payload_signer.cc revision 9c89e8499abeac3894718120d12b41301ffa3fc1 
1//
2// Copyright (C) 2011 The Android Open Source Project
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8//      http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15//
16
17#include "update_engine/payload_generator/payload_signer.h"
18
19#include <endian.h>
20
21#include <utility>
22
23#include <base/logging.h>
24#include <base/strings/string_number_conversions.h>
25#include <base/strings/string_split.h>
26#include <base/strings/string_util.h>
27#include <brillo/data_encoding.h>
28#include <brillo/streams/file_stream.h>
29#include <brillo/streams/stream.h>
30#include <openssl/err.h>
31#include <openssl/pem.h>
32
33#include "update_engine/common/hash_calculator.h"
34#include "update_engine/common/subprocess.h"
35#include "update_engine/common/utils.h"
36#include "update_engine/payload_consumer/delta_performer.h"
37#include "update_engine/payload_consumer/payload_constants.h"
38#include "update_engine/payload_consumer/payload_verifier.h"
39#include "update_engine/payload_generator/delta_diff_generator.h"
40#include "update_engine/payload_generator/payload_file.h"
41#include "update_engine/update_metadata.pb.h"
42
43using std::string;
44using std::vector;
45
46namespace chromeos_update_engine {
47
48namespace {
49
50// The payload verifier will check all the signatures included in the payload
51// regardless of the version field. Old version of the verifier require the
52// version field to be included and be 1.
53const uint32_t kSignatureMessageLegacyVersion = 1;
54
55// Given raw |signatures|, packs them into a protobuf and serializes it into a
56// binary blob. Returns true on success, false otherwise.
57bool ConvertSignatureToProtobufBlob(const vector<brillo::Blob>& signatures,
58                                    brillo::Blob* out_signature_blob) {
59  // Pack it into a protobuf
60  Signatures out_message;
61  for (const brillo::Blob& signature : signatures) {
62    Signatures_Signature* sig_message = out_message.add_signatures();
63    // Set all the signatures with the same version number.
64    sig_message->set_version(kSignatureMessageLegacyVersion);
65    sig_message->set_data(signature.data(), signature.size());
66  }
67
68  // Serialize protobuf
69  string serialized;
70  TEST_AND_RETURN_FALSE(out_message.AppendToString(&serialized));
71  out_signature_blob->insert(out_signature_blob->end(),
72                             serialized.begin(),
73                             serialized.end());
74  LOG(INFO) << "Signature blob size: " << out_signature_blob->size();
75  return true;
76}
77
78// Given an unsigned payload under |payload_path| and the |signature_blob| and
79// |metadata_signature_blob| generates an updated payload that includes the
80// signatures. It populates |out_metadata_size| with the size of the final
81// manifest after adding the dummy signature operation, and
82// |out_signatures_offset| with the expected offset for the new blob, and
83// |out_metadata_signature_size| which will be size of |metadata_signature_blob|
84// if the payload major version supports metadata signature, 0 otherwise.
85// Returns true on success, false otherwise.
86bool AddSignatureBlobToPayload(const string& payload_path,
87                               const brillo::Blob& signature_blob,
88                               const brillo::Blob& metadata_signature_blob,
89                               brillo::Blob* out_payload,
90                               uint64_t* out_metadata_size,
91                               uint32_t* out_metadata_signature_size,
92                               uint64_t* out_signatures_offset) {
93  uint64_t manifest_offset = 20;
94  const int kProtobufSizeOffset = 12;
95
96  DeltaArchiveManifest manifest;
97  uint64_t metadata_size, major_version;
98  uint32_t metadata_signature_size;
99  TEST_AND_RETURN_FALSE(
100      PayloadSigner::LoadPayloadMetadata(payload_path,
101                                         nullptr,
102                                         &manifest,
103                                         &major_version,
104                                         &metadata_size,
105                                         &metadata_signature_size));
106
107  brillo::Blob payload;
108  TEST_AND_RETURN_FALSE(utils::ReadFile(payload_path, &payload));
109
110  if (major_version == kBrilloMajorPayloadVersion) {
111    // Write metadata signature size in header.
112    uint32_t metadata_signature_size_be =
113        htobe32(metadata_signature_blob.size());
114    memcpy(payload.data() + manifest_offset, &metadata_signature_size_be,
115           sizeof(metadata_signature_size_be));
116    manifest_offset += sizeof(metadata_signature_size_be);
117    // Replace metadata signature.
118    payload.erase(payload.begin() + metadata_size,
119                  payload.begin() + metadata_size + metadata_signature_size);
120    payload.insert(payload.begin() + metadata_size,
121                   metadata_signature_blob.begin(),
122                   metadata_signature_blob.end());
123    metadata_signature_size = metadata_signature_blob.size();
124    LOG(INFO) << "Metadata signature size: " << metadata_signature_size;
125  }
126
127  // Is there already a signature op in place?
128  if (manifest.has_signatures_size()) {
129    // The signature op is tied to the size of the signature blob, but not it's
130    // contents. We don't allow the manifest to change if there is already an op
131    // present, because that might invalidate previously generated
132    // hashes/signatures.
133    if (manifest.signatures_size() != signature_blob.size()) {
134      LOG(ERROR) << "Attempt to insert different signature sized blob. "
135                 << "(current:" << manifest.signatures_size()
136                 << "new:" << signature_blob.size() << ")";
137      return false;
138    }
139
140    LOG(INFO) << "Matching signature sizes already present.";
141  } else {
142    // Updates the manifest to include the signature operation.
