tests/encryption-scheme/scheme-test.cpp

   1 /*
   2  *  Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
   3  *
   4  *  Licensed under the Apache License, Version 2.0 (the "License");
   5  *  you may not use this file except in compliance with the License.
   6  *  You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  *  Unless required by applicable law or agreed to in writing, software
  11  *  distributed under the License is distributed on an "AS IS" BASIS,
  12  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  *  See the License for the specific language governing permissions and
  14  *  limitations under the License
  15  */
  16 /*
  17  * @file       scheme-test.cpp
  18  * @author     Krzysztof Jackiewicz (k.jackiewicz@samsung.com)
  19  * @version    1.0
  20  */
  21 #include <scheme-test.h>
  22
  23 #include <sys/smack.h>
  24 #include <sys/types.h>
  25 #include <sys/stat.h>
  26 #include <sys/sendfile.h>
  27 #include <fcntl.h>
  28 #include <unistd.h>
  29 #include <string.h>
  30 #include <grp.h>
  31 #include <pwd.h>
  32
  33 #include <fstream>
  34 #include <stdexcept>
  35 #include <vector>
  36
  37 #include <boost/test/unit_test.hpp>
  38
  39 #include <smack-access.h>
  40
  41 #include <db-crypto.h>
  42 #include <file-system.h>
  43 #include <key-provider.h>
  44 #include <db-row.h>
  45 #include <crypto-init.h>
  46 #include <dpl/errno_string.h>
  47
  48 using namespace CKM;
  49 using namespace std;
  50
  51 namespace {
  52 const uid_t UID = 7654;
  53 const gid_t GID = 7654;
  54 const char* const DBPASS = "db-pass";
  55 const char* const LABEL = "my-label";
  56 const Label DB_LABEL = "/" + string(LABEL);
  57 const int ENC_SCHEME_OFFSET = 24;
  58 const string TEST_DATA_STR = "test-data";
  59 RawBuffer TEST_DATA(TEST_DATA_STR.begin(), TEST_DATA_STR.end());
  60 const Password TEST_PASS = "custom user password";
  61 const size_t IV_LEN = 16;
  62 const size_t CHAIN_LEN = 3;
  63
  64 enum {
  65     NO_PASS = 0,
  66     PASS = 1
  67 };
  68
  69 enum {
  70     NO_EXP = 0,
  71     EXP = 1
  72 };
  73
  74 // [password][exportable]
  75 Policy policy[2][2] = {
  76         {{ Password(), false }, { Password(), true }},
  77         {{ TEST_PASS,  false }, { TEST_PASS,  true }},
  78 };
  79
  80 struct Group {
  81     enum {
  82         SINGLE_ITEM,
  83         KEY_PAIR_RSA,
  84         CERT_CHAIN
  85     } type;
  86     Items items;
  87 };
  88
  89 Group GROUPS[] = {
  90     // Data
  91     { Group::SINGLE_ITEM, {
  92             Item("data-alias1", DataType::BINARY_DATA,  policy[NO_PASS][EXP])
  93     }},
  94     { Group::SINGLE_ITEM, {
  95             Item("data-alias2", DataType::BINARY_DATA,  policy[PASS][EXP])
  96     }},
  97
  98     // RSA keys
  99     { Group::KEY_PAIR_RSA, {
 100             Item("key-rsa-alias-prv1", DataType::KEY_RSA_PRIVATE,  policy[NO_PASS][NO_EXP]),
 101             Item("key-rsa-alias-pub1", DataType::KEY_RSA_PUBLIC,   policy[NO_PASS][NO_EXP])
 102     }},
 103     { Group::KEY_PAIR_RSA, {
 104             Item("key-rsa-alias-prv2", DataType::KEY_RSA_PRIVATE,  policy[NO_PASS][EXP]),
 105             Item("key-rsa-alias-pub2", DataType::KEY_RSA_PUBLIC,   policy[NO_PASS][EXP]),
 106     }},
 107     { Group::KEY_PAIR_RSA, {
 108             Item("key-rsa-alias-prv3", DataType::KEY_RSA_PRIVATE,  policy[PASS][NO_EXP]),
 109             Item("key-rsa-alias-pub3", DataType::KEY_RSA_PUBLIC,   policy[PASS][NO_EXP]),
 110     }},
 111     { Group::KEY_PAIR_RSA, {
 112             Item("key-rsa-alias-prv4", DataType::KEY_RSA_PRIVATE,  policy[PASS][EXP]),
 113             Item("key-rsa-alias-pub4", DataType::KEY_RSA_PUBLIC,   policy[PASS][EXP]),
 114     }},
 115     // different policies
 116     { Group::KEY_PAIR_RSA, {
 117             Item("key-rsa-alias-prv5", DataType::KEY_RSA_PRIVATE,  policy[PASS][NO_EXP]),
 118             Item("key-rsa-alias-pub5", DataType::KEY_RSA_PUBLIC,   policy[NO_PASS][EXP]),
 119     }},
 120
 121     // AES
 122     { Group::SINGLE_ITEM, {
 123             Item("key-aes-alias1",     DataType::KEY_AES,          policy[NO_PASS][NO_EXP]),
 124     }},
