adb_auth_client.c 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382
  1. /*
  2. * Copyright (C) 2012 The Android Open Source Project
  3. *
  4. * Licensed under the Apache License, Version 2.0 (the "License");
  5. * you may not use this file except in compliance with the License.
  6. * You may obtain a copy of the License at
  7. *
  8. * http://www.apache.org/licenses/LICENSE-2.0
  9. *
  10. * Unless required by applicable law or agreed to in writing, software
  11. * distributed under the License is distributed on an "AS IS" BASIS,
  12. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. * See the License for the specific language governing permissions and
  14. * limitations under the License.
  15. */
  16. #include <stdio.h>
  17. #include <string.h>
  18. #include <resolv.h>
  19. #include <cutils/list.h>
  20. #include <cutils/sockets.h>
  21. #include "sysdeps.h"
  22. #include "adb.h"
  23. #include "adb_auth.h"
  24. #include "fdevent.h"
  25. #include "mincrypt/rsa.h"
  26. #include <assert.h>
  27. #define TRACE_TAG TRACE_AUTH
  28. struct adb_public_key {
  29. struct listnode node;
  30. RSAPublicKey key;
  31. };
  32. static struct listnode key_list;
  33. char *external_key_path = NULL;
  34. static char *key_paths[] = {
  35. "/mnt/UDISK/adb_keys",
  36. NULL
  37. };
  38. static fdevent listener_fde;
  39. static int framework_fd = -1;
  40. static const char Base64[] =
  41. "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
  42. static const char Pad64 = '=';
  43. int
  44. b64_pton(src, target, targsize)
  45. char const *src;
  46. u_char *target;
  47. size_t targsize;
  48. {
  49. size_t tarindex;
  50. int state, ch;
  51. char *pos;
  52. assert(src != NULL);
  53. assert(target != NULL);
  54. state = 0;
  55. tarindex = 0;
  56. while ((ch = (u_char) *src++) != '\0') {
  57. if (isspace(ch)) /* Skip whitespace anywhere. */
  58. continue;
  59. if (ch == Pad64)
  60. break;
  61. pos = strchr(Base64, ch);
  62. if (pos == 0) /* A non-base64 character. */
  63. return (-1);
  64. switch (state) {
  65. case 0:
  66. if (target) {
  67. if (tarindex >= targsize)
  68. return (-1);
  69. target[tarindex] = (pos - Base64) << 2;
  70. }
  71. state = 1;
  72. break;
  73. case 1:
  74. if (target) {
  75. if (tarindex + 1 >= targsize)
  76. return (-1);
  77. target[tarindex] |=
  78. (u_int32_t)(pos - Base64) >> 4;
  79. target[tarindex+1] = ((pos - Base64) & 0x0f)
  80. << 4 ;
  81. }
  82. tarindex++;
  83. state = 2;
  84. break;
  85. case 2:
  86. if (target) {
  87. if (tarindex + 1 >= targsize)
  88. return (-1);
  89. target[tarindex] |=
  90. (u_int32_t)(pos - Base64) >> 2;
  91. target[tarindex+1] = ((pos - Base64) & 0x03)
  92. << 6;
  93. }
  94. tarindex++;
  95. state = 3;
  96. break;
  97. case 3:
  98. if (target) {
  99. if (tarindex >= targsize)
  100. return (-1);
  101. target[tarindex] |= (pos - Base64);
  102. }
  103. tarindex++;
  104. state = 0;
  105. break;
  106. default:
  107. abort();
  108. }
  109. }
  110. /*
  111. * We are done decoding Base-64 chars. Let's see if we ended
  112. * on a byte boundary, and/or with erroneous trailing characters.
  113. */
  114. if (ch == Pad64) { /* We got a pad char. */
  115. ch = *src++; /* Skip it, get next. */
  116. switch (state) {
  117. case 0: /* Invalid = in first position */
  118. case 1: /* Invalid = in second position */
  119. return (-1);
  120. case 2: /* Valid, means one byte of info */
  121. /* Skip any number of spaces. */
  122. for (; ch != '\0'; ch = (u_char) *src++)
  123. if (!isspace(ch))
  124. break;
  125. /* Make sure there is another trailing = sign. */
  126. if (ch != Pad64)
  127. return (-1);
  128. ch = *src++; /* Skip the = */
  129. /* Fall through to "single trailing =" case. */
  130. /* FALLTHROUGH */
  131. case 3: /* Valid, means two bytes of info */
  132. /*
  133. * We know this char is an =. Is there anything but
  134. * whitespace after it?
  135. */
  136. for (; ch != '\0'; ch = (u_char) *src++)
  137. if (!isspace(ch))
  138. return (-1);
  139. /*
  140. * Now make sure for cases 2 and 3 that the "extra"
  141. * bits that slopped past the last full byte were
  142. * zeros. If we don't check them, they become a
  143. * subliminal channel.
  144. */
  145. if (target && target[tarindex] != 0)
  146. return (-1);
  147. }
  148. } else {
  149. /*
  150. * We ended by seeing the end of the string. Make sure we
  151. * have no partial bytes lying around.
