libarc-attestation/lib/arc_attestation_test.cc - third_party/platform2 - Git at Google


            
            // Copyright 2023 The ChromiumOS Authors

            
            // Use of this source code is governed by a BSD-style license that can be

            
            // found in the LICENSE file.


            #include <attestation/proto_bindings/interface.pb.h>

            
            #include <libarc-attestation/lib/interface.h>

            
            #include <libarc-attestation/lib/manager.h>

            
            #include <libhwsec/factory/mock_factory.h>

            
            #include <libhwsec/frontend/arc_attestation/mock_frontend.h>

            
            #include <libhwsec-foundation/error/testing_helper.h>


            // This needs to be after interface.pb.h due to protobuf dependency.

            
            #include <attestation/dbus-proxy-mocks.h>


            #include <gtest/gtest.h>


            #include <base/strings/string_number_conversions.h>


            using attestation::ACAType;

            
            using attestation::AttestationStatus;

            
            using attestation::CertificateProfile;

            
            using attestation::GetCertificateReply;

            
            using attestation::GetCertificateRequest;

            
            using attestation::KeyType;

            
            using attestation::SignReply;

            
            using attestation::SignRequest;

            
            using brillo::Blob;

            
            using brillo::BlobFromString;

            
            using brillo::BlobToString;

            
            using hwsec::TPMError;

            
            using hwsec::TPMRetryAction;

            
            using hwsec_foundation::error::testing::ReturnError;

            
            using hwsec_foundation::error::testing::ReturnValue;


            using ::testing::_;

            
            using ::testing::DoAll;

            
            using ::testing::Ge;

            
            using ::testing::Invoke;

            
            using ::testing::Return;

            
            using ::testing::SaveArg;

            
            using ::testing::SetArgPointee;

            
            using ::testing::SetArgReferee;


            namespace arc_attestation {


            namespace {


            // gmock matcher for protobufs, allowing to check protobuf arguments in mocks.

            
            MATCHER_P(ProtobufEquals, expected_message, "") {

            
              std::string arg_dumped;

            
              arg.SerializeToString(&arg_dumped);

            
              std::string expected_message_dumped;

            
              expected_message.SerializeToString(&expected_message_dumped);

            
              return arg_dumped == expected_message_dumped;

            
            }


            }  // namespace


            class ArcAttestationThreadedTest : public ::testing::Test {

            
             public:

            
              void SetUp() override {

            
                singleton_ = ArcAttestationManagerSingleton::CreateForTesting();

            
                std::unique_ptr<ArcAttestationManager> manager =

            
                    std::make_unique<ArcAttestationManager>();

            
                manager_ = manager.get();

            
                singleton_->SetManagerForTesting(std::move(manager));


                manager_->Setup();


                std::unique_ptr<org::chromium::AttestationProxyMock> attestation_proxy =

            
                    std::make_unique<org::chromium::AttestationProxyMock>();

            
                attestation_proxy_ = attestation_proxy.get();

            
                provisioner_ = manager_->GetProvisionerForTesting();

            
                provisioner_->SetAttestationProxyForTesting(std::move(attestation_proxy));

            
                version_attester_ = manager_->GetVersionAttesterForTesting();

            
                version_attester_->SetHwsecFactoryForTesting(&hwsec_factory_);


                default_hwsec_ = std::make_unique<hwsec::MockArcAttestationFrontend>();

            
                hwsec_ = default_hwsec_.get();

            
                ON_CALL(hwsec_factory_, GetArcAttestationFrontend())

            
                    .WillByDefault(

            
                        Invoke([this]() -> std::unique_ptr<hwsec::ArcAttestationFrontend> {

            
                          CHECK(default_hwsec_);

            
                          return std::move(default_hwsec_);

            
                        }));

            
              }


              void TearDown() override {

            
                ArcAttestationManagerSingleton::DestroyForTesting();

            
                singleton_ = nullptr;

            
                manager_ = nullptr;

            
                attestation_proxy_ = nullptr;

            
                provisioner_ = nullptr;

            
                version_attester_ = nullptr;

            
                hwsec_ = nullptr;

            
                default_hwsec_.reset();

            
              }


             protected:

            
              void ExpectGetCertificateSuccess(const GetCertificateReply& reply,

            
                                               const GetCertificateRequest& request) {

            
                EXPECT_CALL(*attestation_proxy_,

            
                            GetCertificate(ProtobufEquals(request), _, _,

            
                                           Ge(kGetCertificateMinTimeout.InMilliseconds())))

            
                    .WillOnce(DoAll(SetArgPointee<1>(reply), Return(true)));

            
              }


              void ExpectSignSuccess(const SignReply& reply, const SignRequest& request) {

            
                EXPECT_CALL(*attestation_proxy_, Sign(ProtobufEquals(request), _, _,

            
                                                      Ge(kSignMinTimeout.InMilliseconds())))

            
                    .WillOnce(DoAll(SetArgPointee<1>(reply), Return(true)));

            
              }


              void SetupSuccessfulProvision() {

            
                // Setup the correct Android Device Key provision request expectation.