 125     { Group::SINGLE_ITEM, {
 126             Item("key-aes-alias2",     DataType::KEY_AES,          policy[NO_PASS][EXP]),
 127     }},
 128     { Group::SINGLE_ITEM, {
 129             Item("key-aes-alias3",     DataType::KEY_AES,          policy[PASS][NO_EXP]),
 130     }},
 131     { Group::SINGLE_ITEM, {
 132             Item("key-aes-alias4",     DataType::KEY_AES,          policy[PASS][EXP]),
 133     }},
 134
 135     // Certificates
 136     { Group::CERT_CHAIN, {
 137             Item("cert-root-alias1",   DataType::CERTIFICATE,      policy[NO_PASS][NO_EXP]),
 138             Item("cert-im-ca-alias1",  DataType::CERTIFICATE,      policy[NO_PASS][NO_EXP]),
 139             Item("cert-leaf-alias1",   DataType::CERTIFICATE,      policy[NO_PASS][NO_EXP]),
 140     }},
 141     { Group::CERT_CHAIN, {
 142             Item("cert-root-alias2",   DataType::CERTIFICATE,      policy[NO_PASS][EXP]),
 143             Item("cert-im-ca-alias2",  DataType::CERTIFICATE,      policy[NO_PASS][EXP]),
 144             Item("cert-leaf-alias2",   DataType::CERTIFICATE,      policy[NO_PASS][EXP]),
 145     }},
 146     { Group::CERT_CHAIN, {
 147             Item("cert-root-alias3",   DataType::CERTIFICATE,      policy[PASS][NO_EXP]),
 148             Item("cert-im-ca-alias3",  DataType::CERTIFICATE,      policy[PASS][NO_EXP]),
 149             Item("cert-leaf-alias3",   DataType::CERTIFICATE,      policy[PASS][NO_EXP]),
 150     }},
 151     { Group::CERT_CHAIN, {
 152             Item("cert-root-alias4",   DataType::CERTIFICATE,      policy[PASS][EXP]),
 153             Item("cert-im-ca-alias4",  DataType::CERTIFICATE,      policy[PASS][EXP]),
 154             Item("cert-leaf-alias4",   DataType::CERTIFICATE,      policy[PASS][EXP]),
 155     }},
 156
 157     // PKCS
 158     { Group::SINGLE_ITEM, {
 159             Item("pkcs-alias1",        DataType::CHAIN_CERT_0,     policy[NO_PASS][NO_EXP]),
 160     }},
 161     { Group::SINGLE_ITEM, {
 162             Item("pkcs-alias2",        DataType::CHAIN_CERT_0,     policy[NO_PASS][EXP]),
 163     }},
 164     { Group::SINGLE_ITEM, {
 165             Item("pkcs-alias3",        DataType::CHAIN_CERT_0,     policy[PASS][NO_EXP]),
 166     }},
 167     { Group::SINGLE_ITEM, {
 168             Item("pkcs-alias4",        DataType::CHAIN_CERT_0,     policy[PASS][EXP]),
 169     }},
 170 };
 171
 172 const size_t CHAIN_SIZE = 3;
 173
 174 // TEST_ROOT_CA, expires 2035
 175 std::string TEST_ROOT_CA =
 176     "-----BEGIN CERTIFICATE-----\n"
 177     "MIIDnzCCAoegAwIBAgIJAMH/ADkC5YSTMA0GCSqGSIb3DQEBBQUAMGYxCzAJBgNV\n"
 178     "BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMQ0wCwYDVQQKDARBQ01FMRAwDgYD\n"
 179     "VQQLDAdUZXN0aW5nMSEwHwYDVQQDDBhUZXN0IHJvb3QgY2EgY2VydGlmaWNhdGUw\n"
 180     "HhcNMTQxMjMwMTcyMTUyWhcNMjQxMjI3MTcyMTUyWjBmMQswCQYDVQQGEwJBVTET\n"
 181     "MBEGA1UECAwKU29tZS1TdGF0ZTENMAsGA1UECgwEQUNNRTEQMA4GA1UECwwHVGVz\n"
 182     "dGluZzEhMB8GA1UEAwwYVGVzdCByb290IGNhIGNlcnRpZmljYXRlMIIBIjANBgkq\n"
 183     "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0EJRdUtd2th0vTVF7QxvDKzyFCF3w9vC\n"
 184     "9IDE/Yr12w+a9jd0s7/eG96qTHIYffS3B7x2MB+d4n+SR3W0qmYh7xk8qfEgH3da\n"
 185     "eDoV59IZ9r543KM+g8jm6KffYGX1bIJVVY5OhBRbO9nY6byYpd5kbCIUB6dCf7/W\n"
 186     "rQl1aIdLGFIegAzPGFPXDcU6F192686x54bxt/itMX4agHJ9ZC/rrTBIZghVsjJo\n"
 187     "5/AH5WZpasv8sfrGiiohAxtieoYoJkv5MOYP4/2lPlOY+Cgw1Yoz+HHv31AllgFs\n"
 188     "BquBb/kJVmCCNsAOcnvQzTZUsW/TXz9G2nwRdqI1nSy2JvVjZGsqGQIDAQABo1Aw\n"
 189     "TjAdBgNVHQ4EFgQUt6pkzFt1PZlfYRL/HGnufF4frdwwHwYDVR0jBBgwFoAUt6pk\n"
 190     "zFt1PZlfYRL/HGnufF4frdwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOC\n"
 191     "AQEAld7Qwq0cdzDQ51w1RVLwTR8Oy25PB3rzwEHcSGJmdqlMi3xOdaz80S1R1BBX\n"
 192     "ldvGBG5Tn0vT7xSuhmSgI2/HnBpy9ocHVOmhtNB4473NieEpfTYrnGXrFxu46Wus\n"
 193     "9m/ZnugcQ2G6C54A/NFtvgLmaC8uH8M7gKdS6uYUwJFQEofkjmd4UpOYSqmcRXhS\n"
 194     "Jzd5FYFWkJhKJYp3nlENSOD8CUFFVGekm05nFN2gRVc/qaqQkEX77+XYvhodLRsV\n"
 195     "qMn7nf7taidDKLO2T4bhujztnTYOhhaXKgPy7AtZ28N2wvX96VyAPB/vrchGmyBK\n"
 196     "kOg11TpPdNDkhb1J4ZCh2gupDg==\n"
 197     "-----END CERTIFICATE-----\n";
 198
 199 // TEST_IM_CA, signed by TEST_ROOT_CA, expires 2035
