blob: 381825988b67d71a867310eed42164588b6c504f [file] [log] [blame]
Jooyung Han12a0b702021-08-05 23:20:31 +09001/*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Andrew Walbran117cd5e2021-08-13 11:42:13 +000017use apkverify::{testing::assert_contains, verify};
Jooyung Hancee6de62021-08-11 15:52:07 +090018use std::matches;
Jooyung Hand8397852021-08-10 16:29:36 +090019
Seungjae Yoo91e250a2022-06-07 02:21:56 +000020const KEY_NAMES_DSA: &[&str] = &["1024", "2048", "3072"];
21const KEY_NAMES_ECDSA: &[&str] = &["p256", "p384", "p521"];
22const KEY_NAMES_RSA: &[&str] = &["1024", "2048", "3072", "4096", "8192", "16384"];
Jooyung Hancee6de62021-08-11 15:52:07 +090023
24#[test]
25fn test_verify_truncated_cd() {
26 use zip::result::ZipError;
27 let res = verify("tests/data/v2-only-truncated-cd.apk");
Alice Wang92889352022-09-16 10:42:52 +000028 // TODO(b/190343842): consider making a helper for err assertion
Jooyung Hancee6de62021-08-11 15:52:07 +090029 assert!(matches!(
Andrew Walbran117cd5e2021-08-13 11:42:13 +000030 res.unwrap_err().root_cause().downcast_ref::<ZipError>().unwrap(),
Jooyung Hancee6de62021-08-11 15:52:07 +090031 ZipError::InvalidArchive(_),
32 ));
33}
Seungjae Yoo91e250a2022-06-07 02:21:56 +000034
35#[test]
36fn test_verify_v3() {
37 assert!(verify("tests/data/test.apex").is_ok());
38}
39
Seungjae Yoo91e250a2022-06-07 02:21:56 +000040#[test]
41fn test_verify_v3_dsa_sha256() {
42 for key_name in KEY_NAMES_DSA.iter() {
43 let res = verify(format!("tests/data/v3-only-with-dsa-sha256-{}.apk", key_name));
44 assert!(res.is_err());
Alice Wanga66b5c02022-09-16 07:25:17 +000045 assert_contains(&res.unwrap_err().to_string(), "not implemented");
Seungjae Yoo91e250a2022-06-07 02:21:56 +000046 }
47}
48
49#[test]
50fn test_verify_v3_ecdsa_sha256() {
51 for key_name in KEY_NAMES_ECDSA.iter() {
52 assert!(verify(format!("tests/data/v3-only-with-ecdsa-sha256-{}.apk", key_name)).is_ok());
53 }
54}
55
Seungjae Yoo91e250a2022-06-07 02:21:56 +000056#[test]
57fn test_verify_v3_ecdsa_sha512() {
58 for key_name in KEY_NAMES_ECDSA.iter() {
Alice Wang455b02b2022-09-16 13:32:13 +000059 assert!(verify(format!("tests/data/v3-only-with-ecdsa-sha512-{}.apk", key_name)).is_ok());
Seungjae Yoo91e250a2022-06-07 02:21:56 +000060 }
61}
62
63#[test]
64fn test_verify_v3_rsa_sha256() {
65 for key_name in KEY_NAMES_RSA.iter() {
66 assert!(
67 verify(format!("tests/data/v3-only-with-rsa-pkcs1-sha256-{}.apk", key_name)).is_ok()
68 );
69 }
70}
71
72#[test]
73fn test_verify_v3_rsa_sha512() {
74 for key_name in KEY_NAMES_RSA.iter() {
75 assert!(
76 verify(format!("tests/data/v3-only-with-rsa-pkcs1-sha512-{}.apk", key_name)).is_ok()
77 );
78 }
79}
80
Seungjae Yoo91e250a2022-06-07 02:21:56 +000081#[test]
82fn test_verify_v3_sig_does_not_verify() {
83 let path_list = [
84 "tests/data/v3-only-with-dsa-sha256-2048-sig-does-not-verify.apk",
85 "tests/data/v3-only-with-ecdsa-sha512-p521-sig-does-not-verify.apk",
86 "tests/data/v3-only-with-rsa-pkcs1-sha256-3072-sig-does-not-verify.apk",
87 ];
88 for path in path_list.iter() {
89 let res = verify(path);
90 assert!(res.is_err());
91 let error_msg = &res.unwrap_err().to_string();
92 assert!(
