lib/codedirectory.cpp

   1 /*
   2  * Copyright (c) 2006-2010 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 //
  25 // codedirectory - format and operations for code signing "code directory" structures
  26 //
  27 #include "codedirectory.h"
  28 #include "csutilities.h"
  29 #include "CSCommonPriv.h"
  30
  31 using namespace UnixPlusPlus;
  32
  33
  34 namespace Security {
  35 namespace CodeSigning {
  36
  37
  38 //
  39 // Canonical filesystem names for select slot numbers.
  40 // These are variously used for filenames, extended attribute names, etc.
  41 // to get some consistency in naming. These are for storing signing-related
  42 // data; they have no bearing on the actual hash slots in the CodeDirectory.
  43 //
  44 const char *CodeDirectory::canonicalSlotName(SpecialSlot slot)
  45 {
  46         switch (slot) {
  47         case cdRequirementsSlot:
  48                 return kSecCS_REQUIREMENTSFILE;
  49         case cdResourceDirSlot:
  50                 return kSecCS_RESOURCEDIRFILE;
  51         case cdCodeDirectorySlot:
  52                 return kSecCS_CODEDIRECTORYFILE;
  53         case cdSignatureSlot:
  54                 return kSecCS_SIGNATUREFILE;
  55         case cdApplicationSlot:
  56                 return kSecCS_APPLICATIONFILE;
  57         case cdEntitlementSlot:
  58                 return kSecCS_ENTITLEMENTFILE;
  59         default:
  60                 return NULL;
  61         }
  62 }
  63
  64
  65 //
  66 // Canonical attributes of SpecialSlots.
  67 //
  68 unsigned CodeDirectory::slotAttributes(SpecialSlot slot)
  69 {
  70         switch (slot) {
  71         case cdRequirementsSlot:
  72                 return cdComponentIsBlob; // global
  73         case cdCodeDirectorySlot:
  74                 return cdComponentPerArchitecture | cdComponentIsBlob;
  75         case cdSignatureSlot:
  76                 return cdComponentPerArchitecture; // raw
  77         case cdEntitlementSlot:
  78                 return cdComponentIsBlob; // global
  79         case cdIdentificationSlot:
  80                 return cdComponentPerArchitecture; // raw
  81         default:
  82                 return 0; // global, raw
  83         }
  84 }
  85
  86
  87 //
  88 // Symbolic names for code directory special slots.
  89 // These are only used for debug output. They are not API-official.
  90 // Needs to be coordinated with the cd*Slot enumeration in codedirectory.h.
  91 //
  92 #if !defined(NDEBUG)
  93 const char * const CodeDirectory::debugSlotName[] = {
  94         "codedirectory",
  95         "info",
  96         "requirements",
  97         "resources",
  98         "application",
  99         "entitlement"
 100 };
 101 #endif //NDEBUG
 102
 103
 104 //
 105 // Check a CodeDirectory for basic integrity. This should ensure that the
 106 // version is understood by our code, and that the internal structure
 107 // (offsets etc.) is intact. In particular, it must make sure that no offsets
 108 // point outside the CodeDirectory.
 109 // Throws if the directory is corrupted or out of versioning bounds.
 110 // Returns if the version is usable (perhaps with degraded features due to
 111 // compatibility hacks).
 112 //
 113 // Note: There are some things we don't bother checking because they won't
 114 // cause crashes, and will just be flagged as nonsense later. For example,
 115 // a Bad Guy could overlap the identifier and hash fields, which is nonsense
 116 // but not dangerous.
 117 //
 118 void CodeDirectory::checkIntegrity() const
 119 {
 120         // check version for support
 121         if (!this->validateBlob())
 122                 MacOSError::throwMe(errSecCSSignatureInvalid);  // busted
 123         if (version > compatibilityLimit)
 124                 MacOSError::throwMe(errSecCSSignatureUnsupported);      // too new - no clue
 125         if (version < earliestVersion)
 126                 MacOSError::throwMe(errSecCSSignatureUnsupported);      // too old - can't support
 127         if (version > currentVersion)
 128                 secdebug("codedir", "%p version 0x%x newer than current 0x%x",
 129                         this, uint32_t(version), currentVersion);
 130
 131         // now check interior offsets for validity
 132         if (!stringAt(identOffset))
 133                 MacOSError::throwMe(errSecCSSignatureFailed); // identifier out of blob range
 134         if (!contains(hashOffset - hashSize * nSpecialSlots, hashSize * (nSpecialSlots + nCodeSlots)))
 135                 MacOSError::throwMe(errSecCSSignatureFailed); // hash array out of blob range
 136         if (const Scatter *scatter = this->scatterVector()) {
 137                 // the optional scatter vector is terminated with an element having (count == 0)
 138                 unsigned int pagesConsumed = 0;
 139                 while (scatter->count) {
 140                         if (!contains(scatter, sizeof(Scatter)))
 141                                 MacOSError::throwMe(errSecCSSignatureFailed);
 142                         pagesConsumed += scatter->count;
 143                         scatter++;
 144                 }
 145                 if (!contains(scatter, sizeof(Scatter)))                        // (even sentinel must be in range)
 146                         MacOSError::throwMe(errSecCSSignatureFailed);
 147                 if (!contains((*this)[pagesConsumed-1], hashSize))      // referenced too many main hash slots
 148                         MacOSError::throwMe(errSecCSSignatureFailed);
 149         }
 150 }
 151
 152
 153 //
 154 // Validate a slot against data in memory.
