Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d7236da1 authored by Alex Klyubin's avatar Alex Klyubin
Browse files

Reject PKCS#7 SignerInfo with unsupported parameters. 

This addresses the TODO to mimic the behavior of Android when
verifying APK JAR signatures. Unfortunately, the behavior of Android
kept changing in interesting ways between different platform versions.
This is hard-coded as a big lookup.

Bug: 27461702
Change-Id: I49bc181ee05f774ef8ee041af870385b35212c23
parent 1fb96c3f

tools/apksigner/core/src/com/android/apksigner/core/ApkVerifier.java

+15 −0
Original line number Diff line number Diff line
@@ -662,6 +662,21 @@ public class ApkVerifier { 
         */

        JAR_SIG_VERIFY_EXCEPTION("Failed to verify JAR signature %1$s against %2$s: %3$s"),



        /**

         * JAR signature contains unsupported digest algorithm.

         *

         * <ul>

         * <li>Parameter 1: name of the signature block file ({@code String})</li>

         * <li>Parameter 2: digest algorithm OID ({@code String})</li>

         * <li>Parameter 2: signature algorithm OID ({@code String})</li>

         * <li>Parameter 3: API Levels on which this combination of algorithms is not supported

         *     ({@code String})</li>

         * </ul>

         */

        JAR_SIG_UNSUPPORTED_SIG_ALG(

                "JAR signature %1$s uses digest algorithm %2$s and signature algorithm %3$s which"

                        + " is not supported on API Levels %4$s"),



        /**

         * An exception was encountered while parsing JAR signature contained in a signature block.

         *

tools/apksigner/core/src/com/android/apksigner/core/internal/apk/v1/V1SchemeSigner.java

+2 −1
Original line number Diff line number Diff line
@@ -562,7 +562,8 @@ public abstract class V1SchemeSigner { 
                    // SignatureAlgorithm: dsaWithSha256 (2.16.840.1.101.3.4.3.2) and

                    // dsa (1.2.840.10040.4.1). The latter works only on API Level 22+. Thus, we use

                    // the former.

                    sigAlgId = getSupportedAlgorithmId("2.16.840.1.101.3.4.3.2"); // DSA with SHA-256

                    sigAlgId =

                            getSupportedAlgorithmId("2.16.840.1.101.3.4.3.2"); // DSA with SHA-256

                    break;

                default:

                    throw new IllegalArgumentException(

tools/apksigner/core/src/com/android/apksigner/core/internal/apk/v1/V1SchemeVerifier.java

+371 −4

File changed.

Preview size limit exceeded, changes collapsed.

tools/apksigner/core/src/com/android/apksigner/core/internal/util/AndroidSdkVersion.java

+3 −0
Original line number Diff line number Diff line
@@ -24,6 +24,9 @@ public abstract class AndroidSdkVersion { 
    /** Hidden constructor to prevent instantiation. */

    private AndroidSdkVersion() {}



    /** Android 2.3. */

    public static final int GINGERBREAD = 9;



    /** Android 4.3. The revenge of the beans. */

    public static final int JELLY_BEAN_MR2 = 18;

tools/apksigner/core/src/com/android/apksigner/core/internal/util/InclusiveIntRange.java

0 → 100644
+89 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2016 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



package com.android.apksigner.core.internal.util;



import java.util.ArrayList;

import java.util.Collections;

import java.util.List;



/**

 * Inclusive interval of integers.

 */

public class InclusiveIntRange {

    private final int min;

    private final int max;



    private InclusiveIntRange(int min, int max) {

        this.min = min;

        this.max = max;

    }



    public int getMin() {

        return min;

    }



    public int getMax() {

        return max;

    }



    public static InclusiveIntRange fromTo(int min, int max) {

        return new InclusiveIntRange(min, max);

    }



    public static InclusiveIntRange from(int min) {

        return new InclusiveIntRange(min, Integer.MAX_VALUE);

    }



    public List<InclusiveIntRange> getValuesNotIn(

            List<InclusiveIntRange> sortedNonOverlappingRanges) {

        if (sortedNonOverlappingRanges.isEmpty()) {

            return Collections.singletonList(this);

        }



        int testValue = min;

        List<InclusiveIntRange> result = null;

        for (InclusiveIntRange range : sortedNonOverlappingRanges) {

            int rangeMax = range.max;

            if (testValue > rangeMax) {

                continue;

            }

            int rangeMin = range.min;

            if (testValue < range.min) {

                if (result == null) {

                    result = new ArrayList<>();

                }

                result.add(fromTo(testValue, rangeMin - 1));

            }

            if (rangeMax >= max) {

                return (result != null) ? result : Collections.emptyList();

            }

            testValue = rangeMax + 1;

        }

        if (testValue <= max) {

            if (result == null) {

                result = new ArrayList<>(1);

            }

            result.add(fromTo(testValue, max));

        }

        return (result != null) ? result : Collections.emptyList();

    }



    @Override

    public String toString() {

        return "[" + min + ", " + ((max < Integer.MAX_VALUE) ? (max + "]") : "\u221e)");

    }

}