Skip to content

Commit 2cbc9be

Browse files
nordic-mik7nordic-mik7
committed
Further test cases; minor changes to decrypt filter error handling
1 parent f87f6d4 commit 2cbc9be

File tree

2 files changed

+249
-3
lines changed

2 files changed

+249
-3
lines changed

‎subsys/suit/stream/stream_filters/src/suit_decrypt_filter.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,13 @@ suit_plat_err_t suit_decrypt_filter_get(struct stream_sink *dec_sink,
403403

404404
status = psa_aead_update_ad(&ctx.operation, enc_info->aad.value, enc_info->aad.len);
405405

406+
if (status != PSA_SUCCESS) {
407+
LOG_ERR("Failed to pass additional data for authentication operation: %d", status);
408+
psa_aead_abort(&ctx.operation);
409+
ctx.in_use = false;
410+
return SUIT_PLAT_ERR_CRASH;
411+
}
412+
406413
ctx.stored_tag_bytes = 0;
407414
memcpy(&ctx.enc_sink, enc_sink, sizeof(struct stream_sink));
408415

‎tests/subsys/suit/unit/suit_decrypt_filter/src/main.c‎

Lines changed: 242 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#include <psa/crypto.h>
1212
#include <mocks.h>
1313

14-
#define KEY_ID_FWENC_APPLICATION_GEN1 0x40000002
14+
#define KEY_ID_FWENC_APPLICATION_GEN1 0x40022000
1515

1616
/**
1717
* Encryption without wrapping CEK achieved by running:
@@ -59,6 +59,8 @@ static const char aad[] = {
5959
"sample aad"
6060
};
6161

62+
static struct stream_sink dec_sink = {0};
63+
6264
static void get_cbor_key_id(psa_key_id_t const key_id, uint8_t * const cbor_key_id, size_t const cbor_key_id_len)
6365
{
6466
if (cbor_key_id_len < 5)
@@ -77,7 +79,15 @@ static suit_plat_err_t write_ram(void *ctx, const uint8_t *buf, size_t size)
7779
(void)buf;
7880
(void)size;
7981

80-
// dummy write interface function for the decrypted data sink
82+
// dummy write interface function for the decrypted data output sink
83+
}
84+
85+
static suit_plat_err_t used_storage(void *ctx, size_t *size)
86+
{
87+
(void)ctx;
88+
(void)size;
89+
90+
// dummy used_storage interface function for the decrypted data output sink
8191
}
8292

8393
static void *test_suite_setup(void)
@@ -99,13 +109,19 @@ static void test_before(void *data)
99109

100110
/* Reset common FFF internal structures */
101111
FFF_RESET_HISTORY();
112+
113+
if (dec_sink.release && dec_sink.ctx)
114+
{
115+
printf("realese me!\n");
116+
dec_sink.release(dec_sink.ctx);
117+
memset(&dec_sink, 0, sizeof(dec_sink));
118+
}
102119
}
103120

