No public description PiperOrigin-RevId: 934794846
diff --git a/quiche/blind_sign_auth/blind_sign_auth.cc b/quiche/blind_sign_auth/blind_sign_auth.cc index 767a192..de86473 100644 --- a/quiche/blind_sign_auth/blind_sign_auth.cc +++ b/quiche/blind_sign_auth/blind_sign_auth.cc
@@ -45,6 +45,8 @@ return value == 0 ? "" : absl::StrCat(value); } +constexpr absl::string_view kAttestationProtoTypeUrl = + "type.googleapis.com/privacy.ppn.AndroidAttestationData"; constexpr absl::string_view kIssuerHostname = "https://ipprotection-ppissuer.googleapis.com"; constexpr size_t kExpectedExtensionTypesSize = 5; @@ -372,7 +374,7 @@ void BlindSignAuth::AttestAndSign( int num_tokens, privacy::ppn::GetInitialDataResponse initial_data_response, SignedTokenCallback callback, - absl::StatusOr<google::protobuf::Any> attestation_data, + absl::StatusOr<absl::Span<const std::string>> attestation_data, std::optional<const absl::string_view> token_challenge) { absl::StatusOr<PrivacyPassContext> pp_context = CreatePrivacyPassContext(initial_data_response); @@ -410,13 +412,29 @@ return; } + // Create AndroidAttestationData. + AndroidAttestationData android_attestation_data; if (!attestation_data.ok()) { std::move(callback)(attestation_data.status()); return; } + if (attestation_data->empty()) { + std::move(callback)( + absl::InvalidArgumentError("Attestation data is empty")); + return; + } + for (absl::string_view cert : *attestation_data) { + android_attestation_data.add_hardware_backed_certs(cert); + } + + Any attestation_data_proto_any; + attestation_data_proto_any.set_type_url(kAttestationProtoTypeUrl); + attestation_data_proto_any.set_value( + android_attestation_data.SerializeAsString()); AttestationData attestation_data_proto; - *attestation_data_proto.mutable_attestation_data() = *attestation_data; + *attestation_data_proto.mutable_attestation_data() = + attestation_data_proto_any; // Create AttestAndSignRequest. AttestAndSignRequest sign_request;
diff --git a/quiche/blind_sign_auth/blind_sign_auth.h b/quiche/blind_sign_auth/blind_sign_auth.h index 8a4a10c..15accf7 100644 --- a/quiche/blind_sign_auth/blind_sign_auth.h +++ b/quiche/blind_sign_auth/blind_sign_auth.h
@@ -136,11 +136,12 @@ int num_tokens, AttestationDataCallback attestation_data_callback, SignedTokenCallback token_callback, absl::StatusOr<BlindSignMessageResponse> response); - void AttestAndSign(int num_tokens, - privacy::ppn::GetInitialDataResponse initial_data_response, - SignedTokenCallback callback, - absl::StatusOr<google::protobuf::Any> attestation_data, - std::optional<const absl::string_view> token_challenge); + void AttestAndSign( + int num_tokens, + privacy::ppn::GetInitialDataResponse initial_data_response, + SignedTokenCallback callback, + absl::StatusOr<absl::Span<const std::string>> attestation_data, + std::optional<const absl::string_view> token_challenge); void AttestAndSignCallback( PrivacyPassContext pp_context, const std::vector<std::unique_ptr<
diff --git a/quiche/blind_sign_auth/blind_sign_auth_interface.h b/quiche/blind_sign_auth/blind_sign_auth_interface.h index 8715a58..4058b6d 100644 --- a/quiche/blind_sign_auth/blind_sign_auth_interface.h +++ b/quiche/blind_sign_auth/blind_sign_auth_interface.h
@@ -10,7 +10,6 @@ #include <string> #include <utility> -#include "google/protobuf/any.pb.h" #include "absl/status/statusor.h" #include "absl/strings/string_view.h" #include "absl/time/time.h" @@ -55,8 +54,9 @@ // This callback is used by the caller to return generated // attestation data and a token challenge to the BlindSignAuth library. -using AttestAndSignCallback = SingleUseCallback<void( - absl::StatusOr<google::protobuf::Any>, std::optional<absl::string_view>)>; +using AttestAndSignCallback = + SingleUseCallback<void(absl::StatusOr<absl::Span<const std::string>>, + std::optional<absl::string_view>)>; // AttestationDataCallback returns a serialized // privacy::ppn::PrepareAttestationData proto, which contains an attestation
