PawletOS/android_bootable_recovery
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add function to load the key from x509.pem file

Browse Source 
We used to convert a pem certificate file to some intermediate plain
text format; and parse that format under recovery mode. This is
uncessary since the x509.pem can be directly parsed with openssl
functions.

Add the function to load the public key from one x509.pem file and
corresponding unit tests. And we will add more cls to extract the pem
files from otacert.zip later.

Bug: 116655889
Test: verify package with 5 supported certficate versions
Change-Id: Ibc6c696c534567f005db75143cc4ef8d4bdea6a0
This commit is contained in:
Tianjie Xu
2018-10-12 11:12:08 -07:00
parent 1a4d234daa
commit 8256698023
3 changed files with 158 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/component/verifier_test.cpp
+84
View File
@@ -27,6 +27,7 @@
#include <android-base/file.h>
#include <android-base/stringprintf.h>
#include <android-base/test_utils.h>
#include <android-base/unique_fd.h>
#include <gtest/gtest.h>
#include "common/test_constants.h"
@@ -35,6 +36,89 @@
using namespace std::string_literals;
static void LoadKeyFromFile(const std::string& file_name, Certificate* cert) {
std::string testkey_string;
ASSERT_TRUE(android::base::ReadFileToString(file_name, &testkey_string));
ASSERT_TRUE(LoadCertificateFromBuffer(
std::vector<uint8_t>(testkey_string.begin(), testkey_string.end()), cert));
}
static void VerifyPackageWithCertificate(const std::string& name, Certificate&& cert) {
std::string package = from_testdata_base(name);
MemMapping memmap;
if (!memmap.MapFile(package)) {
FAIL() << "Failed to mmap " << package << ": " << strerror(errno) << "\n";
}
std::vector<Certificate> certs;
certs.emplace_back(std::move(cert));
ASSERT_EQ(VERIFY_SUCCESS, verify_file(memmap.addr, memmap.length, certs));
}
TEST(VerifierTest, LoadCertificateFromBuffer_failure) {
Certificate cert(0, Certificate::KEY_TYPE_RSA, nullptr, nullptr);
std::string testkey_string;
ASSERT_TRUE(
android::base::ReadFileToString(from_testdata_base("testkey_v1.txt"), &testkey_string));
ASSERT_FALSE(LoadCertificateFromBuffer(
std::vector<uint8_t>(testkey_string.begin(), testkey_string.end()), &cert));
}
TEST(VerifierTest, LoadCertificateFromBuffer_sha1_exponent3) {
Certificate cert(0, Certificate::KEY_TYPE_RSA, nullptr, nullptr);
LoadKeyFromFile(from_testdata_base("testkey_v1.x509.pem"), &cert);
ASSERT_EQ(SHA_DIGEST_LENGTH, cert.hash_len);
ASSERT_EQ(Certificate::KEY_TYPE_RSA, cert.key_type);
ASSERT_EQ(nullptr, cert.ec);
VerifyPackageWithCertificate("otasigned_v1.zip", std::move(cert));
}
TEST(VerifierTest, LoadCertificateFromBuffer_sha1_exponent65537) {
Certificate cert(0, Certificate::KEY_TYPE_RSA, nullptr, nullptr);
LoadKeyFromFile(from_testdata_base("testkey_v2.x509.pem"), &cert);
ASSERT_EQ(SHA_DIGEST_LENGTH, cert.hash_len);
ASSERT_EQ(Certificate::KEY_TYPE_RSA, cert.key_type);
ASSERT_EQ(nullptr, cert.ec);
VerifyPackageWithCertificate("otasigned_v2.zip", std::move(cert));
}
TEST(VerifierTest, LoadCertificateFromBuffer_sha256_exponent3) {
Certificate cert(0, Certificate::KEY_TYPE_RSA, nullptr, nullptr);
LoadKeyFromFile(from_testdata_base("testkey_v3.x509.pem"), &cert);
ASSERT_EQ(SHA256_DIGEST_LENGTH, cert.hash_len);
ASSERT_EQ(Certificate::KEY_TYPE_RSA, cert.key_type);
ASSERT_EQ(nullptr, cert.ec);
VerifyPackageWithCertificate("otasigned_v3.zip", std::move(cert));
}
TEST(VerifierTest, LoadCertificateFromBuffer_sha256_exponent65537) {
Certificate cert(0, Certificate::KEY_TYPE_RSA, nullptr, nullptr);
LoadKeyFromFile(from_testdata_base("testkey_v4.x509.pem"), &cert);
ASSERT_EQ(SHA256_DIGEST_LENGTH, cert.hash_len);
ASSERT_EQ(Certificate::KEY_TYPE_RSA, cert.key_type);
ASSERT_EQ(nullptr, cert.ec);
VerifyPackageWithCertificate("otasigned_v4.zip", std::move(cert));
}
TEST(VerifierTest, LoadCertificateFromBuffer_sha256_ec256bits) {
Certificate cert(0, Certificate::KEY_TYPE_RSA, nullptr, nullptr);
LoadKeyFromFile(from_testdata_base("testkey_v5.x509.pem"), &cert);
ASSERT_EQ(SHA256_DIGEST_LENGTH, cert.hash_len);
ASSERT_EQ(Certificate::KEY_TYPE_EC, cert.key_type);
ASSERT_EQ(nullptr, cert.rsa);
VerifyPackageWithCertificate("otasigned_v5.zip", std::move(cert));
}
class VerifierTest : public testing::TestWithParam<std::vector<std::string>> {
protected:
void SetUp() override {