Package the Rust mobile core and generated Kotlin API for Android (#92)

tools/android-build/src/native.rs

@@ -0,0 +1,208 @@
+//! Verify every packaged native library, including JNA, against the ABI/page contract.
+
+use std::{collections::BTreeMap, error::Error, fs::File, io::Read, path::Path};
+
+use object::{Architecture, BinaryFormat, Object, ObjectSection, ObjectSegment, ObjectSymbol};
+
+const PAGE_SIZE: u64 = 16_384;
+const ABIS: [&str; 3] = ["arm64-v8a", "armeabi-v7a", "x86_64"];
+
+pub fn package_directory(input: &Path, output: &Path) -> Result<(), Box<dyn Error>> {
+    audit_directory(input)?;
+    let input = input.canonicalize()?;
+    let output = if output.exists() {
+        if output.is_symlink() {
+            return Err("native output must not be a symlink".into());
+        }
+        output.canonicalize()?
+    } else {
+        output
+            .parent()
+            .ok_or("output needs a parent")?
+            .canonicalize()?
+            .join(output.file_name().ok_or("output needs a name")?)
+    };
+    if input.starts_with(&output) || output.starts_with(&input) {
+        return Err("native input/output must not overlap".into());
+    }
+    if output.exists() {
+        std::fs::remove_dir_all(&output)?;
+    }
+    for abi in ABIS {
+        std::fs::create_dir_all(output.join(abi))?;
+        // cargo-ndk also emits dependency cdylibs; ship only the Android boundary.
+        std::fs::copy(
+            input.join(abi).join("libironstorage_android.so"),
+            output.join(abi).join("libironstorage_android.so"),
+        )?;
+    }
+    Ok(())
+}
+
+pub fn audit_directory(directory: &Path) -> Result<(), Box<dyn Error>> {
+    let mut expected = None;
+    for abi in ABIS {
+        let bytes = std::fs::read(directory.join(abi).join("libironstorage_android.so"))?;
+        audit_elf(&bytes, abi)?;
+        let library = object::File::parse(bytes.as_slice())?;
+        let mut metadata = BTreeMap::new();
+        for symbol in library.symbols() {
+            let name = symbol.name()?;
+            if name.starts_with("UNIFFI_META_") {
+                let section = library.section_by_index(
+                    symbol
+                        .section_index()
+                        .ok_or("UniFFI metadata has no section")?,
+                )?;
+                let value = section
+                    .data_range(symbol.address(), symbol.size())?
+                    .ok_or("UniFFI metadata is outside its section")?;
+                metadata.insert(name.to_owned(), value.to_vec());
+            }
+        }
+        if metadata.is_empty() {
+            return Err("native library has no UniFFI metadata".into());
+        }
+        if let Some(expected) = &expected {
+            if expected != &metadata {
+                return Err("UniFFI metadata differs across Android ABIs".into());
+            }
+        } else {
+            expected = Some(metadata);
+        }
+    }
+    println!("Verified three native ABIs, 16 KB ELF alignment and identical UniFFI metadata");
+    Ok(())
+}
+
+pub fn audit_elf(bytes: &[u8], abi: &str) -> Result<(), Box<dyn Error>> {
+    let expected = match abi {
+        "arm64-v8a" => Architecture::Aarch64,
+        "armeabi-v7a" => Architecture::Arm,
+        "x86_64" => Architecture::X86_64,
+        _ => return Err("unapproved native ABI".into()),
+    };
+    let library = object::File::parse(bytes)?;
+    if library.format() != BinaryFormat::Elf || library.architecture() != expected {
+        return Err("native library architecture does not match its ABI directory".into());
+    }
+    let mut segments = 0;
+    for segment in library.segments() {
+        let (offset, _) = segment.file_range();
+        if segment.align() < PAGE_SIZE || segment.address() % PAGE_SIZE != offset % PAGE_SIZE {
+            return Err("native ELF LOAD segment is not compatible with 16 KB pages".into());
+        }
+        segments += 1;
+    }
+    if segments == 0 {
+        return Err("native ELF has no loadable segments".into());
+    }
+    Ok(())
+}
+
+pub fn audit_package(path: &Path) -> Result<(), Box<dyn Error>> {
+    audit_package_abis(path, &ABIS)
+}
+
+pub fn audit_split(path: &Path, abi: &str) -> Result<(), Box<dyn Error>> {
