1  /*
  2   * Copyright (c) 2015 Apple Inc. All Rights Reserved.
  3   * 
  4   * @APPLE_LICENSE_HEADER_START@
  5   * 
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   * 
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   * 
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  //
 25  // diskimagerep - DiskRep representing a single read-only compressed disk image file
 26  //
 27  #include "diskimagerep.h"
 28  #include "notarization.h"
 29  #include "sigblob.h"
 30  #include "CodeSigner.h"
 31  #include <security_utilities/endian.h>
 32  #include <algorithm>
 33  
 34  
 35  namespace Security {
 36  namespace CodeSigning {
 37  
 38  using Security::n2h;
 39  using Security::h2n;
 40  using namespace UnixPlusPlus;
 41  
 42  
 43  static const int32_t udifVersion = 4;		// supported image file version
 44  	
 45  
 46  //
 47  // Temporary hack to imply a fUDIFCryptosigFieldsset at the start of the "reserved" area of an UDIF header
 48  //
 49  bool DiskImageRep::readHeader(FileDesc& fd, UDIFFileHeader& header)
 50  {
 51  	// the UDIF "header" is in fact the last 512 bytes of the file, with no particular alignment
 52  	static const size_t headerLength = sizeof(header);
 53  	size_t length = fd.fileSize();
 54  	if (length < sizeof(UDIFFileHeader) + sizeof(BlobCore))
 55  		return false;
 56  	size_t headerOffset = length - sizeof(UDIFFileHeader);
 57  	if (fd.read(&header, headerLength, headerOffset) != headerLength)
 58  		return false;
 59  	if (n2h(header.fUDIFSignature) != kUDIFSignature)
 60  		return false;
 61  	if (n2h(header.fUDIFVersion) != udifVersion)	// current as of this writing
 62  		return false;
 63  	
 64  	return true;
 65  }
 66  
 67  
 68  //
 69  // Object management.
 70  //
 71  DiskImageRep::DiskImageRep(const char *path)
 72  	: SingleDiskRep(path), mSigningData(NULL)
 73  {
 74  	this->setup();
 75  }
 76  
 77  DiskImageRep::~DiskImageRep()
 78  {
 79  	free((void*)mSigningData);
 80  }
 81  
 82  void DiskImageRep::setup()
 83  {
 84  	free((void*)mSigningData);
 85  	mSigningData = NULL;
 86  	
 87  	// the UDIF "header" is in fact the last 512 bytes of the file, with no particular alignment
 88  	if (!readHeader(fd(), this->mHeader))
 89  		UnixError::throwMe(errSecCSBadDiskImageFormat);
 90  
 91  	mHeaderOffset = fd().fileSize() - sizeof(UDIFFileHeader);
 92  	size_t signatureOffset = size_t(n2h(this->mHeader.fUDIFCodeSignOffset));
 93  	size_t signatureLength = size_t(n2h(this->mHeader.fUDIFCodeSignLength));
 94  	this->mHeader.fUDIFCodeSignLength = 0;		// blind length (signature covers header)
 95  	if (signatureOffset == 0) {
 96  		mEndOfDataOffset = mHeaderOffset;
 97  		mHeader.fUDIFCodeSignOffset = h2n(mHeaderOffset);
 98  		return;		// unsigned, header prepared for possible signing
 99  	} else {
100  		mEndOfDataOffset = signatureOffset;
101  	}
102  	
103  	// read the signature superblob
104  	const size_t frameLength = mHeaderOffset - signatureOffset;		// room to following header
105  	if (EmbeddedSignatureBlob* blob = EmbeddedSignatureBlob::readBlob(fd(), signatureOffset, frameLength)) {
106  		if (blob->length() != frameLength
107  				|| frameLength != signatureLength
108  				|| !blob->strictValidateBlob(frameLength)) {
109  			free(blob);
110  			MacOSError::throwMe(errSecCSBadDiskImageFormat);
111  		}
112  		mSigningData = blob;
113  	}
114  }
115  	
116  	
117  //
118  // The default binary identification of a SingleDiskRep is the (SHA-1) hash
119  // of the entire file itself.