104121
ZTEST_SUITE(suit_decrypt_filter_tests, NULL, test_suite_setup, test_before, NULL, test_suite_teardown);
105122

106123
ZTEST_F(suit_decrypt_filter_tests, test_key_id_validation_fail)
107124
{
108-
struct stream_sink dec_sink = {0};
109125
struct stream_sink ram_sink = {0};
110126
uint8_t cek_key_id_cbor[] = {
111127
0x1A, 0x00, 0x00, 0x00, 0x00,
@@ -151,3 +167,226 @@ ZTEST_F(suit_decrypt_filter_tests, test_key_id_validation_fail)
151167
zassert_equal(dec_sink.ctx, NULL,
152168
"Invalid dec_sink.ctx value");
153169
}
170+
171+
ZTEST_F(suit_decrypt_filter_tests, test_decryption_setup_fail)
172+
{
173+
struct stream_sink ram_sink = {0};
174+
uint8_t cek_key_id_cbor[] = {
175+
0x1A, 0x00, 0x00, 0x00, 0x00,
176+
};
177+
178+
get_cbor_key_id(KEY_ID_FWENC_APPLICATION_GEN1, cek_key_id_cbor, sizeof(cek_key_id_cbor));
179+
180+
struct suit_encryption_info enc_info = {
181+
.enc_alg_id = suit_cose_aes256_gcm,
182+
.IV = {
183+
.value = iv_direct,
184+
.len = sizeof(iv_direct),
185+
},
186+
.aad = {
187+
.value = aad,
188+
.len = strlen(aad),
189+
},
190+
.kw_alg_id = suit_cose_direct,
191+
.kw_key.direct = {.key_id = {.value = cek_key_id_cbor,
192+
.len = sizeof(cek_key_id_cbor)},}
193+
};
194+
195+
ram_sink.write = write_ram;
196+
suit_mci_fw_encryption_key_id_validate_fake.return_val = SUIT_PLAT_SUCCESS;
197+
suit_plat_decode_key_id_fake.return_val = SUIT_PLAT_SUCCESS;
198+
psa_aead_decrypt_setup_fake.return_val = PSA_ERROR_GENERIC_ERROR;
199+
200+
suit_plat_err_t err = suit_decrypt_filter_get(&dec_sink, &enc_info, &sample_class_id, &ram_sink);
201+
zassert_equal(err, SUIT_PLAT_ERR_CRASH,
202+
"Incorrect error code when getting decrypt filter");
203+
204+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.call_count, 1,
205+
"Invalid number of calls to suit_mci_fw_encryption_key_id_validate");
206+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.arg0_val, &sample_class_id,
207+
"Invalid class ID passed to suit_mci_fw_encryption_key_id_validate");
208+
zassert_equal(psa_aead_decrypt_setup_fake.call_count, 1,
209+
"Invalid number of calls to psa_aead_decrypt_setup");
210+
zassert_equal(psa_aead_set_nonce_fake.call_count, 0,
211+
"Invalid number of calls to psa_aead_set_nonce");
212+
zassert_equal(psa_aead_update_ad_fake.call_count, 0,
213+
"Invalid number of calls to psa_aead_update_ad");
214+
zassert_equal(psa_aead_abort_fake.call_count, 1,
215+
"Invalid number of calls to psa_aead_abort");
216+
zassert_equal(dec_sink.ctx, NULL,
217+
"Invalid dec_sink.ctx value");
218+
}
219+
220+
ZTEST_F(suit_decrypt_filter_tests, test_decryption_set_nonce_fail)
221+
{
222+
struct stream_sink ram_sink = {0};
223+
uint8_t cek_key_id_cbor[] = {
224+
0x1A, 0x00, 0x00, 0x00, 0x00,
225+
};
226+
227+
get_cbor_key_id(KEY_ID_FWENC_APPLICATION_GEN1, cek_key_id_cbor, sizeof(cek_key_id_cbor));
228+
229+
struct suit_encryption_info enc_info = {
230+
.enc_alg_id = suit_cose_aes256_gcm,
231+
.IV = {
232+
.value = iv_direct,
233+
.len = sizeof(iv_direct),
234+
},
235+
.aad = {
236+
.value = aad,
237+
.len = strlen(aad),
238+
},
239+
.kw_alg_id = suit_cose_direct,
240+
.kw_key.direct = {.key_id = {.value = cek_key_id_cbor,
241+
.len = sizeof(cek_key_id_cbor)},}
242+
};
243+
244+
ram_sink.write = write_ram;
245+
suit_mci_fw_encryption_key_id_validate_fake.return_val = SUIT_PLAT_SUCCESS;
246+
suit_plat_decode_key_id_fake.return_val = SUIT_PLAT_SUCCESS;
247+