 200 std::string TEST_IM_CA =
 201     "-----BEGIN CERTIFICATE-----\n"
 202     "MIIDljCCAn6gAwIBAgICEAAwDQYJKoZIhvcNAQEFBQAwZjELMAkGA1UEBhMCQVUx\n"
 203     "EzARBgNVBAgMClNvbWUtU3RhdGUxDTALBgNVBAoMBEFDTUUxEDAOBgNVBAsMB1Rl\n"
 204     "c3RpbmcxITAfBgNVBAMMGFRlc3Qgcm9vdCBjYSBjZXJ0aWZpY2F0ZTAeFw0xNTAx\n"
 205     "MTYxNjQ1MzRaFw0zNTAxMTExNjQ1MzRaMGQxCzAJBgNVBAYTAkFVMRMwEQYDVQQI\n"
 206     "DApTb21lLVN0YXRlMQ0wCwYDVQQKDARBQ01FMRAwDgYDVQQLDAdUZXN0aW5nMR8w\n"
 207     "HQYDVQQDDBZUZXN0IElNIENBIGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEF\n"
 208     "AAOCAQ8AMIIBCgKCAQEAzmBF78qClgoKfnLAncMXZwZ14TW+5kags1+QCYeg3c7j\n"
 209     "L9+RvDxIaX2tKf1sukJcwQfYqUlQkwt+58LMOb2ORtkpj8Or6WCWCZ0BzneT8ug7\n"
 210     "nxJT4m9+bohMF0JoKjjB2H4KNMHamLIwUxRKt6nyfk81kVhJOi2vzzxd+UCPi6Pc\n"
 211     "UAbJNH48eNgOIg55nyFovVzYj8GIo/9GvHJj83PPa/KlJZ+Z1qZASZZ/VYorplVT\n"
 212     "thsHXKfejhFy5YJ9t7n/vyAQsyBsagZsvX19xnH41fbYXHKf8UbXG23rNaZlchs6\n"
 213     "XJVLQdzOpj3WTj/lCocVHqLaZISLhNQ3aI7kUBUdiwIDAQABo1AwTjAdBgNVHQ4E\n"
 214     "FgQUoCYNaCBP4jl/3SYQuK8Ka+6i3QEwHwYDVR0jBBgwFoAUt6pkzFt1PZlfYRL/\n"
 215     "HGnufF4frdwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjRzWiD97\n"
 216     "Htv4Kxpm3P+C+xP9AEteCJfO+7p8MWgtWEJOknJyt55zeKS2JwZIq57KcbqD8U7v\n"
 217     "vAUx1ymtUhlFPFd7J1mJ3pou+3aFYmGShYhGHpbrmUwjp7HVP588jrW1NoZVHdMc\n"
 218     "4OgJWFrViXeu9+maIcekjMB/+9Y0dUgQuK5ZuT5H/Jwet7Th/o9uufTUZjBzRvrB\n"
 219     "pbXgQpqgME2av4Q/6LuldPCTHLtWXgFUU2R+yCGmuGilvhFJnKoQryAbYnIQNWE8\n"
 220     "SLoHQ9s1i7Zyb7HU6UAaqMOz15LBkyAqtNyJcO2p7Q/p5YK0xfD4xisI5qXucqVm\n"
 221     "F2obL5qJSTN/RQ==\n"
 222     "-----END CERTIFICATE-----\n";
 223
 224 // TEST_LEAF, signed by TEST_IM_CA, expires 2035
 225 std::string TEST_LEAF =
 226     "-----BEGIN CERTIFICATE-----\n"
 227     "MIIDOzCCAiMCAQEwDQYJKoZIhvcNAQEFBQAwZDELMAkGA1UEBhMCQVUxEzARBgNV\n"
 228     "BAgMClNvbWUtU3RhdGUxDTALBgNVBAoMBEFDTUUxEDAOBgNVBAsMB1Rlc3Rpbmcx\n"
 229     "HzAdBgNVBAMMFlRlc3QgSU0gQ0EgY2VydGlmaWNhdGUwHhcNMTUwMTE2MTY0ODE0\n"
 230     "WhcNMzUwMTExMTY0ODE0WjBjMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1T\n"
 231     "dGF0ZTENMAsGA1UECgwEQUNNRTEQMA4GA1UECwwHVGVzdGluZzEeMBwGA1UEAwwV\n"
 232     "VGVzdCBsZWFmIGNlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
 233     "CgKCAQEAzTdDIa2tDmRxFnIgiG+mBz8GoSVODs0ImNQGbqj+pLhBOFRH8fsah4Jl\n"
 234     "z5YF9KwhMVLknnHGFLE/Nb7Ac35kEzhMQMpTRxohW83oxw3eZ8zN/FBoKqg4qHRq\n"
 235     "QR8kS10YXTgrBR0ex/Vp+OUKEw6h7yL2r4Tpvrn9/qHwsxtLxqWbDIVf1O9b1Lfc\n"
 236     "bllYMdmV5E62yN5tcwrDP8gvHjFnVeLzrG8wTpc9FR90/0Jkfp5jAJcArOBLrT0E\n"
 237     "4VRqs+4HuwT8jAwFAmNnc7IYX5qSjtSWkmmHe73K/lzB+OiI0JEc/3eWUTWqwTSk\n"
 238     "4tNCiQGBKJ39LXPTBBJdzmxVH7CUDQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQAp\n"
 239     "UdDOGu3hNiG+Vn10aQ6B1ZmOj3t+45gUV3sC+y8hB8EK1g4P5Ke9bVDts0T5eOnj\n"
 240     "CSc+6VoND5O4adI0IFFRFljHNVnvjeosHfUZNnowsmA2ptQBtC1g5ZKRvKXlkC5/\n"
 241     "i5BGgRqPFA7y9WB9Y05MrJHf3E+Oz/RBsLeeNiNN+rF5X1vYExvGHpo0M0zS0ze9\n"
 242     "HtC0aOy8ocsTrQkf3ceHTAXx2i8ftoSSD4klojtWFpWMrNQa52F7wB9nU6FfKRuF\n"
 243     "Zj/T1JkYXKkEwZU6nAR2jdZp3EP9xj3o15V/tyFcXHx6l8NTxn4cJb+Xe4VquQJz\n"
 244     "6ON7PVe0ABN/AlwVQiFE\n"
 245     "-----END CERTIFICATE-----\n";
 246
 247
 248
 249 struct FdCloser {
 250     void operator()(int* fd) {
 251         if(fd)
 252             close(*fd);
 253     }
 254 };
 255
 256 typedef std::unique_ptr<int, FdCloser> FdPtr;
 257
 258 uid_t getUid(const char *name) {
 259     struct passwd pwd;
 260     struct passwd *result = nullptr;
 261     int bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
 262     if (bufsize <= 0)
 263         bufsize = 16384; /* should be more than enough */
 264
 265     memset(&pwd, 0x00, sizeof(pwd));
 266
 267     std::vector<char> buf(bufsize, 0);
 268
 269     int ret = getpwnam_r(name, &pwd, buf.data(), bufsize, &result);
 270     BOOST_REQUIRE_MESSAGE(ret == 0 && result, "getpwnam_r failed");
 271
 272     return pwd.pw_uid;
 273 }
 274
 275 gid_t getGid(const char *name) {
 276     struct group grp;
 277     struct group *result = nullptr;
 278     size_t bufsize = sysconf(_SC_GETGR_R_SIZE_MAX);