            
                GetCertificateRequest aadk_request;

            
                aadk_request.set_certificate_profile(

            
                    CertificateProfile::ARC_ATTESTATION_DEVICE_KEY_CERTIFICATE);

            
                aadk_request.set_aca_type(ACAType::DEFAULT_ACA);

            
                aadk_request.set_key_type(KeyType::KEY_TYPE_ECC);

            
                aadk_request.set_key_label(kArcAttestationDeviceKeyLabel);

            
                aadk_request.set_shall_trigger_enrollment(true);


                GetCertificateReply aadk_reply;

            
                aadk_reply.set_status(AttestationStatus::STATUS_SUCCESS);

            
                aadk_reply.set_certificate(std::string(kFakeCert1Part1) +

            
                                           std::string(kFakeCert1Part2));

            
                aadk_reply.set_public_key(kFakePublicKey1);

            
                aadk_reply.set_key_blob(kFakeKeyBlob1);


                ExpectGetCertificateSuccess(aadk_reply, aadk_request);


                // Setup the correct TPM Certifying Key provision request expectation.

            
                GetCertificateRequest tck_request;

            
                tck_request.set_certificate_profile(

            
                    CertificateProfile::ARC_TPM_CERTIFYING_KEY_CERTIFICATE);

            
                tck_request.set_aca_type(ACAType::DEFAULT_ACA);

            
                tck_request.set_key_type(KeyType::KEY_TYPE_ECC);

            
                tck_request.set_key_label(kTpmCertifyingKeyLabel);

            
                tck_request.set_shall_trigger_enrollment(true);


                GetCertificateReply tck_reply;

            
                tck_reply.set_status(AttestationStatus::STATUS_SUCCESS);

            
                tck_reply.set_certificate(std::string(kFakeCert2Part1) +

            
                                          std::string(kFakeCert2Part2));

            
                tck_reply.set_public_key(kFakePublicKey2);

            
                tck_reply.set_key_blob(kFakeKeyBlob2);


                ExpectGetCertificateSuccess(tck_reply, tck_request);

            
              }


              ArcAttestationManagerSingleton* singleton_;

            
              ArcAttestationManager* manager_;

            
              org::chromium::AttestationProxyMock* attestation_proxy_;

            
              Provisioner* provisioner_;

            
              VersionAttester* version_attester_;

            
              hwsec::MockFactory hwsec_factory_;

            
              std::unique_ptr<hwsec::MockArcAttestationFrontend> default_hwsec_;

            
              hwsec::MockArcAttestationFrontend* hwsec_;


              static constexpr base::TimeDelta kGetCertificateMinTimeout =

            
                  base::Seconds(60);

            
              static constexpr base::TimeDelta kSignMinTimeout = base::Seconds(15);


              static constexpr char kArcAttestationDeviceKeyLabel[] =

            
                  "arc-attestation-device-key";

            
              static constexpr char kTpmCertifyingKeyLabel[] = "tpm-certifying-key";


              static constexpr char kFakeCert1Part1[] =

            
                  "-----BEGIN CERTIFICATE-----\n"

            
                  "part1-of-fake-cert-1\n"

            
                  "-----END CERTIFICATE-----\n";

            
              static constexpr char kFakeCert1Part2[] =

            
                  "-----BEGIN CERTIFICATE-----\n"

            
                  "fake-cert-1-last-part\n"

            
                  "-----END CERTIFICATE-----\n";

            
              static constexpr char kFakePublicKey1[] = "this-is-a-fake-public-key";

            
              static constexpr char kFakeKeyBlob1[] = "this-is-a-fake-key-blob";


              static constexpr char kFakeCert2Part1[] =

            
                  "-----BEGIN CERTIFICATE-----\n"

            
                  "ca-of-another-cert\n"

            
                  "-----END CERTIFICATE-----\n";

            
              static constexpr char kFakeCert2Part2[] =

            
                  "-----BEGIN CERTIFICATE-----\n"

            
                  "the-last-part-of-another-cert\n"

            
                  "-----END CERTIFICATE-----\n";

            
              static constexpr char kFakePublicKey2[] = "some-fake-ecc-public-key";

