1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 //! Utilities for Signature Verification
18
19 use anyhow::{anyhow, ensure, Error, Result};
20 use apkzip::{set_central_directory_offset, zip_sections};
21 use byteorder::{LittleEndian, ReadBytesExt};
22 use bytes::{Buf, BufMut, Bytes, BytesMut};
23 use openssl::hash::{DigestBytes, Hasher, MessageDigest};
24 use std::cmp::min;
25 use std::io::{self, Cursor, ErrorKind, Read, Seek, SeekFrom, Take};
26
27 use crate::algorithms::SignatureAlgorithmID;
28
29 const APK_SIG_BLOCK_MIN_SIZE: u32 = 32;
30 const APK_SIG_BLOCK_MAGIC: u128 = 0x3234206b636f6c4220676953204b5041;
31
32 const CHUNK_SIZE_BYTES: u64 = 1024 * 1024;
33 const CHUNK_HEADER_TOP: &[u8] = &[0x5a];
34 const CHUNK_HEADER_MID: &[u8] = &[0xa5];
35
36 /// The [APK structure] has four major sections:
37 ///
38 /// | Zip contents | APK Signing Block | Central directory | EOCD(End of Central Directory) |
39 ///
40 /// This structure contains the offset/size information of all the sections except the Zip contents.
41 ///
42 /// [APK structure]: https://source.android.com/docs/security/apksigning/v2#apk-signing-block
43 pub struct ApkSections<R> {
44 inner: R,
45 signing_block_offset: u32,
46 signing_block_size: u32,
47 central_directory_offset: u32,
48 central_directory_size: u32,
49 eocd_offset: u32,
50 eocd_size: u32,
51 }
52
53 impl<R: Read + Seek> ApkSections<R> {
new(mut reader: R) -> Result<ApkSections<R>>54 pub fn new(mut reader: R) -> Result<ApkSections<R>> {
55 let zip_sections = zip_sections(&mut reader)?;
56 let (signing_block_offset, signing_block_size) =
57 find_signing_block(&mut reader, zip_sections.central_directory_offset)?;
58 Ok(ApkSections {
59 inner: reader,
60 signing_block_offset,
61 signing_block_size,
62 central_directory_offset: zip_sections.central_directory_offset,
63 central_directory_size: zip_sections.central_directory_size,
64 eocd_offset: zip_sections.eocd_offset,
65 eocd_size: zip_sections.eocd_size,
66 })
67 }
68
69 /// Returns the APK Signature Scheme block contained in the provided file for the given ID
70 /// and the additional information relevant for verifying the block against the file.
find_signature(&mut self, block_id: u32) -> Result<Bytes>71 pub fn find_signature(&mut self, block_id: u32) -> Result<Bytes> {
72 let signing_block = self.bytes(self.signing_block_offset, self.signing_block_size)?;
73 find_signature_scheme_block(Bytes::from(signing_block), block_id)
74 }
75
76 /// Computes digest with "signature algorithm" over APK contents, central directory, and EOCD.
77 /// 1. The digest of each chunk is computed over the concatenation of byte 0xa5, the chunk’s
78 /// length in bytes (little-endian uint32), and the chunk’s contents.
79 /// 2. The top-level digest is computed over the concatenation of byte 0x5a, the number of
80 /// chunks (little-endian uint32), and the concatenation of digests of the chunks in the
81 /// order the chunks appear in the APK.
82 /// (see https://source.android.com/security/apksigning/v2#integrity-protected-contents)
compute_digest( &mut self, signature_algorithm_id: SignatureAlgorithmID, ) -> Result<Vec<u8>>83 pub(crate) fn compute_digest(
84 &mut self,
85 signature_algorithm_id: SignatureAlgorithmID,
86 ) -> Result<Vec<u8>> {
87 let digester = Digester { message_digest: signature_algorithm_id.new_message_digest() };
88 let mut digests_of_chunks = BytesMut::new();
89 let mut chunk_count = 0u32;
90 let mut chunk = vec![0u8; CHUNK_SIZE_BYTES as usize];
91 for data in &[
92 ApkSections::zip_entries,
93 ApkSections::central_directory,
94 ApkSections::eocd_for_verification,
95 ] {
96 let mut data = data(self)?;
97 while data.limit() > 0 {
98 let chunk_size = min(CHUNK_SIZE_BYTES, data.limit());
99 let slice = &mut chunk[..(chunk_size as usize)];
100 data.read_exact(slice)?;
101 digests_of_chunks.put_slice(
102 digester.digest(slice, CHUNK_HEADER_MID, chunk_size as u32)?.as_ref(),
103 );
104 chunk_count += 1;
105 }
106 }
107 Ok(digester.digest(&digests_of_chunks, CHUNK_HEADER_TOP, chunk_count)?.as_ref().into())
108 }
109
zip_entries(&mut self) -> Result<Take<Box<dyn Read + '_>>>110 fn zip_entries(&mut self) -> Result<Take<Box<dyn Read + '_>>> {
111 scoped_read(&mut self.inner, 0, self.signing_block_offset as u64)
112 }
113
central_directory(&mut self) -> Result<Take<Box<dyn Read + '_>>>114 fn central_directory(&mut self) -> Result<Take<Box<dyn Read + '_>>> {
115 scoped_read(
116 &mut self.inner,
117 self.central_directory_offset as u64,
118 self.central_directory_size as u64,
119 )
120 }
121
eocd_for_verification(&mut self) -> Result<Take<Box<dyn Read + '_>>>122 fn eocd_for_verification(&mut self) -> Result<Take<Box<dyn Read + '_>>> {
123 let mut eocd = self.bytes(self.eocd_offset, self.eocd_size)?;
124 // Protection of section 4 (ZIP End of Central Directory) is complicated by the section
125 // containing the offset of ZIP Central Directory. The offset changes when the size of the
126 // APK Signing Block changes, for instance, when a new signature is added. Thus, when
127 // computing digest over the ZIP End of Central Directory, the field containing the offset
128 // of ZIP Central Directory must be treated as containing the offset of the APK Signing
129 // Block.