psa_aead_decrypt_setup_fake.return_val = PSA_SUCCESS;
248+
psa_aead_set_nonce_fake.return_val = PSA_ERROR_GENERIC_ERROR;
249+
250+
suit_plat_err_t err = suit_decrypt_filter_get(&dec_sink, &enc_info, &sample_class_id, &ram_sink);
251+
zassert_equal(err, SUIT_PLAT_ERR_CRASH,
252+
"Incorrect error code when getting decrypt filter");
253+
254+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.call_count, 1,
255+
"Invalid number of calls to suit_mci_fw_encryption_key_id_validate");
256+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.arg0_val, &sample_class_id,
257+
"Invalid class ID passed to suit_mci_fw_encryption_key_id_validate");
258+
zassert_equal(psa_aead_decrypt_setup_fake.call_count, 1,
259+
"Invalid number of calls to psa_aead_decrypt_setup");
260+
zassert_equal_ptr(psa_aead_set_nonce_fake.arg1_val, iv_direct,
261+
"Invalid IV passed to psa_aead_set_nonce");
262+
zassert_equal_ptr(psa_aead_set_nonce_fake.arg2_val, sizeof(iv_direct),
263+
"Invalid IV length passed to psa_aead_set_nonce");
264+
zassert_equal(psa_aead_set_nonce_fake.call_count, 1,
265+
"Invalid number of calls to psa_aead_set_nonce");
266+
zassert_equal(psa_aead_update_ad_fake.call_count, 0,
267+
"Invalid number of calls to psa_aead_update_ad");
268+
zassert_equal(psa_aead_abort_fake.call_count, 1,
269+
"Invalid number of calls to psa_aead_abort");
270+
zassert_equal(dec_sink.ctx, NULL,
271+
"Invalid dec_sink.ctx value");
272+
}
273+
274+
ZTEST_F(suit_decrypt_filter_tests, test_decryption_update_ad_fail)
275+
{
276+
struct stream_sink ram_sink = {0};
277+
uint8_t cek_key_id_cbor[] = {
278+
0x1A, 0x00, 0x00, 0x00, 0x00,
279+
};
280+
281+
get_cbor_key_id(KEY_ID_FWENC_APPLICATION_GEN1, cek_key_id_cbor, sizeof(cek_key_id_cbor));
282+
283+
struct suit_encryption_info enc_info = {
284+
.enc_alg_id = suit_cose_aes256_gcm,
285+
.IV = {
286+
.value = iv_direct,
287+
.len = sizeof(iv_direct),
288+
},
289+
.aad = {
290+
.value = aad,
291+
.len = strlen(aad),
292+
},
293+
.kw_alg_id = suit_cose_direct,
294+
.kw_key.direct = {.key_id = {.value = cek_key_id_cbor,
295+
.len = sizeof(cek_key_id_cbor)},}
296+
};
297+
298+
ram_sink.write = write_ram;
299+
suit_mci_fw_encryption_key_id_validate_fake.return_val = SUIT_PLAT_SUCCESS;
300+
suit_plat_decode_key_id_fake.return_val = SUIT_PLAT_SUCCESS;
301+
psa_aead_decrypt_setup_fake.return_val = PSA_SUCCESS;
302+
psa_aead_set_nonce_fake.return_val = PSA_SUCCESS;
303+
psa_aead_update_ad_fake.return_val = PSA_ERROR_GENERIC_ERROR;
304+
305+
suit_plat_err_t err = suit_decrypt_filter_get(&dec_sink, &enc_info, &sample_class_id, &ram_sink);
306+
zassert_equal(err, SUIT_PLAT_ERR_CRASH,
307+
"Incorrect error code when getting decrypt filter");
308+
309+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.call_count, 1,
310+
"Invalid number of calls to suit_mci_fw_encryption_key_id_validate");
311+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.arg0_val, &sample_class_id,
312+
"Invalid class ID passed to suit_mci_fw_encryption_key_id_validate");
313+
zassert_equal(psa_aead_decrypt_setup_fake.call_count, 1,
314+
"Invalid number of calls to psa_aead_decrypt_setup");
315+
zassert_equal_ptr(psa_aead_set_nonce_fake.arg1_val, iv_direct,
316+
"Invalid IV passed to psa_aead_set_nonce");
317+
zassert_equal_ptr(psa_aead_set_nonce_fake.arg2_val, sizeof(iv_direct),
318+
"Invalid IV length passed to psa_aead_set_nonce");
319+
