1 //
2 // Copyright (C) 2019 The Android Open Source Project
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 // http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 //
16
17 #include "update_engine/payload_consumer/certificate_parser_android.h"
18
19 #include <memory>
20 #include <utility>
21
22 #include <base/logging.h>
23 #include <openssl/bio.h>
24 #include <openssl/pem.h>
25 #include <ziparchive/zip_archive.h>
26
27 #include "update_engine/payload_consumer/certificate_parser_interface.h"
28
29 namespace {
IterateZipEntriesAndSearchForKeys(const ZipArchiveHandle & handle,std::vector<std::vector<uint8_t>> * result)30 bool IterateZipEntriesAndSearchForKeys(
31 const ZipArchiveHandle& handle, std::vector<std::vector<uint8_t>>* result) {
32 void* cookie;
33 int32_t iter_status = StartIteration(handle, &cookie, "", "x509.pem");
34 if (iter_status != 0) {
35 LOG(ERROR) << "Failed to iterate over entries in the certificate zipfile: "
36 << ErrorCodeString(iter_status);
37 return false;
38 }
39 std::unique_ptr<void, decltype(&EndIteration)> guard(cookie, EndIteration);
40
41 std::vector<std::vector<uint8_t>> pem_keys;
42 std::string_view name;
43 ZipEntry entry;
44 while ((iter_status = Next(cookie, &entry, &name)) == 0) {
45 std::vector<uint8_t> pem_content(entry.uncompressed_length);
46 if (int32_t extract_status = ExtractToMemory(
47 handle, &entry, pem_content.data(), pem_content.size());
48 extract_status != 0) {
49 LOG(ERROR) << "Failed to extract " << name << ": "
50 << ErrorCodeString(extract_status);
51 return false;
52 }
53 pem_keys.push_back(pem_content);
54 }
55
56 if (iter_status != -1) {
57 LOG(ERROR) << "Error while iterating over zip entries: "
58 << ErrorCodeString(iter_status);
59 return false;
60 }
61
62 *result = std::move(pem_keys);
63 return true;
64 }
65
66 } // namespace
67
68 namespace chromeos_update_engine {
ReadPublicKeysFromCertificates(const std::string & path,std::vector<std::unique_ptr<EVP_PKEY,decltype (& EVP_PKEY_free)>> * out_public_keys)69 bool CertificateParserAndroid::ReadPublicKeysFromCertificates(
70 const std::string& path,
71 std::vector<std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>>*
72 out_public_keys) {
73 out_public_keys->clear();
74
75 ZipArchiveHandle handle;
76 if (int32_t open_status = OpenArchive(path.c_str(), &handle);
77 open_status != 0) {
78 LOG(ERROR) << "Failed to open " << path << ": "
79 << ErrorCodeString(open_status);
80 return false;
81 }
82
83 std::vector<std::vector<uint8_t>> pem_certs;
84 if (!IterateZipEntriesAndSearchForKeys(handle, &pem_certs)) {
85 CloseArchive(handle);
86 return false;
87 }
88 CloseArchive(handle);
89
90 // Convert the certificates into public keys. Stop and return false if we
91 // encounter an error.
92 std::vector<std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>> result;
93 for (const auto& cert : pem_certs) {
94 std::unique_ptr<BIO, decltype(&BIO_free)> input(
95 BIO_new_mem_buf(cert.data(), cert.size()), BIO_free);
96
97 std::unique_ptr<X509, decltype(&X509_free)> x509(
98 PEM_read_bio_X509(input.get(), nullptr, nullptr, nullptr), X509_free);
99 if (!x509) {
100 LOG(ERROR) << "Failed to read x509 certificate";
101 return false;
102 }
103
104 std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)> public_key(
105 X509_get_pubkey(x509.get()), EVP_PKEY_free);
106 if (!public_key) {
107 LOG(ERROR) << "Failed to extract the public key from x509 certificate";
108 return false;
109 }
110 result.push_back(std::move(public_key));
111 }
112
113 *out_public_keys = std::move(result);
114 return true;
115 }
116
CreateCertificateParser()117 std::unique_ptr<CertificateParserInterface> CreateCertificateParser() {
118 return std::make_unique<CertificateParserAndroid>();
119 }
120
121 } // namespace chromeos_update_engine
122