130 set_central_directory_offset(&mut eocd, self.signing_block_offset)?;
131 Ok(Read::take(Box::new(Cursor::new(eocd)), self.eocd_size as u64))
132 }
133
bytes(&mut self, offset: u32, size: u32) -> Result<Vec<u8>>134 fn bytes(&mut self, offset: u32, size: u32) -> Result<Vec<u8>> {
135 self.inner.seek(SeekFrom::Start(offset as u64))?;
136 let mut buf = vec![0u8; size as usize];
137 self.inner.read_exact(&mut buf)?;
138 Ok(buf)
139 }
140 }
141
scoped_read<'a, R: Read + Seek>( src: &'a mut R, offset: u64, size: u64, ) -> Result<Take<Box<dyn Read + 'a>>>142 fn scoped_read<'a, R: Read + Seek>(
143 src: &'a mut R,
144 offset: u64,
145 size: u64,
146 ) -> Result<Take<Box<dyn Read + 'a>>> {
147 src.seek(SeekFrom::Start(offset))?;
148 Ok(Read::take(Box::new(src), size))
149 }
150
151 struct Digester {
152 message_digest: MessageDigest,
153 }
154
155 impl Digester {
156 // v2/v3 digests are computed after prepending "header" byte and "size" info.
digest(&self, data: &[u8], header: &[u8], size: u32) -> Result<DigestBytes>157 fn digest(&self, data: &[u8], header: &[u8], size: u32) -> Result<DigestBytes> {
158 let mut hasher = Hasher::new(self.message_digest)?;
159 hasher.update(header)?;
160 hasher.update(&size.to_le_bytes())?;
161 hasher.update(data)?;
162 Ok(hasher.finish()?)
163 }
164 }
165
find_signing_block<T: Read + Seek>( reader: &mut T, central_directory_offset: u32, ) -> Result<(u32, u32)>166 fn find_signing_block<T: Read + Seek>(
167 reader: &mut T,
168 central_directory_offset: u32,
169 ) -> Result<(u32, u32)> {
170 // FORMAT:
171 // OFFSET DATA TYPE DESCRIPTION
172 // * @+0 bytes uint64: size in bytes (excluding this field)
173 // * @+8 bytes payload
174 // * @-24 bytes uint64: size in bytes (same as the one above)
175 // * @-16 bytes uint128: magic
176 ensure!(
177 central_directory_offset >= APK_SIG_BLOCK_MIN_SIZE,
178 "APK too small for APK Signing Block. ZIP Central Directory offset: {}",
179 central_directory_offset
180 );
181 reader.seek(SeekFrom::Start((central_directory_offset - 24) as u64))?;
182 let size_in_footer = reader.read_u64::<LittleEndian>()? as u32;
183 ensure!(
184 reader.read_u128::<LittleEndian>()? == APK_SIG_BLOCK_MAGIC,
185 "No APK Signing Block before ZIP Central Directory"
186 );
187 let total_size = size_in_footer + 8;
188 let signing_block_offset = central_directory_offset
189 .checked_sub(total_size)
190 .ok_or_else(|| anyhow!("APK Signing Block size out of range: {}", size_in_footer))?;
191 reader.seek(SeekFrom::Start(signing_block_offset as u64))?;
192 let size_in_header = reader.read_u64::<LittleEndian>()? as u32;
193 // This corresponds to APK Signature Scheme v3 verification step 1a.