 279     if (bufsize <= 0)
 280         bufsize = 16384; /* should be more than enough */
 281
 282     memset(&grp, 0x00, sizeof(grp));
 283
 284     std::vector<char> buf(bufsize, 0);
 285
 286     int ret = getgrnam_r(name, &grp, buf.data(), bufsize, &result);
 287     BOOST_REQUIRE_MESSAGE(ret == 0 && result, "getgrnam_r failed");
 288
 289     return grp.gr_gid;
 290 }
 291
 292 void restoreFile(const string& filename) {
 293     static uid_t CKM_UID = getUid(USER_NAME);
 294     static gid_t CKM_GID = getGid(GROUP_NAME);
 295     string sourcePath = string(DB_TEST_DIR) + "/" + filename;
 296     string targetPath = string(RW_DATA_DIR) + "/" + filename;
 297
 298     int err, ret;
 299
 300     int sourceFd = TEMP_FAILURE_RETRY(open(sourcePath.c_str(), O_RDONLY));
 301     err = errno;
 302     BOOST_REQUIRE_MESSAGE(sourceFd > 0, "Opening " << sourcePath << " failed: " << GetErrnoString(err));
 303
 304     FdPtr sourceFdPtr(&sourceFd);
 305
 306     int targetFd = TEMP_FAILURE_RETRY(creat(targetPath.c_str(), 0644));
 307     err = errno;
 308     BOOST_REQUIRE_MESSAGE(targetFd > 0, "Creating " << targetPath << " failed: " << GetErrnoString(err));
 309
 310     ret = fchown(targetFd, CKM_UID, CKM_GID);
 311     err = errno;
 312     BOOST_REQUIRE_MESSAGE(ret != -1, "fchown() failed: " << GetErrnoString(err));
 313
 314     FdPtr targetFdPtr(&targetFd);
 315
 316     struct stat sourceStat;
 317     ret = fstat(sourceFd, &sourceStat);
 318     err = errno;
 319     BOOST_REQUIRE_MESSAGE(ret != -1, "fstat() failed: " << GetErrnoString(err));
 320
 321     ret = sendfile(targetFd, sourceFd, 0, sourceStat.st_size);
 322     err = errno;
 323     BOOST_REQUIRE_MESSAGE(ret != -1, "sendfile() failed: " << GetErrnoString(err));
 324
 325     ret = fsync(targetFd);
 326     err = errno;
 327     BOOST_REQUIRE_MESSAGE(ret != -1, "fsync() failed: " << GetErrnoString(err));
 328 }
 329
 330 void generateRandom(size_t random_bytes, unsigned char *output)
 331 {
 332     if(random_bytes<=0 || !output)
 333         throw runtime_error("Invalid param");
 334
 335     std::ifstream is("/dev/urandom", std::ifstream::binary);
 336     if(!is)
 337         throw runtime_error("Failed to read /dev/urandom");
 338     is.read(reinterpret_cast<char*>(output), random_bytes);
 339     if(static_cast<std::streamsize>(random_bytes) != is.gcount())
 340         throw runtime_error("Not enough bytes read from /dev/urandom");
 341 }
 342
 343 RawBuffer createRandomBuffer(size_t random_bytes)
 344 {
 345     RawBuffer buffer(random_bytes);
 346     generateRandom(buffer.size(), buffer.data());
 347     return buffer;
 348 }
 349 } // namespace anonymous
 350
 351
 352 SchemeTest::SchemeTest() : m_userChanged(false), m_directAccessEnabled(false) {
 353     m_control = Control::create();
 354     m_mgr = Manager::create();
 355     initOpenSsl();
 356
 357     SmackAccess sa;
 358     sa.add("System", LABEL, "rwx");
 359     sa.add(LABEL, "System", "rwx");
 360     sa.add(LABEL, "System::Run", "x");
 361     sa.apply();
 362 }
 363
 364 SchemeTest::~SchemeTest() {
 365     try {
 366         SwitchToRoot();
 367     } catch (...) {}
 368 }
 369
 370 void SchemeTest::RemoveUserData() {
 371     if(CKM_API_SUCCESS != m_control->lockUserKey(UID))
 372         throw runtime_error("lockUserKey failed");
 373
 374     if(CKM_API_SUCCESS != m_control->removeUserData(UID))
 375         throw runtime_error("removeUserData failed");
 376 }
 377
 378 void SchemeTest::SwitchToUser() {
 379     if (m_userChanged)
 380         return;
 381
 382     if(CKM_API_SUCCESS != m_control->unlockUserKey(UID, DBPASS))
 383         throw runtime_error("unlockUserKey failed");
 384
 385     // get calling label
 386     char* label = NULL;
 387     if (smack_new_label_from_self(&label) <= 0)
 388         throw runtime_error("smack_new_label_from_self failed");
 389
 390     m_origLabel = string(label);
 391     free(label);
 392
 393     if(0 > smack_set_label_for_self(LABEL))
 394         throw runtime_error("smack_set_label_for_self failed");
 395
 396     if(0 > setegid(GID))
 397         throw runtime_error("setegid failed");
 398
 399     if(0 > seteuid(UID))
