The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Tao Bao | ac9d94d | 2016-11-03 11:37:15 -0700 | [diff] [blame] | 17 | #include "verifier.h" |
| 18 | |
Doug Zongker | 54e2e86 | 2009-08-17 13:21:04 -0700 | [diff] [blame] | 19 | #include <errno.h> |
Elliott Hughes | 26dbad2 | 2015-01-28 12:09:05 -0800 | [diff] [blame] | 20 | #include <stdio.h> |
Tao Bao | ac9d94d | 2016-11-03 11:37:15 -0700 | [diff] [blame] | 21 | #include <stdlib.h> |
Elliott Hughes | 26dbad2 | 2015-01-28 12:09:05 -0800 | [diff] [blame] | 22 | #include <string.h> |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 23 | |
Elliott Hughes | 8febafa | 2016-04-13 16:39:56 -0700 | [diff] [blame] | 24 | #include <algorithm> |
Tao Bao | d7bf82e | 2017-03-18 09:24:11 -0700 | [diff] [blame] | 25 | #include <functional> |
Elliott Hughes | 8febafa | 2016-04-13 16:39:56 -0700 | [diff] [blame] | 26 | #include <memory> |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 27 | #include <vector> |
Elliott Hughes | 8febafa | 2016-04-13 16:39:56 -0700 | [diff] [blame] | 28 | |
Tianjie Xu | 7b0ad9c | 2016-08-05 18:00:04 -0700 | [diff] [blame] | 29 | #include <android-base/logging.h> |
Tianjie Xu | 8256698 | 2018-10-10 15:44:17 -0700 | [diff] [blame] | 30 | #include <openssl/bio.h> |
David Benjamin | a86392e | 2016-04-15 20:22:09 -0400 | [diff] [blame] | 31 | #include <openssl/bn.h> |
Elliott Hughes | 8febafa | 2016-04-13 16:39:56 -0700 | [diff] [blame] | 32 | #include <openssl/ecdsa.h> |
Tianjie Xu | 8256698 | 2018-10-10 15:44:17 -0700 | [diff] [blame] | 33 | #include <openssl/evp.h> |
Elliott Hughes | 8febafa | 2016-04-13 16:39:56 -0700 | [diff] [blame] | 34 | #include <openssl/obj_mac.h> |
Tianjie Xu | 8256698 | 2018-10-10 15:44:17 -0700 | [diff] [blame] | 35 | #include <openssl/pem.h> |
| 36 | #include <openssl/rsa.h> |
Tianjie Xu | 0dd9685 | 2018-10-15 11:44:14 -0700 | [diff] [blame] | 37 | #include <ziparchive/zip_archive.h> |
Elliott Hughes | 8febafa | 2016-04-13 16:39:56 -0700 | [diff] [blame] | 38 | |
| 39 | #include "asn1_decoder.h" |
Tao Bao | 09e468f | 2017-09-29 14:39:33 -0700 | [diff] [blame] | 40 | #include "otautil/print_sha1.h" |
Doug Zongker | 211aebc | 2011-10-28 15:13:10 -0700 | [diff] [blame] | 41 | |
Elliott Hughes | 8febafa | 2016-04-13 16:39:56 -0700 | [diff] [blame] | 42 | static constexpr size_t MiB = 1024 * 1024; |
| 43 | |
Kenny Root | 7a4adb5 | 2013-10-09 10:14:35 -0700 | [diff] [blame] | 44 | /* |
| 45 | * Simple version of PKCS#7 SignedData extraction. This extracts the |
| 46 | * signature OCTET STRING to be used for signature verification. |
| 47 | * |
| 48 | * For full details, see http://www.ietf.org/rfc/rfc3852.txt |
| 49 | * |
| 50 | * The PKCS#7 structure looks like: |
| 51 | * |
| 52 | * SEQUENCE (ContentInfo) |
| 53 | * OID (ContentType) |
| 54 | * [0] (content) |
| 55 | * SEQUENCE (SignedData) |
| 56 | * INTEGER (version CMSVersion) |
| 57 | * SET (DigestAlgorithmIdentifiers) |
| 58 | * SEQUENCE (EncapsulatedContentInfo) |
| 59 | * [0] (CertificateSet OPTIONAL) |
| 60 | * [1] (RevocationInfoChoices OPTIONAL) |
| 61 | * SET (SignerInfos) |
| 62 | * SEQUENCE (SignerInfo) |
| 63 | * INTEGER (CMSVersion) |
| 64 | * SEQUENCE (SignerIdentifier) |
| 65 | * SEQUENCE (DigestAlgorithmIdentifier) |
| 66 | * SEQUENCE (SignatureAlgorithmIdentifier) |
| 67 | * OCTET STRING (SignatureValue) |
