -inkey priv.key
310 // check if data matches the expected size and content
313 ckmc_raw_buffer_s *testData1;
316 CKMC_ERROR_NONE == (temp = ckmc_get_data(XML_1_EXPECTED_ASCII_DATA.c_str(), NULL, &testData1)),
317 CKMCReadableError(temp));
318 size_t expected_len = 15;
319 RUNNER_ASSERT_MSG(expected_len /* src/ckm/keys/EIV/ascii_data */ == testData1->size, "invalid data size");
320 RUNNER_ASSERT_MSG(memcmp(reinterpret_cast<char*>(testData1->data), "My secret data\n", expected_len) == 0, "invalid data contents");
321 ckmc_buffer_free(testData1);
324 RUNNER_TEST(T6070_ENCRYPTED_BIG_DATA)
327 // to encrypt using RSA OAEP: openssl rsautl -encrypt -oaep -pubin -inkey pub.key -in input.txt -out cipher.out
328 // to decrypt RSA OAEP cipher: openssl rsautl -decrypt -oaep -in cipher.out -out plaintext -inkey priv.key
331 // check if data matches the expected size
334 ckmc_raw_buffer_s *testData1;
337 CKMC_ERROR_NONE == (temp = ckmc_get_data(XML_1_EXPECTED_BIG_DATA.c_str(), NULL, &testData1)),
338 CKMCReadableError(temp));
339 RUNNER_ASSERT_MSG(5918 /* src/ckm/keys/EIV/code.png */ == testData1->size, "invalid data size");
340 ckmc_buffer_free(testData1);
343 RUNNER_TEST(T6999_deinit)