120  //
121  CFDataRef DiskImageRep::identification()
122  {
123  	SHA1 hash;		// not security sensitive
124  	hash(&mHeader, sizeof(mHeader));
125  	SHA1::Digest digest;
126  	hash.finish(digest);
127  	return makeCFData(digest, sizeof(digest));
128  }
129  
130  
131  //
132  // Sniffer function for UDIF disk image files.
133  // This just looks for the trailing "header" and its magic number.
134  //
135  bool DiskImageRep::candidate(FileDesc &fd)
136  {
137  	UDIFFileHeader header;
138  	return readHeader(fd, header) == true;
139  }
140  
141  
142  //
143  // Signing limit is the start of the (trailing) signature
144  //
145  size_t DiskImageRep::signingLimit()
146  {
147  	return mEndOfDataOffset;
148  }
149  
150  void DiskImageRep::strictValidate(const CodeDirectory* cd, const ToleratedErrors& tolerated, SecCSFlags flags)
151  {
152      DiskRep::strictValidate(cd, tolerated, flags);
153  
154      if (cd) {
155          size_t cd_limit = cd->signingLimit();
156          size_t dr_limit = signingLimit();
157          if (cd_limit != dr_limit &&         // must cover exactly the entire data
158              cd_limit != fd().fileSize())    // or, for legacy detached sigs, the entire file
159              MacOSError::throwMe(errSecCSSignatureInvalid);
160      }
161  }
162  
163  
164  //
165  // Retrieve a component from the executable.
166  // Our mCache has mapped the entire file, so we just fish the contents out of
167  // the mapped area as needed.
168  //
169  CFDataRef DiskImageRep::component(CodeDirectory::SpecialSlot slot)
170  {
171  	switch (slot) {
172  	case cdRepSpecificSlot:
173  		return makeCFData(&mHeader, sizeof(mHeader));
174  	default:
175  		return mSigningData ? mSigningData->component(slot) : NULL;
176  	}
177  }
178  
179  
180  //
181  // Provide a (vaguely) human readable characterization of this code
182  //
183  string DiskImageRep::format()
184  {
185  	return "disk image";
186  }
187  	
188  void DiskImageRep::prepareForSigning(SigningContext& context)
189  {
190  	// default to SHA256 unconditionally - we have no legacy issues to worry about
191  	if (context.digestAlgorithms().empty())
192  		context.setDigestAlgorithm(kSecCodeSignatureHashSHA256);
193  }
194  
195  
196  //
197  // DiskImageRep::Writers
198  //
199  DiskRep::Writer *DiskImageRep::writer()
200  {
201  	return new Writer(this);
202  }
203  
204  
205  //
206  // Write a component.
207  //
208  void DiskImageRep::Writer::component(CodeDirectory::SpecialSlot slot, CFDataRef data)
209  {
210  	assert(slot != cdRepSpecificSlot);
211  	EmbeddedSignatureBlob::Maker::component(slot, data);
212  }
213  
214  
215  //
216  // Append the superblob we built to the cache file.
217  //
218  void DiskImageRep::Writer::flush()
219  {
220  	free((void*)mSigningData);		// ditch previous blob just in case
221  	mSigningData = Maker::make();	// assemble new signature SuperBlob
222  	
223  	// write signature superblob
224  	size_t location = rep->mEndOfDataOffset;
225  	assert(location);
226  	fd().seek(location);
227  	fd().writeAll(*mSigningData);	// write signature
228  	
229  	// now (re)write disk image header after it
230  	UDIFFileHeader fullHeader = rep->mHeader;
231  	fullHeader.fUDIFCodeSignOffset = h2n(location);
232  	fullHeader.fUDIFCodeSignLength = h2n(mSigningData->length());
233  	fd().writeAll(&fullHeader, sizeof(rep->mHeader));
234      fd().truncate(fd().position());
235  }
236  
237  
238  //
239  // Discretionary manipulations
240  //
241  void DiskImageRep::Writer::addDiscretionary(CodeDirectory::Builder &builder)
242  {
243  }
244  
245  void DiskImageRep::registerStapledTicket()
246  {
247  	CFRef<CFDataRef> data = NULL;
248  	if (mSigningData) {
249  		data.take(mSigningData->component(cdTicketSlot));
250  		registerStapledTicketInDMG(data);
251  	}
252  }
253  
254  
255  } // end namespace CodeSigning
256  } // end namespace Security