diff --git a/quiche/blind_sign_auth/blind_sign_auth_test.cc b/quiche/blind_sign_auth/blind_sign_auth_test.cc index dcffc92..2b2f3d4 100644 --- a/quiche/blind_sign_auth/blind_sign_auth_test.cc +++ b/quiche/blind_sign_auth/blind_sign_auth_test.cc
@@ -678,16 +678,10 @@ [](absl::string_view attestation_nonce, AttestAndSignCallback attest_and_sign_callback) { EXPECT_EQ(attestation_nonce, "test_attestation_nonce"); - privacy::ppn::AndroidAttestationData android_attestation_data; - android_attestation_data.add_hardware_backed_certs( - "fake_hardware_backed_cert"); - google::protobuf::Any attestation_data_any; - attestation_data_any.set_type_url( - "type.googleapis.com/privacy.ppn.AndroidAttestationData"); - attestation_data_any.set_value( - android_attestation_data.SerializeAsString()); + std::vector<std::string> hardware_backed_certs = { + "fake_hardware_backed_cert"}; std::move(attest_and_sign_callback)( - /*attestation_data=*/attestation_data_any, + /*attestation_data=*/hardware_backed_certs, /*token_challenge=*/std::nullopt); }; @@ -802,80 +796,6 @@ done.WaitForNotification(); } -TEST_F(BlindSignAuthTest, GetAttestationTokensMalformedTypeUrl) { - BlindSignMessageResponse fake_initial_data_attestation_response( - absl::StatusCode::kOk, - fake_get_initial_data_response_attestation_.SerializeAsString()); - - EXPECT_CALL(mock_message_interface(), - DoRequest(Eq(BlindSignMessageRequestType::kGetInitialData), _, - Eq(expected_get_initial_data_request_attestation_ - .SerializeAsString()), - _)) - .Times(1) - .WillOnce([=](auto&&, auto&&, auto&&, auto get_initial_data_cb) { - std::move(get_initial_data_cb)(fake_initial_data_attestation_response); - }); - - // Since BlindSignAuth passes the Any payload blindly to the backend, - // we just test that it is correctly serialized and sent. - EXPECT_CALL( - mock_message_interface(), - DoRequest(Eq(BlindSignMessageRequestType::kAttestAndSign), _, _, _)) - .Times(1) - .WillOnce([this](Unused, Unused, const std::string& body, - BlindSignMessageCallback attest_callback) { - privacy::ppn::AttestAndSignRequest request; - ASSERT_TRUE(request.ParseFromString(body)); - EXPECT_EQ(request.attestation().attestation_data().type_url(), - "type.googleapis.com/unknown.TypeUrl"); - EXPECT_EQ(request.attestation().attestation_data().value(), - "malformed_data"); - - // Construct fake response - privacy::ppn::AttestAndSignResponse response; - for (const auto& request_token : request.blinded_tokens()) { - std::string decoded_blinded_token; - ASSERT_TRUE( - absl::Base64Unescape(request_token, &decoded_blinded_token)); - absl::StatusOr<std::string> signature = - anonymous_tokens::TestSignWithPublicMetadata( - decoded_blinded_token, - fake_get_initial_data_response_attestation_ - .privacy_pass_data() - .public_metadata_extensions(), - *rsa_private_key_, false); - QUICHE_EXPECT_OK(signature); - response.add_blinded_token_signatures(absl::Base64Escape(*signature)); - } - BlindSignMessageResponse mock_resp(absl::StatusCode::kOk, - response.SerializeAsString()); - std::move(attest_callback)(mock_resp); - }); - - absl::Notification done; - AttestationDataCallback callback = - [](absl::string_view /*attestation_nonce*/, - AttestAndSignCallback attest_and_sign_callback) { - google::protobuf::Any attestation_data_any; - attestation_data_any.set_type_url( - "type.googleapis.com/unknown.TypeUrl"); - attestation_data_any.set_value("malformed_data"); - std::move(attest_and_sign_callback)( - /*attestation_data=*/attestation_data_any, - /*token_challenge=*/std::nullopt); - }; - SignedTokenCallback signed_token_callback = - [&done](absl::StatusOr<absl::Span<BlindSignToken>> tokens) { - EXPECT_TRUE(tokens.ok()); - done.Notify(); - }; - blind_sign_auth_->GetAttestationTokens( - /*num_tokens=*/1, ProxyLayer::kProxyA, std::move(callback), - std::move(signed_token_callback)); - done.WaitForNotification(); -} - } // namespace } // namespace test } // namespace quiche