            
              static constexpr char kFakeKeyBlob2[] = "yet-another-fake-key-blob";


              static constexpr char kFakeSignData1[] = "to-be-signed";

            
              static constexpr char kFakeSignature1[] = "already-signed";


              static constexpr char kFakeChallenge[] = "can-you-answer-this?";

            
              static constexpr char kFakeLsbRelease[] = "SOME_VERSION=1.2.3";

            
              static constexpr char kFakeCmdline[] = "lsb_hash=AABBCC1234";

            
              static constexpr char kFakePcrQuote[] = "pcr-quoted";

            
              static constexpr char kFakePcrSignature[] = "pcr-signed";

            
            };


            TEST_F(ArcAttestationThreadedTest, ProvisionValidityTest) {

            
              SetupSuccessfulProvision();


              // Make the API call for provisioning.

            
              AndroidStatus result = ProvisionDkCert(true);

            
              ASSERT_TRUE(result.is_ok());


              // Test the resulting certificate.

            
              std::vector<Blob> cert_out;

            
              result = GetDkCertChain(cert_out);

            
              ASSERT_TRUE(result.is_ok());


              ASSERT_EQ(cert_out.size(), 2);

            
              EXPECT_EQ(BlobToString(cert_out[0]), kFakeCert1Part1);

            
              EXPECT_EQ(BlobToString(cert_out[1]), kFakeCert1Part2);


              // Test the signing.

            
              SignRequest sign_request;

            
              sign_request.set_key_label(kArcAttestationDeviceKeyLabel);

            
              sign_request.set_data_to_sign(kFakeSignData1);


              SignReply sign_reply;

            
              sign_reply.set_status(AttestationStatus::STATUS_SUCCESS);

            
              sign_reply.set_signature(kFakeSignature1);


              ExpectSignSuccess(sign_reply, sign_request);


              Blob data_to_sign = BlobFromString(kFakeSignData1);

            
              Blob result_signature;

            
              result = SignWithP256Dk(data_to_sign, result_signature);

            
              ASSERT_TRUE(result.is_ok());


              EXPECT_EQ(BlobToString(result_signature), kFakeSignature1);


              // Test the version attestation.

            
              arc_attestation::CrOSVersionAttestationBlob blob_to_return;

            
              blob_to_return.set_version(arc_attestation::CrOSVersionAttestationVersion::

            
                                             CROS_BLOB_VERSION_TPM2_FORMAT_1);

            
              blob_to_return.set_tpm_certifying_key_cert(std::string(kFakeCert2Part1) +

            
                                                         std::string(kFakeCert2Part2));

            
              blob_to_return.set_lsb_release_content(kFakeLsbRelease);

            
              blob_to_return.set_kernel_cmdline_content(kFakeCmdline);

            
              blob_to_return.set_kernel_cmdline_quote(kFakePcrQuote);

            
              blob_to_return.set_kernel_cmdline_quote_signature(kFakePcrSignature);

            
              EXPECT_CALL(*hwsec_, AttestVersion(BlobFromString(kFakeKeyBlob2),

            
                                                 std::string(kFakeCert2Part1) +

            
                                                     std::string(kFakeCert2Part2),

            
                                                 BlobFromString(kFakeChallenge)))

            
                  .WillOnce(Return(blob_to_return));


              Blob quoted_blob;

            
              result = QuoteCrOSBlob(BlobFromString(kFakeChallenge), quoted_blob);

            
              ASSERT_TRUE(result.is_ok());

            
              arc_attestation::CrOSSpecificBlob quoted_data;

            
              quoted_data.ParseFromString(BlobToString(quoted_blob));

            
              EXPECT_EQ(quoted_data.version_attestation().version(),

            
                        arc_attestation::CrOSVersionAttestationVersion::

            
                            CROS_BLOB_VERSION_TPM2_FORMAT_1);

            
              EXPECT_EQ(quoted_data.version_attestation().tpm_certifying_key_cert(),

            
                        std::string(kFakeCert2Part1) + std::string(kFakeCert2Part2));

            
              EXPECT_EQ(quoted_data.version_attestation().lsb_release_content(),

            
                        kFakeLsbRelease);

            
              EXPECT_EQ(quoted_data.version_attestation().kernel_cmdline_content(),

            
                        kFakeCmdline);

            
              EXPECT_EQ(quoted_data.version_attestation().kernel_cmdline_quote(),

            
                        kFakePcrQuote);

            
              EXPECT_EQ(quoted_data.version_attestation().kernel_cmdline_quote_signature(),

            
                        kFakePcrSignature);

            
            }


            TEST_F(ArcAttestationThreadedTest, ProvisionTCKFailed) {

            
              // Provisioning the TPM Certifying Key should fail.