| 68 | */ |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 69 | static bool read_pkcs7(const uint8_t* pkcs7_der, size_t pkcs7_der_len, |
| 70 | std::vector<uint8_t>* sig_der) { |
| 71 | CHECK(sig_der != nullptr); |
| 72 | sig_der->clear(); |
Kenny Root | 7a4adb5 | 2013-10-09 10:14:35 -0700 | [diff] [blame] | 73 | |
Tao Bao | 861c53c | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 74 | asn1_context ctx(pkcs7_der, pkcs7_der_len); |
| 75 | |
| 76 | std::unique_ptr<asn1_context> pkcs7_seq(ctx.asn1_sequence_get()); |
| 77 | if (pkcs7_seq == nullptr || !pkcs7_seq->asn1_sequence_next()) { |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 78 | return false; |
| 79 | } |
| 80 | |
Tao Bao | 861c53c | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 81 | std::unique_ptr<asn1_context> signed_data_app(pkcs7_seq->asn1_constructed_get()); |
| 82 | if (signed_data_app == nullptr) { |
| 83 | return false; |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 84 | } |
Kenny Root | 7a4adb5 | 2013-10-09 10:14:35 -0700 | [diff] [blame] | 85 | |
Tao Bao | 861c53c | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 86 | std::unique_ptr<asn1_context> signed_data_seq(signed_data_app->asn1_sequence_get()); |
| 87 | if (signed_data_seq == nullptr || |
| 88 | !signed_data_seq->asn1_sequence_next() || |
| 89 | !signed_data_seq->asn1_sequence_next() || |
| 90 | !signed_data_seq->asn1_sequence_next() || |
| 91 | !signed_data_seq->asn1_constructed_skip_all()) { |
| 92 | return false; |
| 93 | } |
| 94 | |
| 95 | std::unique_ptr<asn1_context> sig_set(signed_data_seq->asn1_set_get()); |
| 96 | if (sig_set == nullptr) { |
| 97 | return false; |
| 98 | } |
| 99 | |
| 100 | std::unique_ptr<asn1_context> sig_seq(sig_set->asn1_sequence_get()); |
| 101 | if (sig_seq == nullptr || |
| 102 | !sig_seq->asn1_sequence_next() || |
| 103 | !sig_seq->asn1_sequence_next() || |
| 104 | !sig_seq->asn1_sequence_next() || |
| 105 | !sig_seq->asn1_sequence_next()) { |
| 106 | return false; |
| 107 | } |
| 108 | |
| 109 | const uint8_t* sig_der_ptr; |
| 110 | size_t sig_der_length; |
| 111 | if (!sig_seq->asn1_octet_string_get(&sig_der_ptr, &sig_der_length)) { |
| 112 | return false; |
| 113 | } |
| 114 | |
| 115 | sig_der->resize(sig_der_length); |
| 116 | std::copy(sig_der_ptr, sig_der_ptr + sig_der_length, sig_der->begin()); |
| 117 | return true; |
Kenny Root | 7a4adb5 | 2013-10-09 10:14:35 -0700 | [diff] [blame] | 118 | } |
| 119 | |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 120 | int verify_file(VerifierInterface* package, const std::vector<Certificate>& keys) { |
| 121 | CHECK(package); |
| 122 | package->SetProgress(0.0); |
Doug Zongker | 54e2e86 | 2009-08-17 13:21:04 -0700 | [diff] [blame] | 123 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 124 | // An archive with a whole-file signature will end in six bytes: |
| 125 | // |
| 126 | // (2-byte signature start) $ff $ff (2-byte comment size) |
| 127 | // |
| 128 | // (As far as the ZIP format is concerned, these are part of the archive comment.) We start by |
| 129 | // reading this footer, this tells us how far back from the end we have to start reading to find |
| 130 | // the whole comment. |
Doug Zongker | 54e2e86 | 2009-08-17 13:21:04 -0700 | [diff] [blame] | 131 | |