 400         throw runtime_error("seteuid failed");
 401
 402     m_userChanged = true;
 403 }
 404
 405 void SchemeTest::SwitchToRoot() {
 406     if (!m_userChanged)
 407         return;
 408
 409     if(0 > seteuid(0))
 410         throw runtime_error("seteuid failed");
 411     if(0 > setegid(0))
 412         throw runtime_error("setegid failed");
 413
 414     if(0 > smack_set_label_for_self(m_origLabel.c_str()))
 415         throw runtime_error("smack_set_label_for_self failed");
 416
 417     if(m_control->lockUserKey(UID) != CKM_API_SUCCESS)
 418         throw runtime_error("lockUserKey failed");
 419 }
 420
 421 void SchemeTest::FillDb() {
 422     // pkcs
 423     ifstream is(DB_TEST_DIR "/encryption-scheme.p12");
 424     if(!is)
 425         throw runtime_error("Failed to read pkcs");
 426     istreambuf_iterator<char> begin(is), end;
 427     RawBuffer pkcsBuffer(begin, end);
 428     auto pkcs = PKCS12::create(pkcsBuffer, Password());
 429     if(pkcs->empty())
 430         throw runtime_error("Empty pkcs");
 431
 432     SwitchToUser();
 433
 434     // certificates
 435     RawBuffer rootCaBuffer(TEST_ROOT_CA.begin(), TEST_ROOT_CA.end());
 436     CertificateShPtr rootCa = CKM::Certificate::create(rootCaBuffer, CKM::DataFormat::FORM_PEM);
 437     RawBuffer imCaBuffer(TEST_IM_CA.begin(), TEST_IM_CA.end());
 438     CertificateShPtr imCa = CKM::Certificate::create(imCaBuffer, CKM::DataFormat::FORM_PEM);
 439     RawBuffer leafBuffer(TEST_LEAF.begin(), TEST_LEAF.end());
 440     CertificateShPtr leaf = CKM::Certificate::create(leafBuffer, CKM::DataFormat::FORM_PEM);
 441
 442     for(const auto& g:GROUPS) {
 443         switch (g.type) {
 444         case Group::KEY_PAIR_RSA:
 445             if(g.items.size() != 2)
 446                 throw runtime_error("Wrong number of keys");
 447             if( g.items[0].type != DataType::KEY_RSA_PRIVATE ||
 448                 g.items[1].type != DataType::KEY_RSA_PUBLIC)
 449                 throw runtime_error("Invalid item type");
 450
 451             if(CKM_API_SUCCESS != m_mgr->createKeyPairRSA(1024,
 452                                                           g.items[0].alias,
 453                                                           g.items[1].alias,
 454                                                           g.items[0].policy,
 455                                                           g.items[1].policy))
 456                 throw runtime_error("createKeyPair failed");
 457             break;
 458
 459         case Group::CERT_CHAIN:
 460             if(g.items.size() != CHAIN_SIZE)
 461                 throw runtime_error("Wrong number of certificates");
 462             if( g.items[0].type != DataType::CERTIFICATE ||
 463                 g.items[1].type != DataType::CERTIFICATE ||
 464                 g.items[2].type != DataType::CERTIFICATE)
 465                 throw runtime_error("Invalid item type");
 466
 467             if(CKM_API_SUCCESS != m_mgr->saveCertificate(g.items[0].alias, rootCa, g.items[0].policy))
 468                 throw runtime_error("saveCertificate failed");
 469             if(CKM_API_SUCCESS != m_mgr->saveCertificate(g.items[1].alias, imCa, g.items[1].policy))
 470                 throw runtime_error("saveCertificate failed");
 471             if(CKM_API_SUCCESS != m_mgr->saveCertificate(g.items[2].alias, leaf, g.items[2].policy))
 472                 throw runtime_error("saveCertificate failed");
 473             break;
 474
 475         default:
 476             for(const auto& i:g.items) {
 477                 switch (i.type) {
 478                 case DataType::BINARY_DATA:
 479                     if(CKM_API_SUCCESS != m_mgr->saveData(i.alias, TEST_DATA, i.policy))
 480                         throw runtime_error("saveData failed");
 481                     break;
 482
 483                 case DataType::KEY_AES:
 484                     if(CKM_API_SUCCESS != m_mgr->createKeyAES(256, i.alias, i.policy))
 485                         throw runtime_error("createKeyAES failed");
 486                     break;
 487
 488                 case DataType::CHAIN_CERT_0:    // PKCS