 155 //
 156 bool CodeDirectory::validateSlot(const void *data, size_t length, Slot slot) const
 157 {
 158         secdebug("codedir", "%p validating slot %d", this, int(slot));
 159         MakeHash<CodeDirectory> hasher(this);
 160         Hashing::Byte digest[hasher->digestLength()];
 161         generateHash(hasher, data, length, digest);
 162         return memcmp(digest, (*this)[slot], hasher->digestLength()) == 0;
 163 }
 164
 165
 166 //
 167 // Validate a slot against the contents of an open file. At most 'length' bytes
 168 // will be read from the file.
 169 //
 170 bool CodeDirectory::validateSlot(FileDesc fd, size_t length, Slot slot) const
 171 {
 172         MakeHash<CodeDirectory> hasher(this);
 173         Hashing::Byte digest[hasher->digestLength()];
 174         generateHash(hasher, fd, digest, length);
 175         return memcmp(digest, (*this)[slot], hasher->digestLength()) == 0;
 176 }
 177
 178
 179 //
 180 // Check whether a particular slot is present.
 181 // Absense is indicated by either a zero hash, or by lying outside
 182 // the slot range.
 183 //
 184 bool CodeDirectory::slotIsPresent(Slot slot) const
 185 {
 186         if (slot >= -Slot(nSpecialSlots) && slot < Slot(nCodeSlots)) {
 187                 const Hashing::Byte *digest = (*this)[slot];
 188                 for (unsigned n = 0; n < hashSize; n++)
 189                         if (digest[n])
 190                                 return true;    // non-zero digest => present
 191         }
 192         return false;   // absent
 193 }
 194
 195
 196 //
 197 // Given a hash type code, create an appropriate subclass of DynamicHash
 198 // and return it. The caller owns the object and  must delete it when done.
 199 // This function never returns NULL. It throws if the hashType is unsuupported,
 200 // or if there's an error creating the hasher.
 201 //
 202 DynamicHash *CodeDirectory::hashFor(HashAlgorithm hashType)
 203 {
 204         CCDigestAlg alg;
 205         switch (hashType) {
 206         case kSecCodeSignatureHashSHA1:                                         alg = kCCDigestSHA1; break;
 207         case kSecCodeSignatureHashSHA256:                                       alg = kCCDigestSHA256; break;
 208         case kSecCodeSignatureHashPrestandardSkein160x256:      alg = kCCDigestSkein160; break;
 209         case kSecCodeSignatureHashPrestandardSkein256x512:      alg = kCCDigestSkein256; break;
 210         default:
 211                 MacOSError::throwMe(errSecCSSignatureUnsupported);
 212         }
 213         return new CCHashInstance(alg);
 214 }
 215
 216
 217 //
 218 // Hash the next limit bytes of a file and return the digest.
 219 // If the file is shorter, hash as much as you can.
 220 // Limit==0 means unlimited (to end of file).
 221 // Return how many bytes were actually hashed.
 222 // Throw on any errors.
 223 //
 224 size_t CodeDirectory::generateHash(DynamicHash *hasher, FileDesc fd, Hashing::Byte *digest, size_t limit)
 225 {
 226         size_t size = hashFileData(fd, hasher, limit);
 227         hasher->finish(digest);
 228         return size;
 229 }
 230
 231
 232 //
 233 // Ditto, but hash a memory buffer instead.
 234 //
 235 size_t CodeDirectory::generateHash(DynamicHash *hasher, const void *data, size_t length, Hashing::Byte *digest)
 236 {
 237         hasher->update(data, length);
 238         hasher->finish(digest);
 239         return length;
 240 }
 241
 242
 243 }       // CodeSigning
 244 }       // Security
 245
 246
 247 //
 248 // Canonical text form for user-settable code directory flags.
 249 // Note: This table is actually exported from Security.framework.
 250 //
 251 const SecCodeDirectoryFlagTable kSecCodeDirectoryFlagTable[] = {
 252         { "host",               kSecCodeSignatureHost,                  true },
 253         { "adhoc",              kSecCodeSignatureAdhoc,                 false },
 254         { "hard",               kSecCodeSignatureForceHard,             true },
 255         { "kill",               kSecCodeSignatureForceKill,             true },
 256         { "expires",    kSecCodeSignatureForceExpiration, true },
 257         { NULL }
 258 };