| 132 | #define FOOTER_SIZE 6 |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 133 | uint64_t length = package->GetPackageSize(); |
Doug Zongker | 54e2e86 | 2009-08-17 13:21:04 -0700 | [diff] [blame] | 134 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 135 | if (length < FOOTER_SIZE) { |
| 136 | LOG(ERROR) << "not big enough to contain footer"; |
| 137 | return VERIFY_FAILURE; |
| 138 | } |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 139 | |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 140 | uint8_t footer[FOOTER_SIZE]; |
| 141 | if (!package->ReadFullyAtOffset(footer, FOOTER_SIZE, length - FOOTER_SIZE)) { |
| 142 | LOG(ERROR) << "Failed to read footer"; |
| 143 | return VERIFY_FAILURE; |
| 144 | } |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 145 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 146 | if (footer[2] != 0xff || footer[3] != 0xff) { |
| 147 | LOG(ERROR) << "footer is wrong"; |
| 148 | return VERIFY_FAILURE; |
| 149 | } |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 150 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 151 | size_t comment_size = footer[4] + (footer[5] << 8); |
| 152 | size_t signature_start = footer[0] + (footer[1] << 8); |
| 153 | LOG(INFO) << "comment is " << comment_size << " bytes; signature is " << signature_start |
| 154 | << " bytes from end"; |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 155 | |
Tao Bao | 553c7bd | 2017-03-18 07:33:26 -0700 | [diff] [blame] | 156 | if (signature_start > comment_size) { |
| 157 | LOG(ERROR) << "signature start: " << signature_start << " is larger than comment size: " |
| 158 | << comment_size; |
| 159 | return VERIFY_FAILURE; |
| 160 | } |
Tianjie Xu | 54ea136 | 2016-12-16 16:24:09 -0800 | [diff] [blame] | 161 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 162 | if (signature_start <= FOOTER_SIZE) { |
| 163 | LOG(ERROR) << "Signature start is in the footer"; |
| 164 | return VERIFY_FAILURE; |
| 165 | } |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 166 | |
Doug Zongker | 54e2e86 | 2009-08-17 13:21:04 -0700 | [diff] [blame] | 167 | #define EOCD_HEADER_SIZE 22 |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 168 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 169 | // The end-of-central-directory record is 22 bytes plus any comment length. |
| 170 | size_t eocd_size = comment_size + EOCD_HEADER_SIZE; |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 171 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 172 | if (length < eocd_size) { |
| 173 | LOG(ERROR) << "not big enough to contain EOCD"; |
Doug Zongker | 54e2e86 | 2009-08-17 13:21:04 -0700 | [diff] [blame] | 174 | return VERIFY_FAILURE; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 175 | } |
| 176 | |
| 177 | // Determine how much of the file is covered by the signature. This is everything except the |
| 178 | // signature data and length, which includes all of the EOCD except for the comment length field |
| 179 | // (2 bytes) and the comment data. |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 180 | uint64_t signed_len = length - eocd_size + EOCD_HEADER_SIZE - 2; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 181 | |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 182 | uint8_t eocd[eocd_size]; |
| 183 | if (!package->ReadFullyAtOffset(eocd, eocd_size, length - eocd_size)) { |