            
              GetCertificateRequest tck_request;

            
              tck_request.set_certificate_profile(

            
                  CertificateProfile::ARC_TPM_CERTIFYING_KEY_CERTIFICATE);

            
              tck_request.set_aca_type(ACAType::DEFAULT_ACA);

            
              tck_request.set_key_type(KeyType::KEY_TYPE_ECC);

            
              tck_request.set_key_label(kTpmCertifyingKeyLabel);

            
              tck_request.set_shall_trigger_enrollment(true);


              GetCertificateReply tck_reply;

            
              tck_reply.set_status(AttestationStatus::STATUS_UNEXPECTED_DEVICE_ERROR);


              ExpectGetCertificateSuccess(tck_reply, tck_request);


              // Make the API call for provisioning, and it should fail.

            
              AndroidStatus result = ProvisionDkCert(true);

            
              EXPECT_FALSE(result.is_ok());

            
            }


            TEST_F(ArcAttestationThreadedTest, ProvisionDKFailed) {

            
              // Setup the correct TPM Certifying Key provision request expectation.

            
              GetCertificateRequest tck_request;

            
              tck_request.set_certificate_profile(

            
                  CertificateProfile::ARC_TPM_CERTIFYING_KEY_CERTIFICATE);

            
              tck_request.set_aca_type(ACAType::DEFAULT_ACA);

            
              tck_request.set_key_type(KeyType::KEY_TYPE_ECC);

            
              tck_request.set_key_label(kTpmCertifyingKeyLabel);

            
              tck_request.set_shall_trigger_enrollment(true);


              GetCertificateReply tck_reply;

            
              tck_reply.set_status(AttestationStatus::STATUS_SUCCESS);

            
              tck_reply.set_certificate(std::string(kFakeCert2Part1) +

            
                                        std::string(kFakeCert2Part2));

            
              tck_reply.set_public_key(kFakePublicKey2);

            
              tck_reply.set_key_blob(kFakeKeyBlob2);


              ExpectGetCertificateSuccess(tck_reply, tck_request);


              // Provisioning the Device Key should fail.

            
              GetCertificateRequest aadk_request;

            
              aadk_request.set_certificate_profile(

            
                  CertificateProfile::ARC_ATTESTATION_DEVICE_KEY_CERTIFICATE);

            
              aadk_request.set_aca_type(ACAType::DEFAULT_ACA);

            
              aadk_request.set_key_type(KeyType::KEY_TYPE_ECC);

            
              aadk_request.set_key_label(kArcAttestationDeviceKeyLabel);

            
              aadk_request.set_shall_trigger_enrollment(true);


              GetCertificateReply aadk_reply;

            
              aadk_reply.set_status(AttestationStatus::STATUS_UNEXPECTED_DEVICE_ERROR);


              ExpectGetCertificateSuccess(aadk_reply, aadk_request);


              // Make the API call for provisioning, and it should fail.

            
              AndroidStatus result = ProvisionDkCert(true);

            
              EXPECT_FALSE(result.is_ok());

            
            }


            TEST_F(ArcAttestationThreadedTest, NoCertWithoutProvision) {

            
              std::vector<Blob> cert_out;

            
              AndroidStatus result = GetDkCertChain(cert_out);

            
              EXPECT_FALSE(result.is_ok());

            
            }


            TEST_F(ArcAttestationThreadedTest, SignFailed) {

            
              // We need to be provisioned to test this.

            
              SetupSuccessfulProvision();

            
              AndroidStatus result = ProvisionDkCert(true);

            
              ASSERT_TRUE(result.is_ok());


              // Setup signing failure.

            
              SignRequest sign_request;

            
              sign_request.set_key_label(kArcAttestationDeviceKeyLabel);

            
              sign_request.set_data_to_sign(kFakeSignData1);


              SignReply sign_reply;

            
              sign_reply.set_status(AttestationStatus::STATUS_UNEXPECTED_DEVICE_ERROR);


              ExpectSignSuccess(sign_reply, sign_request);


              // Call and it should fail.

            
              Blob data_to_sign = BlobFromString(kFakeSignData1);

            
              Blob result_signature;

            
              result = SignWithP256Dk(data_to_sign, result_signature);

            
              EXPECT_FALSE(result.is_ok());

            
            }


            TEST_F(ArcAttestationThreadedTest, AttestVersionFailed) {

            
              // We need to be provisioned to test this.