Alice Wanga66b5c02022-09-16 07:25:17 +000093 error_msg.contains("Signature is invalid") || error_msg.contains("not implemented")
Seungjae Yoo91e250a2022-06-07 02:21:56 +000094 );
95 }
96}
97
Seungjae Yoo91e250a2022-06-07 02:21:56 +000098#[test]
99fn test_verify_v3_digest_mismatch() {
100 let path_list = [
101 "tests/data/v3-only-with-dsa-sha256-3072-digest-mismatch.apk",
102 "tests/data/v3-only-with-rsa-pkcs1-sha512-8192-digest-mismatch.apk",
103 ];
104 for path in path_list.iter() {
105 let res = verify(path);
106 assert!(res.is_err());
107 let error_msg = &res.unwrap_err().to_string();
Alice Wanga66b5c02022-09-16 07:25:17 +0000108 assert!(error_msg.contains("Digest mismatch") || error_msg.contains("not implemented"));
Seungjae Yoo91e250a2022-06-07 02:21:56 +0000109 }
110}
111
112#[test]
113fn test_verify_v3_wrong_apk_sig_block_magic() {
114 let res = verify("tests/data/v3-only-with-ecdsa-sha512-p384-wrong-apk-sig-block-magic.apk");
115 assert!(res.is_err());
116 assert_contains(&res.unwrap_err().to_string(), "No APK Signing Block");
117}
118
119#[test]
120fn test_verify_v3_apk_sig_block_size_mismatch() {
121 let res =
122 verify("tests/data/v3-only-with-rsa-pkcs1-sha512-4096-apk-sig-block-size-mismatch.apk");
123 assert!(res.is_err());
124 assert_contains(
125 &res.unwrap_err().to_string(),
126 "APK Signing Block sizes in header and footer do not match",
127 );
128}
129
130#[test]
131fn test_verify_v3_cert_and_public_key_mismatch() {
132 let res = verify("tests/data/v3-only-cert-and-public-key-mismatch.apk");
133 assert!(res.is_err());
134 assert_contains(&res.unwrap_err().to_string(), "Public key mismatch");
135}
136
137#[test]
138fn test_verify_v3_empty() {
139 let res = verify("tests/data/v3-only-empty.apk");
140 assert!(res.is_err());
141 assert_contains(&res.unwrap_err().to_string(), "APK too small for APK Signing Block");
142}
143
144#[test]
145fn test_verify_v3_no_certs_in_sig() {
146 let res = verify("tests/data/v3-only-no-certs-in-sig.apk");
147 assert!(res.is_err());
148 assert_contains(&res.unwrap_err().to_string(), "No certificates listed");
149}
150
151#[test]
152fn test_verify_v3_no_supported_sig_algs() {
153 let res = verify("tests/data/v3-only-no-supported-sig-algs.apk");
154 assert!(res.is_err());
155 assert_contains(&res.unwrap_err().to_string(), "No supported signatures found");
156}
157
158#[test]
159fn test_verify_v3_signatures_and_digests_block_mismatch() {
160 let res = verify("tests/data/v3-only-signatures-and-digests-block-mismatch.apk");
161 assert!(res.is_err());
162 assert_contains(
163 &res.unwrap_err().to_string(),
164 "Signature algorithms don't match between digests and signatures records",
165 );
166}
167
168#[test]
169fn test_verify_v3_unknown_additional_attr() {
170 assert!(verify("tests/data/v3-only-unknown-additional-attr.apk").is_ok());
171}
172
173#[test]
174fn test_verify_v3_unknown_pair_in_apk_sig_block() {
175 assert!(verify("tests/data/v3-only-unknown-pair-in-apk-sig-block.apk").is_ok());
176}
177
178#[test]
179fn test_verify_v3_ignorable_unsupported_sig_algs() {
180 assert!(verify("tests/data/v3-only-with-ignorable-unsupported-sig-algs.apk").is_ok());
181}
182
183#[test]
184fn test_verify_v3_stamp() {
185 assert!(verify("tests/data/v3-only-with-stamp.apk").is_ok());
186}