| 184 | LOG(ERROR) << "Failed to read EOCD of " << eocd_size << " bytes"; |
| 185 | return VERIFY_FAILURE; |
| 186 | } |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 187 | |
| 188 | // If this is really is the EOCD record, it will begin with the magic number $50 $4b $05 $06. |
| 189 | if (eocd[0] != 0x50 || eocd[1] != 0x4b || eocd[2] != 0x05 || eocd[3] != 0x06) { |
| 190 | LOG(ERROR) << "signature length doesn't match EOCD marker"; |
| 191 | return VERIFY_FAILURE; |
| 192 | } |
| 193 | |
| 194 | for (size_t i = 4; i < eocd_size-3; ++i) { |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 195 | if (eocd[i] == 0x50 && eocd[i+1] == 0x4b && eocd[i+2] == 0x05 && eocd[i+3] == 0x06) { |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 196 | // If the sequence $50 $4b $05 $06 appears anywhere after the real one, libziparchive will |
| 197 | // find the later (wrong) one, which could be exploitable. Fail the verification if this |
| 198 | // sequence occurs anywhere after the real one. |
| 199 | LOG(ERROR) << "EOCD marker occurs after start of EOCD"; |
| 200 | return VERIFY_FAILURE; |
| 201 | } |
| 202 | } |
| 203 | |
| 204 | bool need_sha1 = false; |
| 205 | bool need_sha256 = false; |
| 206 | for (const auto& key : keys) { |
| 207 | switch (key.hash_len) { |
| 208 | case SHA_DIGEST_LENGTH: need_sha1 = true; break; |
| 209 | case SHA256_DIGEST_LENGTH: need_sha256 = true; break; |
| 210 | } |
| 211 | } |
| 212 | |
| 213 | SHA_CTX sha1_ctx; |
| 214 | SHA256_CTX sha256_ctx; |
| 215 | SHA1_Init(&sha1_ctx); |
| 216 | SHA256_Init(&sha256_ctx); |
| 217 | |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 218 | std::vector<HasherUpdateCallback> hashers; |
| 219 | if (need_sha1) { |
| 220 | hashers.emplace_back( |
| 221 | std::bind(&SHA1_Update, &sha1_ctx, std::placeholders::_1, std::placeholders::_2)); |
| 222 | } |
| 223 | if (need_sha256) { |
| 224 | hashers.emplace_back( |
| 225 | std::bind(&SHA256_Update, &sha256_ctx, std::placeholders::_1, std::placeholders::_2)); |
| 226 | } |
| 227 | |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 228 | double frac = -1.0; |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 229 | uint64_t so_far = 0; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 230 | while (so_far < signed_len) { |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 231 | // On a Nexus 5X, experiment showed 16MiB beat 1MiB by 6% faster for a 1196MiB full OTA and |
| 232 | // 60% for an 89MiB incremental OTA. http://b/28135231. |
| 233 | uint64_t read_size = std::min<uint64_t>(signed_len - so_far, 16 * MiB); |
| 234 | package->UpdateHashAtOffset(hashers, so_far, read_size); |
| 235 | so_far += read_size; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 236 | |
xunchang | f07ed2e | 2019-02-25 14:14:01 -0800 | [diff] [blame] | 237 | double f = so_far / static_cast<double>(signed_len); |
| 238 | if (f > frac + 0.02 || read_size == so_far) { |
| 239 | package->SetProgress(f); |
| 240 | frac = f; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 241 | } |
| 242 | } |
| 243 | |
| 244 | uint8_t sha1[SHA_DIGEST_LENGTH]; |
| 245 | SHA1_Final(sha1, &sha1_ctx); |
| 246 | uint8_t sha256[SHA256_DIGEST_LENGTH]; |
| 247 | SHA256_Final(sha256, &sha256_ctx); |