            
              SetupSuccessfulProvision();

            
              AndroidStatus result = ProvisionDkCert(true);

            
              ASSERT_TRUE(result.is_ok());


              // AttestVersion should fail.

            
              EXPECT_CALL(*hwsec_, AttestVersion(BlobFromString(kFakeKeyBlob2),

            
                                                 std::string(kFakeCert2Part1) +

            
                                                     std::string(kFakeCert2Part2),

            
                                                 BlobFromString(kFakeChallenge)))

            
                  .WillOnce(ReturnError<TPMError>("fake", TPMRetryAction::kNoRetry));


              // Call to QuoteCrOSBlob should fail.

            
              Blob quoted_blob;

            
              result = QuoteCrOSBlob(BlobFromString(kFakeChallenge), quoted_blob);

            
              EXPECT_FALSE(result.is_ok());

            
            }


            }  // namespace arc_attestation
	// Copyright 2023 The ChromiumOS Authors
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include <attestation/proto_bindings/interface.pb.h>
	#include <libarc-attestation/lib/interface.h>
	#include <libarc-attestation/lib/manager.h>
	#include <libhwsec/factory/mock_factory.h>
	#include <libhwsec/frontend/arc_attestation/mock_frontend.h>
	#include <libhwsec-foundation/error/testing_helper.h>

	// This needs to be after interface.pb.h due to protobuf dependency.
	#include <attestation/dbus-proxy-mocks.h>

	#include <gtest/gtest.h>

	#include <base/strings/string_number_conversions.h>

	using attestation::ACAType;
	using attestation::AttestationStatus;
	using attestation::CertificateProfile;
	using attestation::GetCertificateReply;
	using attestation::GetCertificateRequest;
	using attestation::KeyType;
	using attestation::SignReply;
	using attestation::SignRequest;
	using brillo::Blob;
	using brillo::BlobFromString;
	using brillo::BlobToString;
	using hwsec::TPMError;
	using hwsec::TPMRetryAction;
	using hwsec_foundation::error::testing::ReturnError;
	using hwsec_foundation::error::testing::ReturnValue;

	using ::testing::_;
	using ::testing::DoAll;
	using ::testing::Ge;
	using ::testing::Invoke;
	using ::testing::Return;
	using ::testing::SaveArg;
	using ::testing::SetArgPointee;
	using ::testing::SetArgReferee;

	namespace arc_attestation {

	namespace {

	// gmock matcher for protobufs, allowing to check protobuf arguments in mocks.
	MATCHER_P(ProtobufEquals, expected_message, "") {
	std::string arg_dumped;
	arg.SerializeToString(&arg_dumped);
	std::string expected_message_dumped;
	expected_message.SerializeToString(&expected_message_dumped);
	return arg_dumped == expected_message_dumped;
	}

	} // namespace

	class ArcAttestationThreadedTest : public ::testing::Test {
	public:
	void SetUp() override {
	singleton_ = ArcAttestationManagerSingleton::CreateForTesting();
	std::unique_ptr<ArcAttestationManager> manager =
	std::make_unique<ArcAttestationManager>();
	manager_ = manager.get();
	singleton_->SetManagerForTesting(std::move(manager));

	manager_->Setup();

	std::unique_ptr<org::chromium::AttestationProxyMock> attestation_proxy =
	std::make_unique<org::chromium::AttestationProxyMock>();
	attestation_proxy_ = attestation_proxy.get();
	provisioner_ = manager_->GetProvisionerForTesting();
	provisioner_->SetAttestationProxyForTesting(std::move(attestation_proxy));
	version_attester_ = manager_->GetVersionAttesterForTesting();
	version_attester_->SetHwsecFactoryForTesting(&hwsec_factory_);

	default_hwsec_ = std::make_unique<hwsec::MockArcAttestationFrontend>();
	hwsec_ = default_hwsec_.get();
	ON_CALL(hwsec_factory_, GetArcAttestationFrontend())
	.WillByDefault(
	Invoke([this]() -> std::unique_ptr<hwsec::ArcAttestationFrontend> {
	CHECK(default_hwsec_);
	return std::move(default_hwsec_);
	}));
	}

	void TearDown() override {
	ArcAttestationManagerSingleton::DestroyForTesting();
	singleton_ = nullptr;
	manager_ = nullptr;
	attestation_proxy_ = nullptr;
	provisioner_ = nullptr;
	version_attester_ = nullptr;
	hwsec_ = nullptr;
	default_hwsec_.reset();
	}