  152. */
  153. if (state != 0)
  154. return (-1);
  155. }
  156. return (tarindex);
  157. }
  158. static void read_keys(const char *file, struct listnode *list)
  159. {
  160. struct adb_public_key *key;
  161. FILE *f;
  162. char buf[MAX_PAYLOAD];
  163. char *sep;
  164. int ret;
  165. f = fopen(file, "r");
  166. if (!f) {
  167. D("Can't open '%s'\n", file);
  168. return;
  169. }
  170. while (fgets(buf, sizeof(buf), f)) {
  171. /* Allocate 4 extra bytes to decode the base64 data in-place */
  172. key = calloc(1, sizeof(*key) + 4);
  173. if (!key) {
  174. D("Can't malloc key\n");
  175. break;
  176. }
  177. sep = strpbrk(buf, " \t");
  178. if (sep)
  179. *sep = '\0';
  180. ret = b64_pton(buf, (u_char *)&key->key, sizeof(key->key) + 4);
  181. if (ret != sizeof(key->key)) {
  182. D("%s: Invalid base64 data ret=%d\n", file, ret);
  183. free(key);
  184. continue;
  185. }
  186. if (key->key.len != RSANUMWORDS) {
  187. D("%s: Invalid key len %d\n", file, key->key.len);
  188. free(key);
  189. continue;
  190. }
  191. list_add_tail(list, &key->node);
  192. }
  193. fclose(f);
  194. }
  195. static void free_keys(struct listnode *list)
  196. {
  197. struct listnode *item;
  198. while (!list_empty(list)) {
  199. item = list_head(list);
  200. list_remove(item);
  201. free(node_to_item(item, struct adb_public_key, node));
  202. }
  203. }
  204. void adb_auth_reload_keys(void)
  205. {
  206. char *path;
  207. char **paths = key_paths;
  208. struct stat buf;
  209. free_keys(&key_list);
  210. if (external_key_path != NULL
  211. && !stat(external_key_path, &buf))
  212. read_keys(external_key_path, &key_list);
  213. while ((path = *paths++)) {
  214. if (!stat(path, &buf)) {
  215. D("Loading keys from '%s'\n", path);
  216. read_keys(path, &key_list);
  217. }
  218. }
  219. }
  220. int adb_auth_generate_token(void *token, size_t token_size)
  221. {
  222. FILE *f;
  223. int ret;
  224. f = fopen("/dev/urandom", "r");
  225. if (!f)
  226. return 0;
  227. ret = fread(token, token_size, 1, f);
  228. fclose(f);
  229. return ret * token_size;
  230. }
  231. int adb_auth_verify(void *token, void *sig, int siglen)
  232. {
  233. struct listnode *item;
  234. struct adb_public_key *key;
  235. int ret;
  236. if (siglen != RSANUMBYTES)
  237. return 0;
  238. list_for_each(item, &key_list) {
  239. key = node_to_item(item, struct adb_public_key, node);
  240. ret = RSA_verify(&key->key, sig, siglen, token);
  241. if (ret)
  242. return 1;
  243. }
  244. return 0;
  245. }
  246. static void adb_auth_event(int fd, unsigned events, void *data)
  247. {
  248. atransport *t = data;
  249. char response[2];
  250. int ret;
  251. if (events & FDE_READ) {
  252. ret = unix_read(fd, response, sizeof(response));
  253. if (ret < 0) {
  254. D("Disconnect");
  255. fdevent_remove(&t->auth_fde);
  256. framework_fd = -1;
  257. }
  258. else if (ret == 2 && response[0] == 'O' && response[1] == 'K') {
  259. adb_auth_reload_keys();
  260. adb_auth_verified(t);
  261. }
  262. }
  263. }
  264. void adb_auth_confirm_key(unsigned char *key, size_t len, atransport *t)
  265. {
  266. char msg[MAX_PAYLOAD];
  267. int ret;
  268. if (framework_fd < 0) {
  269. D("Client not connected\n");
  270. return;
  271. }
  272. if (key[len - 1] != '\0') {
  273. D("Key must be a null-terminated string\n");
  274. return;
  275. }
  276. ret = snprintf(msg, sizeof(msg), "PK%s", key);
  277. if (ret >= (signed)sizeof(msg)) {
  278. D("Key too long. ret=%d", ret);
  279. return;
  280. }
  281. D("Sending '%s'\n", msg);
  282. ret = unix_write(framework_fd, msg, ret);
  283. if (ret < 0) {
  284. D("Failed to write PK, errno=%d\n", errno);
  285. return;
  286. }
  287. fdevent_install(&t->auth_fde, framework_fd, adb_auth_event, t);
  288. fdevent_add(&t->auth_fde, FDE_READ);
  289. }
  290. static void adb_auth_listener(int fd, unsigned events, void *data)
  291. {
  292. struct sockaddr addr;
  293. socklen_t alen;
  294. int s;
  295. alen = sizeof(addr);
  296. s = adb_socket_accept(fd, &addr, &alen);
  297. if (s < 0) {
  298. D("Failed to accept: errno=%d\n", errno);
  299. return;
  300. }
  301. framework_fd = s;
  302. }
  303. void adb_auth_init(void)
  304. {
  305. int fd, ret;
  306. D("adb_auth_init\n");
  307. list_init(&key_list);
  308. adb_auth_reload_keys();
  309. fd = android_get_control_socket("adbd");
  310. if (fd < 0) {
  311. D("Failed to get adbd socket\n");
  312. return;
  313. }
  314. ret = listen(fd, 4);
  315. if (ret < 0) {
  316. D("Failed to listen on '%d'\n", fd);
  317. return;
  318. }
  319. fdevent_install(&listener_fde, fd, adb_auth_listener, NULL);
  320. fdevent_add(&listener_fde, FDE_READ);
  321. }