+    if !ABIS.contains(&abi) || !path.extension().is_some_and(|ext| ext == "apk") {
+        return Err("expected an APK split for an approved ABI".into());
+    }
+    audit_package_abis(path, &[abi])
+}
+
+fn audit_package_abis(path: &Path, abis: &[&str]) -> Result<(), Box<dyn Error>> {
+    let apk = path.extension().is_some_and(|ext| ext == "apk");
+    if !apk && !path.extension().is_some_and(|ext| ext == "aab") {
+        return Err("expected an APK or AAB".into());
+    }
+    let mut archive = zip::ZipArchive::new(File::open(path)?)?;
+    let mut libraries = BTreeMap::<String, Vec<String>>::new();
+    for index in 0..archive.len() {
+        let mut file = archive.by_index(index)?;
+        let name = file.name().to_owned();
+        let native = name.strip_prefix(if apk { "lib/" } else { "base/lib/" });
+        let Some((abi, library)) = native.and_then(|name| name.split_once('/')) else {
+            continue;
+        };
+        if !library.ends_with(".so") {
+            continue;
+        }
+        if library == "libironstorage_apple.so" {
+            return Err("Android package includes the redundant Apple boundary library".into());
+        }
+        if !abis.contains(&abi) || library.contains('/') {
+            return Err("package contains an unapproved native library path".into());
+        }
+        if apk
+            && (file.compression() != zip::CompressionMethod::Stored
+                || file.data_start() % PAGE_SIZE != 0)
+        {
+            return Err(format!("{name}: APK native entry is not stored/aligned to 16 KB").into());
+        }
+        if file.size() > 512 * 1024 * 1024 {
+            return Err("native library exceeds the package audit bound".into());
+        }
+        let mut bytes = Vec::new();
+        file.read_to_end(&mut bytes)?;
+        audit_elf(&bytes, abi).map_err(|error| format!("{name}: {error}"))?;
+        libraries
+            .entry(abi.to_owned())
+            .or_default()
+            .push(library.to_owned());
+    }
+    for abi in abis {
+        let found = libraries
+            .get(*abi)
+            .ok_or("package is missing a supported ABI")?;
+        for required in ["libironstorage_android.so", "libjnidispatch.so"] {
+            if !found.iter().any(|name| name == required) {
+                return Err(format!("{abi}: missing {required}").into());
+            }
+        }
+    }
+    println!(
+        "Verified all packaged native libraries for {abis:?} in {}",
+        path.display()
+    );
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn elf(alignment: u64, address: u64) -> Vec<u8> {
+        let mut bytes = vec![0; 120];
+        bytes[..7].copy_from_slice(b"\x7fELF\x02\x01\x01");
+        bytes[16..18].copy_from_slice(&3_u16.to_le_bytes());
+        bytes[18..20].copy_from_slice(&183_u16.to_le_bytes());
+        bytes[20..24].copy_from_slice(&1_u32.to_le_bytes());
+        bytes[32..40].copy_from_slice(&64_u64.to_le_bytes());
+        bytes[52..54].copy_from_slice(&64_u16.to_le_bytes());
+        bytes[54..56].copy_from_slice(&56_u16.to_le_bytes());
+        bytes[56..58].copy_from_slice(&1_u16.to_le_bytes());
+        bytes[64..68].copy_from_slice(&1_u32.to_le_bytes());
+        bytes[68..72].copy_from_slice(&4_u32.to_le_bytes());
+        bytes[80..88].copy_from_slice(&address.to_le_bytes());
+        bytes[96..104].copy_from_slice(&120_u64.to_le_bytes());
+        bytes[104..112].copy_from_slice(&120_u64.to_le_bytes());
+        bytes[112..120].copy_from_slice(&alignment.to_le_bytes());
+        bytes
+    }
+
+    #[test]
+    fn checks_real_load_alignment_congruence_and_directory_abi() {
+        assert!(audit_elf(&elf(PAGE_SIZE, 0), "arm64-v8a").is_ok());
+        assert!(audit_elf(&elf(4096, 0), "arm64-v8a").is_err());
+        assert!(audit_elf(&elf(PAGE_SIZE, 4), "arm64-v8a").is_err());
+        assert!(audit_elf(&elf(PAGE_SIZE, 0), "x86_64").is_err());
+    }
+
+    #[test]
+    fn rejects_non_elf_unapproved_abi_and_truncated_headers() {
+        assert!(audit_elf(b"not an ELF", "arm64-v8a").is_err());
+        assert!(audit_elf(b"\x7fELF", "x86_64").is_err());
+        assert!(audit_elf(&[], "mips").is_err());
+    }
+}