	protected:
	void ExpectGetCertificateSuccess(const GetCertificateReply& reply,
	const GetCertificateRequest& request) {
	EXPECT_CALL(*attestation_proxy_,
	GetCertificate(ProtobufEquals(request), _, _,
	Ge(kGetCertificateMinTimeout.InMilliseconds())))
	.WillOnce(DoAll(SetArgPointee<1>(reply), Return(true)));
	}

	void ExpectSignSuccess(const SignReply& reply, const SignRequest& request) {
	EXPECT_CALL(*attestation_proxy_, Sign(ProtobufEquals(request), _, _,
	Ge(kSignMinTimeout.InMilliseconds())))
	.WillOnce(DoAll(SetArgPointee<1>(reply), Return(true)));
	}

	void SetupSuccessfulProvision() {
	// Setup the correct Android Device Key provision request expectation.
	GetCertificateRequest aadk_request;
	aadk_request.set_certificate_profile(
	CertificateProfile::ARC_ATTESTATION_DEVICE_KEY_CERTIFICATE);
	aadk_request.set_aca_type(ACAType::DEFAULT_ACA);
	aadk_request.set_key_type(KeyType::KEY_TYPE_ECC);
	aadk_request.set_key_label(kArcAttestationDeviceKeyLabel);
	aadk_request.set_shall_trigger_enrollment(true);

	GetCertificateReply aadk_reply;
	aadk_reply.set_status(AttestationStatus::STATUS_SUCCESS);
	aadk_reply.set_certificate(std::string(kFakeCert1Part1) +
	std::string(kFakeCert1Part2));
	aadk_reply.set_public_key(kFakePublicKey1);
	aadk_reply.set_key_blob(kFakeKeyBlob1);

	ExpectGetCertificateSuccess(aadk_reply, aadk_request);

	// Setup the correct TPM Certifying Key provision request expectation.
	GetCertificateRequest tck_request;
	tck_request.set_certificate_profile(
	CertificateProfile::ARC_TPM_CERTIFYING_KEY_CERTIFICATE);
	tck_request.set_aca_type(ACAType::DEFAULT_ACA);
	tck_request.set_key_type(KeyType::KEY_TYPE_ECC);
	tck_request.set_key_label(kTpmCertifyingKeyLabel);
	tck_request.set_shall_trigger_enrollment(true);

	GetCertificateReply tck_reply;
	tck_reply.set_status(AttestationStatus::STATUS_SUCCESS);
	tck_reply.set_certificate(std::string(kFakeCert2Part1) +
	std::string(kFakeCert2Part2));
	tck_reply.set_public_key(kFakePublicKey2);
	tck_reply.set_key_blob(kFakeKeyBlob2);

	ExpectGetCertificateSuccess(tck_reply, tck_request);
	}

	ArcAttestationManagerSingleton* singleton_;
	ArcAttestationManager* manager_;
	org::chromium::AttestationProxyMock* attestation_proxy_;
	Provisioner* provisioner_;
	VersionAttester* version_attester_;
	hwsec::MockFactory hwsec_factory_;
	std::unique_ptr<hwsec::MockArcAttestationFrontend> default_hwsec_;
	hwsec::MockArcAttestationFrontend* hwsec_;

	static constexpr base::TimeDelta kGetCertificateMinTimeout =
	base::Seconds(60);
	static constexpr base::TimeDelta kSignMinTimeout = base::Seconds(15);

	static constexpr char kArcAttestationDeviceKeyLabel[] =
	"arc-attestation-device-key";
	static constexpr char kTpmCertifyingKeyLabel[] = "tpm-certifying-key";

	static constexpr char kFakeCert1Part1[] =
	"-----BEGIN CERTIFICATE-----\n"
	"part1-of-fake-cert-1\n"
	"-----END CERTIFICATE-----\n";
	static constexpr char kFakeCert1Part2[] =
	"-----BEGIN CERTIFICATE-----\n"
	"fake-cert-1-last-part\n"
	"-----END CERTIFICATE-----\n";
	static constexpr char kFakePublicKey1[] = "this-is-a-fake-public-key";
	static constexpr char kFakeKeyBlob1[] = "this-is-a-fake-key-blob";

	static constexpr char kFakeCert2Part1[] =
	"-----BEGIN CERTIFICATE-----\n"
	"ca-of-another-cert\n"
	"-----END CERTIFICATE-----\n";
	static constexpr char kFakeCert2Part2[] =
	"-----BEGIN CERTIFICATE-----\n"
	"the-last-part-of-another-cert\n"
	"-----END CERTIFICATE-----\n";
	static constexpr char kFakePublicKey2[] = "some-fake-ecc-public-key";
	static constexpr char kFakeKeyBlob2[] = "yet-another-fake-key-blob";

	static constexpr char kFakeSignData1[] = "to-be-signed";
	static constexpr char kFakeSignature1[] = "already-signed";

	static constexpr char kFakeChallenge[] = "can-you-answer-this?";
	static constexpr char kFakeLsbRelease[] = "SOME_VERSION=1.2.3";
	static constexpr char kFakeCmdline[] = "lsb_hash=AABBCC1234";
	static constexpr char kFakePcrQuote[] = "pcr-quoted";
	static constexpr char kFakePcrSignature[] = "pcr-signed";
	};