 489                     if(CKM_API_SUCCESS != m_mgr->savePKCS12(i.alias, pkcs, i.policy, i.policy))
 490                         throw runtime_error("savePkcs12 failed");
 491                     break;
 492
 493                 default:
 494                     throw runtime_error("unsupported data type");
 495                 }
 496             }
 497             break;
 498         }
 499     }
 500 }
 501
 502 void SchemeTest::ReadAll(bool useWrongPass) {
 503     SwitchToUser();
 504
 505     for(const auto& g:GROUPS) {
 506         for(const auto& i:g.items) {
 507             int ret;
 508             Password pass = i.policy.password;
 509             if(useWrongPass) {
 510                 if(pass.empty())
 511                     pass = TEST_PASS;
 512                 else
 513                     pass = Password();
 514             }
 515
 516             switch (i.type) {
 517             case DataType::BINARY_DATA:
 518             {
 519                 RawBuffer receivedData;
 520                 ret = m_mgr->getData(i.alias, pass, receivedData);
 521                 BOOST_REQUIRE_MESSAGE(useWrongPass || receivedData == TEST_DATA,
 522                                       "Received data is different for " << i.alias);
 523                 break;
 524             }
 525
 526             case DataType::KEY_AES:
 527             case DataType::KEY_RSA_PRIVATE:
 528             case DataType::KEY_RSA_PUBLIC:
 529             {
 530                 KeyShPtr receivedKey;
 531                 ret = m_mgr->getKey(i.alias, pass, receivedKey);
 532                 break;
 533             }
 534
 535             case DataType::CERTIFICATE:
 536             {
 537                 CertificateShPtr receivedCert;
 538                 ret = m_mgr->getCertificate(i.alias, pass, receivedCert);
 539                 break;
 540             }
 541
 542             case DataType::CHAIN_CERT_0: // pkcs
 543             {
 544                 PKCS12ShPtr pkcs;
 545                 ret = m_mgr->getPKCS12(i.alias, pass, pass, pkcs);
 546                 break;
 547             }
 548
 549             default:
 550                 BOOST_FAIL("Unsupported data type " << i.type);
 551             }
 552
 553             if(i.policy.extractable) {
 554                 if(useWrongPass)
 555                     BOOST_REQUIRE_MESSAGE(ret == CKM_API_ERROR_AUTHENTICATION_FAILED,
 556                                           "Reading item " << i.alias << " should fail with " <<
 557                                           CKM_API_ERROR_AUTHENTICATION_FAILED << " got: " << ret);
 558                 else
 559                     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS, "Reading item " << i.alias <<
 560                                           " failed with " << ret);
 561             }
 562             else
 563                 BOOST_REQUIRE_MESSAGE(ret == CKM_API_ERROR_NOT_EXPORTABLE, "Item " << i.alias <<
 564                                       " should not be exportable");
 565         }
 566     }
 567 }
 568
 569 void SchemeTest::SignVerify() {
 570     SwitchToUser();
 571
 572     for(const auto& g:GROUPS) {
 573         if(g.type == Group::KEY_PAIR_RSA) {
 574             BOOST_REQUIRE_MESSAGE(g.items.size() == 2, "Wrong number of keys");
 575             BOOST_REQUIRE_MESSAGE(g.items[0].type == DataType::KEY_RSA_PRIVATE &&
 576                                   g.items[1].type == DataType::KEY_RSA_PUBLIC, "Wrong key");
 577
 578             SignVerifyItem(g.items[0], g.items[1]);
 579         } else {
 580             for(const auto& i:g.items) {
 581                 switch (i.type) {
 582                 case DataType::CHAIN_CERT_0:
 583                     SignVerifyItem(i, i);
 584                     break;
 585
 586                 default:
 587                     break;
 588                 }
 589             }
 590         }
 591     }
 592 }
 593
 594 void SchemeTest::EncryptDecrypt() {
 595     SwitchToUser();
 596
 597     for(const auto& g:GROUPS) {
 598         if(g.type == Group::KEY_PAIR_RSA) {
 599             BOOST_REQUIRE_MESSAGE(g.items.size() == 2, "Wrong number of keys");