| 248 | |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 249 | const uint8_t* signature = eocd + eocd_size - signature_start; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 250 | size_t signature_size = signature_start - FOOTER_SIZE; |
| 251 | |
| 252 | LOG(INFO) << "signature (offset: " << std::hex << (length - signature_start) << ", length: " |
| 253 | << signature_size << "): " << print_hex(signature, signature_size); |
| 254 | |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 255 | std::vector<uint8_t> sig_der; |
| 256 | if (!read_pkcs7(signature, signature_size, &sig_der)) { |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 257 | LOG(ERROR) << "Could not find signature DER block"; |
| 258 | return VERIFY_FAILURE; |
| 259 | } |
| 260 | |
| 261 | // Check to make sure at least one of the keys matches the signature. Since any key can match, |
| 262 | // we need to try each before determining a verification failure has happened. |
| 263 | size_t i = 0; |
| 264 | for (const auto& key : keys) { |
| 265 | const uint8_t* hash; |
| 266 | int hash_nid; |
| 267 | switch (key.hash_len) { |
| 268 | case SHA_DIGEST_LENGTH: |
| 269 | hash = sha1; |
| 270 | hash_nid = NID_sha1; |
| 271 | break; |
| 272 | case SHA256_DIGEST_LENGTH: |
| 273 | hash = sha256; |
| 274 | hash_nid = NID_sha256; |
| 275 | break; |
| 276 | default: |
| 277 | continue; |
| 278 | } |
| 279 | |
| 280 | // The 6 bytes is the "(signature_start) $ff $ff (comment_size)" that the signing tool appends |
| 281 | // after the signature itself. |
| 282 | if (key.key_type == Certificate::KEY_TYPE_RSA) { |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 283 | if (!RSA_verify(hash_nid, hash, key.hash_len, sig_der.data(), sig_der.size(), |
| 284 | key.rsa.get())) { |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 285 | LOG(INFO) << "failed to verify against RSA key " << i; |
| 286 | continue; |
| 287 | } |
| 288 | |
| 289 | LOG(INFO) << "whole-file signature verified against RSA key " << i; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 290 | return VERIFY_SUCCESS; |
| 291 | } else if (key.key_type == Certificate::KEY_TYPE_EC && key.hash_len == SHA256_DIGEST_LENGTH) { |
Tao Bao | 76fdb24 | 2017-03-20 17:09:13 -0700 | [diff] [blame] | 292 | if (!ECDSA_verify(0, hash, key.hash_len, sig_der.data(), sig_der.size(), key.ec.get())) { |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 293 | LOG(INFO) << "failed to verify against EC key " << i; |
| 294 | continue; |
| 295 | } |
| 296 | |
| 297 | LOG(INFO) << "whole-file signature verified against EC key " << i; |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 298 | return VERIFY_SUCCESS; |
| 299 | } else { |
| 300 | LOG(INFO) << "Unknown key type " << key.key_type; |
| 301 | } |
| 302 | i++; |
| 303 | } |
| 304 | |
| 305 | if (need_sha1) { |
| 306 | LOG(INFO) << "SHA-1 digest: " << print_hex(sha1, SHA_DIGEST_LENGTH); |
| 307 | } |
| 308 | if (need_sha256) { |
| 309 | LOG(INFO) << "SHA-256 digest: " << print_hex(sha256, SHA256_DIGEST_LENGTH); |
| 310 | } |
Tao Bao | 5e53501 | 2017-03-16 17:37:38 -0700 | [diff] [blame] | 311 | LOG(ERROR) << "failed to verify whole-file signature"; |
| 312 | return VERIFY_FAILURE; |
The Android Open Source Project | c24a8e6 | 2009-03-03 19:28:42 -0800 | [diff] [blame] | 313 | } |
Doug Zongker | 6c249f7 | 2012-11-02 15:04:05 -0700 | [diff] [blame] | 314 | |