	TEST_F(ArcAttestationThreadedTest, ProvisionValidityTest) {
	SetupSuccessfulProvision();

	// Make the API call for provisioning.
	AndroidStatus result = ProvisionDkCert(true);
	ASSERT_TRUE(result.is_ok());

	// Test the resulting certificate.
	std::vector<Blob> cert_out;
	result = GetDkCertChain(cert_out);
	ASSERT_TRUE(result.is_ok());

	ASSERT_EQ(cert_out.size(), 2);
	EXPECT_EQ(BlobToString(cert_out[0]), kFakeCert1Part1);
	EXPECT_EQ(BlobToString(cert_out[1]), kFakeCert1Part2);

	// Test the signing.
	SignRequest sign_request;
	sign_request.set_key_label(kArcAttestationDeviceKeyLabel);
	sign_request.set_data_to_sign(kFakeSignData1);

	SignReply sign_reply;
	sign_reply.set_status(AttestationStatus::STATUS_SUCCESS);
	sign_reply.set_signature(kFakeSignature1);

	ExpectSignSuccess(sign_reply, sign_request);

	Blob data_to_sign = BlobFromString(kFakeSignData1);
	Blob result_signature;
	result = SignWithP256Dk(data_to_sign, result_signature);
	ASSERT_TRUE(result.is_ok());

	EXPECT_EQ(BlobToString(result_signature), kFakeSignature1);

	// Test the version attestation.
	arc_attestation::CrOSVersionAttestationBlob blob_to_return;
	blob_to_return.set_version(arc_attestation::CrOSVersionAttestationVersion::
	CROS_BLOB_VERSION_TPM2_FORMAT_1);
	blob_to_return.set_tpm_certifying_key_cert(std::string(kFakeCert2Part1) +
	std::string(kFakeCert2Part2));
	blob_to_return.set_lsb_release_content(kFakeLsbRelease);
	blob_to_return.set_kernel_cmdline_content(kFakeCmdline);
	blob_to_return.set_kernel_cmdline_quote(kFakePcrQuote);
	blob_to_return.set_kernel_cmdline_quote_signature(kFakePcrSignature);
	EXPECT_CALL(*hwsec_, AttestVersion(BlobFromString(kFakeKeyBlob2),
	std::string(kFakeCert2Part1) +
	std::string(kFakeCert2Part2),
	BlobFromString(kFakeChallenge)))
	.WillOnce(Return(blob_to_return));

	Blob quoted_blob;
	result = QuoteCrOSBlob(BlobFromString(kFakeChallenge), quoted_blob);
	ASSERT_TRUE(result.is_ok());
	arc_attestation::CrOSSpecificBlob quoted_data;
	quoted_data.ParseFromString(BlobToString(quoted_blob));
	EXPECT_EQ(quoted_data.version_attestation().version(),
	arc_attestation::CrOSVersionAttestationVersion::
	CROS_BLOB_VERSION_TPM2_FORMAT_1);
	EXPECT_EQ(quoted_data.version_attestation().tpm_certifying_key_cert(),
	std::string(kFakeCert2Part1) + std::string(kFakeCert2Part2));
	EXPECT_EQ(quoted_data.version_attestation().lsb_release_content(),
	kFakeLsbRelease);
	EXPECT_EQ(quoted_data.version_attestation().kernel_cmdline_content(),
	kFakeCmdline);
	EXPECT_EQ(quoted_data.version_attestation().kernel_cmdline_quote(),
	kFakePcrQuote);
	EXPECT_EQ(quoted_data.version_attestation().kernel_cmdline_quote_signature(),
	kFakePcrSignature);
	}

	TEST_F(ArcAttestationThreadedTest, ProvisionTCKFailed) {
	// Provisioning the TPM Certifying Key should fail.
	GetCertificateRequest tck_request;
	tck_request.set_certificate_profile(
	CertificateProfile::ARC_TPM_CERTIFYING_KEY_CERTIFICATE);
	tck_request.set_aca_type(ACAType::DEFAULT_ACA);
	tck_request.set_key_type(KeyType::KEY_TYPE_ECC);
	tck_request.set_key_label(kTpmCertifyingKeyLabel);
	tck_request.set_shall_trigger_enrollment(true);