 600             BOOST_REQUIRE_MESSAGE(g.items[0].type == DataType::KEY_RSA_PRIVATE &&
 601                                   g.items[1].type == DataType::KEY_RSA_PUBLIC, "Wrong key");
 602
 603             EncryptDecryptItem(g.items[0], g.items[1]);
 604         } else {
 605             for(const auto& i:g.items) {
 606                 switch (i.type) {
 607                 case DataType::KEY_AES:
 608                     EncryptDecryptItem(i);
 609                     break;
 610
 611                 case DataType::CHAIN_CERT_0:
 612                     EncryptDecryptItem(i, i);
 613                     break;
 614
 615                 default:
 616                     break;
 617                 }
 618             }
 619         }
 620     }
 621 }
 622
 623 void SchemeTest::CreateChain() {
 624     SwitchToUser();
 625
 626     for(const auto& g:GROUPS) {
 627         if(g.type == Group::CERT_CHAIN) {
 628             BOOST_REQUIRE_MESSAGE(g.items.size() == CHAIN_SIZE, "Not enough certificates");
 629             for(const auto& c:g.items)
 630                 BOOST_REQUIRE_MESSAGE(c.type == DataType::CERTIFICATE, "Wrong item type");
 631             Items trusted(CHAIN_SIZE-1);
 632             std::copy(g.items.begin(), g.items.begin() + CHAIN_SIZE-1, trusted.begin());
 633
 634             // last one is ee (leaf)
 635             CreateChainItem(g.items.back(), trusted);
 636         } else {
 637             for(const auto& i:g.items) {
 638                 if(i.type == DataType::CHAIN_CERT_0) // PKCS
 639                     CreateChainItem(i, { i });
 640             }
 641         }
 642     }
 643 }
 644
 645 void SchemeTest::RemoveAll() {
 646     SwitchToUser();
 647
 648     for(const auto& g:GROUPS) {
 649         for(const auto& i:g.items) {
 650             int ret = m_mgr->removeAlias(i.alias);
 651             BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS,
 652                                   "removeAlias() failed with " << ret << " for " << i.alias);
 653         }
 654     }
 655 }
 656 size_t SchemeTest::CountObjects() {
 657     EnableDirectDbAccess();
 658
 659     size_t ret = 0;
 660     for(const auto& g:GROUPS) {
 661         for(const auto& i:g.items) {
 662             DB::RowVector rows;
 663             // it is assumed that aliases are different
 664             m_db->getRows(i.alias, DB_LABEL, DataType::DB_FIRST, DataType::DB_LAST, rows);
 665             ret += rows.size();
 666         }
 667     }
 668     return ret;
 669 }
 670
 671 void SchemeTest::RestoreDb() {
 672     restoreFile("key-7654");
 673     restoreFile("db-key-7654");
 674     restoreFile("db-7654");
 675     m_db.reset();
 676     m_directAccessEnabled = false;
 677 }
 678
 679 void SchemeTest::CheckSchemeVersion(const ItemFilter& filter, int version) {
 680     EnableDirectDbAccess();
 681
 682     for(const auto& g:GROUPS) {
 683         for(const auto& i:g.items) {
 684             if(!filter.Matches(i))
 685                 continue;
 686
 687             DB::RowVector rows;
 688             m_db->getRows(i.alias, DB_LABEL, filter.typeFrom, filter.typeTo, rows);
 689             BOOST_REQUIRE_MESSAGE(rows.size() > 0, "No rows found for " << i.alias);
 690             for(const auto& r : rows) {
 691                 BOOST_REQUIRE_MESSAGE(
 692                         (r.encryptionScheme >> ENC_SCHEME_OFFSET) == version,
 693                         "Wrong encryption scheme for " << i.alias << ". Expected " << version <<
 694                         " got: " << (r.encryptionScheme >> ENC_SCHEME_OFFSET));
 695             }
 696         }
 697     }
 698 }
 699
 700 void SchemeTest::EnableDirectDbAccess() {
 701     SwitchToRoot();
 702
 703     if(m_directAccessEnabled)
 704         return;
 705
 706     // direct access to db
 707     FileSystem fs(UID);
 708     auto wrappedDKEK = fs.getDKEK();
 709     auto keyProvider = KeyProvider(wrappedDKEK, DBPASS);
 710
 711     auto wrappedDatabaseDEK = fs.getDBDEK();
 712     RawBuffer key = keyProvider.getPureDEK(wrappedDatabaseDEK);
 713
 714     m_db.reset(new DB::Crypto(fs.getDBPath(), key));