Tianjie Xu | 0dd9685 | 2018-10-15 11:44:14 -0700 | [diff] [blame] | 315 | static std::vector<Certificate> IterateZipEntriesAndSearchForKeys(const ZipArchiveHandle& handle) { |
| 316 | void* cookie; |
| 317 | ZipString suffix("x509.pem"); |
| 318 | int32_t iter_status = StartIteration(handle, &cookie, nullptr, &suffix); |
| 319 | if (iter_status != 0) { |
| 320 | LOG(ERROR) << "Failed to iterate over entries in the certificate zipfile: " |
| 321 | << ErrorCodeString(iter_status); |
| 322 | return {}; |
| 323 | } |
| 324 | |
| 325 | std::vector<Certificate> result; |
| 326 | |
| 327 | ZipString name; |
| 328 | ZipEntry entry; |
| 329 | while ((iter_status = Next(cookie, &entry, &name)) == 0) { |
| 330 | std::vector<uint8_t> pem_content(entry.uncompressed_length); |
| 331 | if (int32_t extract_status = |
| 332 | ExtractToMemory(handle, &entry, pem_content.data(), pem_content.size()); |
| 333 | extract_status != 0) { |
| 334 | LOG(ERROR) << "Failed to extract " << std::string(name.name, name.name + name.name_length); |
| 335 | return {}; |
| 336 | } |
| 337 | |
| 338 | Certificate cert(0, Certificate::KEY_TYPE_RSA, nullptr, nullptr); |
| 339 | // Aborts the parsing if we fail to load one of the key file. |
| 340 | if (!LoadCertificateFromBuffer(pem_content, &cert)) { |
| 341 | LOG(ERROR) << "Failed to load keys from " |
| 342 | << std::string(name.name, name.name + name.name_length); |
| 343 | return {}; |
| 344 | } |
| 345 | |
| 346 | result.emplace_back(std::move(cert)); |
| 347 | } |
| 348 | |
| 349 | if (iter_status != -1) { |
| 350 | LOG(ERROR) << "Error while iterating over zip entries: " << ErrorCodeString(iter_status); |
| 351 | return {}; |
| 352 | } |
| 353 | |
| 354 | return result; |
| 355 | } |
| 356 | |
| 357 | std::vector<Certificate> LoadKeysFromZipfile(const std::string& zip_name) { |
| 358 | ZipArchiveHandle handle; |
| 359 | if (int32_t open_status = OpenArchive(zip_name.c_str(), &handle); open_status != 0) { |
| 360 | LOG(ERROR) << "Failed to open " << zip_name << ": " << ErrorCodeString(open_status); |
| 361 | return {}; |
| 362 | } |
| 363 | |
| 364 | std::vector<Certificate> result = IterateZipEntriesAndSearchForKeys(handle); |
| 365 | CloseArchive(handle); |
| 366 | return result; |
| 367 | } |
| 368 | |
Tianjie Xu | b5110de | 2018-10-23 23:31:43 -0700 | [diff] [blame] | 369 | bool CheckRSAKey(const std::unique_ptr<RSA, RSADeleter>& rsa) { |
| 370 | if (!rsa) { |
| 371 | return false; |
| 372 | } |
| 373 | |
| 374 | const BIGNUM* out_n; |
| 375 | const BIGNUM* out_e; |
| 376 | RSA_get0_key(rsa.get(), &out_n, &out_e, nullptr /* private exponent */); |
| 377 | auto modulus_bits = BN_num_bits(out_n); |
| 378 | if (modulus_bits != 2048) { |
| 379 | LOG(ERROR) << "Modulus should be 2048 bits long, actual: " << modulus_bits; |
| 380 | return false; |
| 381 | } |
| 382 | |
| 383 | BN_ULONG exponent = BN_get_word(out_e); |
| 384 | if (exponent != 3 && exponent != 65537) { |
| 385 | LOG(ERROR) << "Public exponent should be 3 or 65537, actual: " << exponent; |
| 386 | return false; |
| 387 | } |
| 388 | |
| 389 | return true; |
| 390 | } |
| 391 | |
| 392 | bool CheckECKey(const std::unique_ptr<EC_KEY, ECKEYDeleter>& ec_key) { |
| 393 | if (!ec_key) { |
| 394 | return false; |
| 395 | } |
| 396 | |
| 397 | const EC_GROUP* ec_group = EC_KEY_get0_group(ec_key.get()); |