	GetCertificateReply tck_reply;
	tck_reply.set_status(AttestationStatus::STATUS_UNEXPECTED_DEVICE_ERROR);

	ExpectGetCertificateSuccess(tck_reply, tck_request);

	// Make the API call for provisioning, and it should fail.
	AndroidStatus result = ProvisionDkCert(true);
	EXPECT_FALSE(result.is_ok());
	}

	TEST_F(ArcAttestationThreadedTest, ProvisionDKFailed) {
	// Setup the correct TPM Certifying Key provision request expectation.
	GetCertificateRequest tck_request;
	tck_request.set_certificate_profile(
	CertificateProfile::ARC_TPM_CERTIFYING_KEY_CERTIFICATE);
	tck_request.set_aca_type(ACAType::DEFAULT_ACA);
	tck_request.set_key_type(KeyType::KEY_TYPE_ECC);
	tck_request.set_key_label(kTpmCertifyingKeyLabel);
	tck_request.set_shall_trigger_enrollment(true);

	GetCertificateReply tck_reply;
	tck_reply.set_status(AttestationStatus::STATUS_SUCCESS);
	tck_reply.set_certificate(std::string(kFakeCert2Part1) +
	std::string(kFakeCert2Part2));
	tck_reply.set_public_key(kFakePublicKey2);
	tck_reply.set_key_blob(kFakeKeyBlob2);

	ExpectGetCertificateSuccess(tck_reply, tck_request);

	// Provisioning the Device Key should fail.
	GetCertificateRequest aadk_request;
	aadk_request.set_certificate_profile(
	CertificateProfile::ARC_ATTESTATION_DEVICE_KEY_CERTIFICATE);
	aadk_request.set_aca_type(ACAType::DEFAULT_ACA);
	aadk_request.set_key_type(KeyType::KEY_TYPE_ECC);
	aadk_request.set_key_label(kArcAttestationDeviceKeyLabel);
	aadk_request.set_shall_trigger_enrollment(true);

	GetCertificateReply aadk_reply;
	aadk_reply.set_status(AttestationStatus::STATUS_UNEXPECTED_DEVICE_ERROR);

	ExpectGetCertificateSuccess(aadk_reply, aadk_request);

	// Make the API call for provisioning, and it should fail.
	AndroidStatus result = ProvisionDkCert(true);
	EXPECT_FALSE(result.is_ok());
	}

	TEST_F(ArcAttestationThreadedTest, NoCertWithoutProvision) {
	std::vector<Blob> cert_out;
	AndroidStatus result = GetDkCertChain(cert_out);
	EXPECT_FALSE(result.is_ok());
	}

	TEST_F(ArcAttestationThreadedTest, SignFailed) {
	// We need to be provisioned to test this.
	SetupSuccessfulProvision();
	AndroidStatus result = ProvisionDkCert(true);
	ASSERT_TRUE(result.is_ok());

	// Setup signing failure.
	SignRequest sign_request;
	sign_request.set_key_label(kArcAttestationDeviceKeyLabel);
	sign_request.set_data_to_sign(kFakeSignData1);

	SignReply sign_reply;
	sign_reply.set_status(AttestationStatus::STATUS_UNEXPECTED_DEVICE_ERROR);

	ExpectSignSuccess(sign_reply, sign_request);

	// Call and it should fail.
	Blob data_to_sign = BlobFromString(kFakeSignData1);
	Blob result_signature;
	result = SignWithP256Dk(data_to_sign, result_signature);
	EXPECT_FALSE(result.is_ok());
	}

	TEST_F(ArcAttestationThreadedTest, AttestVersionFailed) {
	// We need to be provisioned to test this.
	SetupSuccessfulProvision();
	AndroidStatus result = ProvisionDkCert(true);
	ASSERT_TRUE(result.is_ok());

	// AttestVersion should fail.
	EXPECT_CALL(*hwsec_, AttestVersion(BlobFromString(kFakeKeyBlob2),
	std::string(kFakeCert2Part1) +
	std::string(kFakeCert2Part2),
	BlobFromString(kFakeChallenge)))
	.WillOnce(ReturnError<TPMError>("fake", TPMRetryAction::kNoRetry));

	// Call to QuoteCrOSBlob should fail.
	Blob quoted_blob;
	result = QuoteCrOSBlob(BlobFromString(kFakeChallenge), quoted_blob);
	EXPECT_FALSE(result.is_ok());
	}

	} // namespace arc_attestation