zassert_equal(psa_aead_set_nonce_fake.call_count, 1,
320+
"Invalid number of calls to psa_aead_set_nonce");
321+
zassert_equal(psa_aead_update_ad_fake.call_count, 1,
322+
"Invalid number of calls to psa_aead_update_ad");
323+
zassert_equal_ptr(psa_aead_update_ad_fake.arg1_val, aad,
324+
"Invalid ad passed to psa_aead_update_ad");
325+
zassert_equal_ptr(psa_aead_update_ad_fake.arg2_val, strlen(aad),
326+
"Invalid ad length passed to psa_aead_update_ad");
327+
zassert_equal(psa_aead_abort_fake.call_count, 1,
328+
"Invalid number of calls to psa_aead_abort");
329+
zassert_equal(dec_sink.ctx, NULL,
330+
"Invalid dec_sink.ctx value");
331+
}
332+
333+
ZTEST_F(suit_decrypt_filter_tests, test_filter_get_happy_path)
334+
{
335+
struct stream_sink ram_sink = {0};
336+
uint8_t cek_key_id_cbor[] = {
337+
0x1A, 0x00, 0x00, 0x00, 0x00,
338+
};
339+
340+
get_cbor_key_id(KEY_ID_FWENC_APPLICATION_GEN1, cek_key_id_cbor, sizeof(cek_key_id_cbor));
341+
342+
struct suit_encryption_info enc_info = {
343+
.enc_alg_id = suit_cose_aes256_gcm,
344+
.IV = {
345+
.value = iv_direct,
346+
.len = sizeof(iv_direct),
347+
},
348+
.aad = {
349+
.value = aad,
350+
.len = strlen(aad),
351+
},
352+
.kw_alg_id = suit_cose_direct,
353+
.kw_key.direct = {.key_id = {.value = cek_key_id_cbor,
354+
.len = sizeof(cek_key_id_cbor)},}
355+
};
356+
357+
ram_sink.write = write_ram;
358+
ram_sink.used_storage = used_storage;
359+
suit_mci_fw_encryption_key_id_validate_fake.return_val = SUIT_PLAT_SUCCESS;
360+
suit_plat_decode_key_id_fake.return_val = SUIT_PLAT_SUCCESS;
361+
psa_aead_decrypt_setup_fake.return_val = PSA_SUCCESS;
362+
psa_aead_set_nonce_fake.return_val = PSA_SUCCESS;
363+
psa_aead_update_ad_fake.return_val = PSA_SUCCESS;
364+
365+
suit_plat_err_t err = suit_decrypt_filter_get(&dec_sink, &enc_info, &sample_class_id, &ram_sink);
366+
zassert_equal(err, SUIT_PLAT_SUCCESS,
367+
"Incorrect error code when getting decrypt filter");
368+
369+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.call_count, 1,
370+
"Invalid number of calls to suit_mci_fw_encryption_key_id_validate");
371+
zassert_equal_ptr(suit_mci_fw_encryption_key_id_validate_fake.arg0_val, &sample_class_id,
372+
"Invalid class ID passed to suit_mci_fw_encryption_key_id_validate");
373+
zassert_equal(psa_aead_decrypt_setup_fake.call_count, 1,
374+
"Invalid number of calls to psa_aead_decrypt_setup");
375+
zassert_equal_ptr(psa_aead_set_nonce_fake.arg1_val, iv_direct,
376+
"Invalid IV passed to psa_aead_set_nonce");
377+
zassert_equal_ptr(psa_aead_set_nonce_fake.arg2_val, sizeof(iv_direct),
378+
"Invalid IV length passed to psa_aead_set_nonce");
379+
zassert_equal(psa_aead_set_nonce_fake.call_count, 1,
380+
"Invalid number of calls to psa_aead_set_nonce");
381+
zassert_equal(psa_aead_update_ad_fake.call_count, 1,
382+
"Invalid number of calls to psa_aead_update_ad");
383+
zassert_equal_ptr(psa_aead_update_ad_fake.arg1_val, aad,
384+
"Invalid ad passed to psa_aead_update_ad");
385+
zassert_equal_ptr(psa_aead_update_ad_fake.arg2_val, strlen(aad),
386+
"Invalid ad length passed to psa_aead_update_ad");
387+
zassert_equal(psa_aead_abort_fake.call_count, 0,
388+
"Invalid number of calls to psa_aead_abort");
389+
zassert_not_equal( dec_sink.ctx && dec_sink.write && dec_sink.erase
390+
&& dec_sink.release && dec_sink.flush && dec_sink.used_storage, NULL,
391+
"Invalid dec_sink.ctx value");
392+
}

0 commit comments

Comments
 (0)