194 ensure!(
195 size_in_header == size_in_footer,
196 "APK Signing Block sizes in header and footer do not match: {} vs {}",
197 size_in_header,
198 size_in_footer
199 );
200 Ok((signing_block_offset, total_size))
201 }
202
find_signature_scheme_block(buf: Bytes, block_id: u32) -> Result<Bytes>203 fn find_signature_scheme_block(buf: Bytes, block_id: u32) -> Result<Bytes> {
204 // FORMAT:
205 // OFFSET DATA TYPE DESCRIPTION
206 // * @+0 bytes uint64: size in bytes (excluding this field)
207 // * @+8 bytes pairs
208 // * @-24 bytes uint64: size in bytes (same as the one above)
209 // * @-16 bytes uint128: magic
210 let mut pairs = buf.slice(8..(buf.len() - 24));
211 let mut entry_count = 0;
212 while pairs.has_remaining() {
213 entry_count += 1;
214 ensure!(
215 pairs.remaining() >= 8,
216 "Insufficient data to read size of APK Signing Block entry #{}",
217 entry_count
218 );
219 let length = pairs.get_u64_le();
220 let mut pair = pairs.split_to(length as usize);
221 let id = pair.get_u32_le();
222 if id == block_id {
223 return Ok(pair);
224 }
225 }
226 let context =
227 format!("No APK Signature Scheme block in APK Signing Block with ID: {}", block_id);
228 Err(Error::new(io::Error::from(ErrorKind::NotFound)).context(context))
229 }
230
231 #[cfg(test)]
232 mod tests {
233 use super::*;
234 use byteorder::LittleEndian;
235 use std::fs::File;
236 use std::mem::size_of_val;
237
238 use crate::v3::APK_SIGNATURE_SCHEME_V3_BLOCK_ID;
239
240 const CENTRAL_DIRECTORY_HEADER_SIGNATURE: u32 = 0x02014b50;
241
242 #[test]
test_apk_sections()243 fn test_apk_sections() {
244 let apk_file = File::open("tests/data/v3-only-with-ecdsa-sha512-p521.apk").unwrap();
245 let apk_sections = ApkSections::new(apk_file).unwrap();
246 let mut reader = &apk_sections.inner;
247
248 // Checks APK Signing Block.
249 assert_eq!(
250 apk_sections.signing_block_offset + apk_sections.signing_block_size,
251 apk_sections.central_directory_offset
252 );
253 let apk_signature_offset = SeekFrom::Start(
254 apk_sections.central_directory_offset as u64 - size_of_val(&APK_SIG_BLOCK_MAGIC) as u64,
255 );
256 reader.seek(apk_signature_offset).unwrap();
257 assert_eq!(reader.read_u128::<LittleEndian>().unwrap(), APK_SIG_BLOCK_MAGIC);
258
259 // Checks Central directory.
260 assert_eq!(reader.read_u32::<LittleEndian>().unwrap(), CENTRAL_DIRECTORY_HEADER_SIGNATURE);
261 assert_eq!(
262 apk_sections.central_directory_offset + apk_sections.central_directory_size,
263 apk_sections.eocd_offset
264 );
265
266 // Checks EOCD.
267 assert_eq!(
268 reader.metadata().unwrap().len(),
269 (apk_sections.eocd_offset + apk_sections.eocd_size) as u64
270 );
271 }
272
273 #[test]
test_apk_digest()274 fn test_apk_digest() {
275 let apk_file = File::open("tests/data/v3-only-with-dsa-sha256-1024.apk").unwrap();
276 let mut apk_sections = ApkSections::new(apk_file).unwrap();
277 let digest = apk_sections.compute_digest(SignatureAlgorithmID::DsaWithSha256).unwrap();
278 assert_eq!(
279 "0df2426ea33aedaf495d88e5be0c6a1663ff0a81c5ed12d5b2929ae4b4300f2f",
280 hex::encode(&digest[..])
281 );
282 }
283
284 #[test]
test_apk_sections_cannot_find_signature()285 fn test_apk_sections_cannot_find_signature() {
286 let apk_file = File::open("tests/data/v2-only-two-signers.apk").unwrap();
287 let mut apk_sections = ApkSections::new(apk_file).unwrap();
288 let result = apk_sections.find_signature(APK_SIGNATURE_SCHEME_V3_BLOCK_ID);
289
290 assert!(result.is_err());
291 let error = result.unwrap_err();
292 assert_eq!(error.downcast_ref::<io::Error>().unwrap().kind(), ErrorKind::NotFound);
293 assert!(
294 error.to_string().contains(&APK_SIGNATURE_SCHEME_V3_BLOCK_ID.to_string()),
295 "Error should contain the block ID: {}",
296 error
297 );
298 }
299
300 #[test]
test_apk_sections_find_signature()301 fn test_apk_sections_find_signature() {
302 let apk_file = File::open("tests/data/v3-only-with-dsa-sha256-1024.apk").unwrap();
303 let mut apk_sections = ApkSections::new(apk_file).unwrap();
304 let signature = apk_sections.find_signature(APK_SIGNATURE_SCHEME_V3_BLOCK_ID).unwrap();
305
306 let expected_v3_signature_block_size = 1289; // Only for this specific APK
307 assert_eq!(signature.len(), expected_v3_signature_block_size);
308 }
309 }
310