 715     m_directAccessEnabled = true;
 716 }
 717
 718 void SchemeTest::SignVerifyItem(const Item& itemPrv, const Item& itemPub) {
 719     int ret;
 720     KeyShPtr receivedKey;
 721     RawBuffer signature;
 722     // create/verify signature
 723     ret = m_mgr->createSignature(itemPrv.alias,
 724                                  itemPrv.policy.password,
 725                                  TEST_DATA,
 726                                  HashAlgorithm::SHA512,
 727                                  RSAPaddingAlgorithm::X931,
 728                                  signature);
 729     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS, "createSignature() failed with " << ret <<
 730                           " for " << itemPrv.alias);
 731     ret = m_mgr->verifySignature(itemPub.alias,
 732                                  itemPub.policy.password,
 733                                  TEST_DATA,
 734                                  signature,
 735                                  HashAlgorithm::SHA512,
 736                                  RSAPaddingAlgorithm::X931);
 737     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS, "verifySignature() failed with " << ret <<
 738                           " for " << itemPub.alias);
 739
 740 }
 741
 742 void SchemeTest::EncryptDecryptItem(const Item& item) {
 743     CryptoAlgorithm algo;
 744     RawBuffer iv = createRandomBuffer(IV_LEN);
 745     RawBuffer encrypted, decrypted;
 746     int ret;
 747
 748     algo.setParam(ParamName::ALGO_TYPE, AlgoType::AES_GCM);
 749     algo.setParam(ParamName::ED_IV, iv);
 750
 751     ret = m_mgr->encrypt(algo, item.alias, item.policy.password, TEST_DATA, encrypted);
 752     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS, "encrypt() failed iwth " << ret << " for " <<
 753                           item.alias);
 754
 755     ret = m_mgr->decrypt(algo, item.alias, item.policy.password, encrypted, decrypted);
 756     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS, "decrypt() failed iwth " << ret << " for " <<
 757                           item.alias);
 758
 759     BOOST_REQUIRE_MESSAGE(decrypted == TEST_DATA, "Decrypted data not equal to original");
 760 }
 761
 762 void SchemeTest::EncryptDecryptItem(const Item& itemPrv, const Item& itemPub) {
 763     CryptoAlgorithm algo;
 764     RawBuffer encrypted, decrypted;
 765     int ret;
 766
 767     algo.setParam(ParamName::ALGO_TYPE, AlgoType::RSA_OAEP);
 768
 769     ret = m_mgr->encrypt(algo, itemPub.alias, itemPub.policy.password, TEST_DATA, encrypted);
 770     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS, "encrypt() failed iwth " << ret << " for " <<
 771                           itemPub.alias);
 772
 773     ret = m_mgr->decrypt(algo, itemPrv.alias, itemPrv.policy.password, encrypted, decrypted);
 774     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS, "decrypt() failed iwth " << ret << " for " <<
 775                           itemPrv.alias);
 776
 777     BOOST_REQUIRE_MESSAGE(decrypted == TEST_DATA, "Decrypted data not equal to original");
 778 }
 779
 780 void SchemeTest::CreateChainItem(const Item& leaf, const Items& certs) {
 781     CertificateShPtrVector chain;
 782     AliasVector trusted;
 783
 784     if(!leaf.policy.extractable || !leaf.policy.password.empty())
 785         return;
 786
 787     for(const auto& i : certs) {
 788         if(!i.policy.extractable || !i.policy.password.empty())
 789             return;
 790         trusted.push_back(i.alias);
 791     }
 792
 793     CertificateShPtr leafCrt;
 794     int ret = m_mgr->getCertificate(leaf.alias, leaf.policy.password, leafCrt);
 795     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS,
 796                           "getCertificate failed with " << ret << " for " <<
 797                           leaf.alias);
 798
 799     ret = m_mgr->getCertificateChain(leafCrt, AliasVector(), trusted, false, chain);
 800     BOOST_REQUIRE_MESSAGE(ret == CKM_API_SUCCESS,
 801                           "getCertificateChain() failed with " << ret);
 802     BOOST_REQUIRE_MESSAGE(chain.size() == CHAIN_LEN, "Wrong chain length: " << chain.size());
 803 }