| 398 | if (!ec_group) { |
| 399 | LOG(ERROR) << "Failed to get the ec_group from the ec_key"; |
| 400 | return false; |
| 401 | } |
| 402 | auto degree = EC_GROUP_get_degree(ec_group); |
| 403 | if (degree != 256) { |
| 404 | LOG(ERROR) << "Field size of the ec key should be 256 bits long, actual: " << degree; |
| 405 | return false; |
| 406 | } |
| 407 | |
| 408 | return true; |
| 409 | } |
| 410 | |
Tianjie Xu | 8256698 | 2018-10-10 15:44:17 -0700 | [diff] [blame] | 411 | bool LoadCertificateFromBuffer(const std::vector<uint8_t>& pem_content, Certificate* cert) { |
| 412 | std::unique_ptr<BIO, decltype(&BIO_free)> content( |
| 413 | BIO_new_mem_buf(pem_content.data(), pem_content.size()), BIO_free); |
| 414 | |
| 415 | std::unique_ptr<X509, decltype(&X509_free)> x509( |
| 416 | PEM_read_bio_X509(content.get(), nullptr, nullptr, nullptr), X509_free); |
| 417 | if (!x509) { |
| 418 | LOG(ERROR) << "Failed to read x509 certificate"; |
| 419 | return false; |
| 420 | } |
| 421 | |
| 422 | int nid = X509_get_signature_nid(x509.get()); |
| 423 | switch (nid) { |
| 424 | // SignApk has historically accepted md5WithRSA certificates, but treated them as |
| 425 | // sha1WithRSA anyway. Continue to do so for backwards compatibility. |
| 426 | case NID_md5WithRSA: |
| 427 | case NID_md5WithRSAEncryption: |
| 428 | case NID_sha1WithRSA: |
| 429 | case NID_sha1WithRSAEncryption: |
| 430 | cert->hash_len = SHA_DIGEST_LENGTH; |
| 431 | break; |
| 432 | case NID_sha256WithRSAEncryption: |
| 433 | case NID_ecdsa_with_SHA256: |
| 434 | cert->hash_len = SHA256_DIGEST_LENGTH; |
| 435 | break; |
| 436 | default: |
| 437 | LOG(ERROR) << "Unrecognized signature nid " << OBJ_nid2ln(nid); |
| 438 | return false; |
| 439 | } |
| 440 | |
| 441 | std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)> public_key(X509_get_pubkey(x509.get()), |
| 442 | EVP_PKEY_free); |
| 443 | if (!public_key) { |
| 444 | LOG(ERROR) << "Failed to extract the public key from x509 certificate"; |
| 445 | return false; |
| 446 | } |
| 447 | |
| 448 | int key_type = EVP_PKEY_id(public_key.get()); |
Tianjie Xu | 8256698 | 2018-10-10 15:44:17 -0700 | [diff] [blame] | 449 | if (key_type == EVP_PKEY_RSA) { |
| 450 | cert->key_type = Certificate::KEY_TYPE_RSA; |
| 451 | cert->ec.reset(); |
| 452 | cert->rsa.reset(EVP_PKEY_get1_RSA(public_key.get())); |
Tianjie Xu | b5110de | 2018-10-23 23:31:43 -0700 | [diff] [blame] | 453 | if (!cert->rsa || !CheckRSAKey(cert->rsa)) { |
| 454 | LOG(ERROR) << "Failed to validate the rsa key info from public key"; |
Tianjie Xu | 8256698 | 2018-10-10 15:44:17 -0700 | [diff] [blame] | 455 | return false; |
| 456 | } |
| 457 | } else if (key_type == EVP_PKEY_EC) { |
| 458 | cert->key_type = Certificate::KEY_TYPE_EC; |
| 459 | cert->rsa.reset(); |
| 460 | cert->ec.reset(EVP_PKEY_get1_EC_KEY(public_key.get())); |
Tianjie Xu | b5110de | 2018-10-23 23:31:43 -0700 | [diff] [blame] | 461 | if (!cert->ec || !CheckECKey(cert->ec)) { |
| 462 | LOG(ERROR) << "Failed to validate the ec key info from the public key"; |
Tianjie Xu | 8256698 | 2018-10-10 15:44:17 -0700 | [diff] [blame] | 463 | return false; |
| 464 | } |
| 465 | } else { |
| 466 | LOG(ERROR) << "Unrecognized public key type " << OBJ_nid2ln(key_type); |
| 467 | return false; |
| 468 | } |
| 469 | |
| 470 | return true; |
| 471 | } |