143    PayloadSigner::AddSignatureToManifest(
144        payload.size() - metadata_size - metadata_signature_size,
145        signature_blob.size(),
146        major_version == kChromeOSMajorPayloadVersion,
147        &manifest);
148
149    // Updates the payload to include the new manifest.
150    string serialized_manifest;
151    TEST_AND_RETURN_FALSE(manifest.AppendToString(&serialized_manifest));
152    LOG(INFO) << "Updated protobuf size: " << serialized_manifest.size();
153    payload.erase(payload.begin() + manifest_offset,
154                  payload.begin() + metadata_size);
155    payload.insert(payload.begin() + manifest_offset,
156                   serialized_manifest.begin(),
157                   serialized_manifest.end());
158
159    // Updates the protobuf size.
160    uint64_t size_be = htobe64(serialized_manifest.size());
161    memcpy(&payload[kProtobufSizeOffset], &size_be, sizeof(size_be));
162    metadata_size = serialized_manifest.size() + manifest_offset;
163
164    LOG(INFO) << "Updated payload size: " << payload.size();
165    LOG(INFO) << "Updated metadata size: " << metadata_size;
166  }
167  uint64_t signatures_offset = metadata_size + metadata_signature_size +
168                               manifest.signatures_offset();
169  LOG(INFO) << "Signature Blob Offset: " << signatures_offset;
170  payload.resize(signatures_offset);
171  payload.insert(payload.begin() + signatures_offset,
172                 signature_blob.begin(),
173                 signature_blob.end());
174
175  *out_payload = std::move(payload);
176  *out_metadata_size = metadata_size;
177  *out_metadata_signature_size = metadata_signature_size;
178  *out_signatures_offset = signatures_offset;
179  return true;
180}
181
182// Given a |payload| with correct signature op and metadata signature size in
183// header and |metadata_size|, |metadata_signature_size|, |signatures_offset|,
184// calculate hash for payload and metadata, save it to |out_hash_data| and
185// |out_metadata_hash|.
186bool CalculateHashFromPayload(const brillo::Blob& payload,
187                              const uint64_t metadata_size,
188                              const uint32_t metadata_signature_size,
189                              const uint64_t signatures_offset,
190                              brillo::Blob* out_hash_data,
191                              brillo::Blob* out_metadata_hash) {
192  if (out_metadata_hash) {
193    // Calculates the hash on the manifest.
194    TEST_AND_RETURN_FALSE(
195        HashCalculator::RawHashOfBytes(payload.data(), metadata_size,
196                                       out_metadata_hash));
197  }
198  if (out_hash_data) {
199    // Calculates the hash on the updated payload. Note that we skip metadata
200    // signature and payload signature.
201    HashCalculator calc;
202    TEST_AND_RETURN_FALSE(calc.Update(payload.data(), metadata_size));
203    TEST_AND_RETURN_FALSE(signatures_offset >=
204                          metadata_size + metadata_signature_size);
205    TEST_AND_RETURN_FALSE(calc.Update(
206        payload.data() + metadata_size + metadata_signature_size,
207        signatures_offset - metadata_size - metadata_signature_size));
208    TEST_AND_RETURN_FALSE(calc.Finalize());
209    *out_hash_data = calc.raw_hash();
210  }
211  return true;
212}
213
214}  // namespace
215
216void PayloadSigner::AddSignatureToManifest(uint64_t signature_blob_offset,
217                                           uint64_t signature_blob_length,
218                                           bool add_dummy_op,
219                                           DeltaArchiveManifest* manifest) {
220  LOG(INFO) << "Making room for signature in file";
221  manifest->set_signatures_offset(signature_blob_offset);
222  LOG(INFO) << "set? " << manifest->has_signatures_offset();
223  manifest->set_signatures_offset(signature_blob_offset);
224  manifest->set_signatures_size(signature_blob_length);
225  // Add a dummy op at the end to appease older clients
226  if (add_dummy_op) {
227    InstallOperation* dummy_op = manifest->add_kernel_install_operations();
228    dummy_op->set_type(InstallOperation::REPLACE);
229    dummy_op->set_data_offset(signature_blob_offset);
230    dummy_op->set_data_length(signature_blob_length);
231    Extent* dummy_extent = dummy_op->add_dst_extents();
232    // Tell the dummy op to write this data to a big sparse hole
233    dummy_extent->set_start_block(kSparseHole);
234    dummy_extent->set_num_blocks((signature_blob_length + kBlockSize - 1) /
235                                 kBlockSize);
236  }
237}
238
239bool PayloadSigner::LoadPayloadMetadata(const string& payload_path,
240                                        brillo::Blob* out_payload_metadata,
241                                        DeltaArchiveManifest* out_manifest,
242                                        uint64_t* out_major_version,
243                                        uint64_t* out_metadata_size,
244                                        uint32_t* out_metadata_signature_size) {
245  brillo::StreamPtr payload_file =
246      brillo::FileStream::Open(base::FilePath(payload_path),
247                               brillo::Stream::AccessMode::READ,
248                               brillo::FileStream::Disposition::OPEN_EXISTING,
249                               nullptr);
250  TEST_AND_RETURN_FALSE(payload_file);
251  brillo::Blob payload_metadata;
252
253  payload_metadata.resize(kMaxPayloadHeaderSize);
254  TEST_AND_RETURN_FALSE(payload_file->ReadAllBlocking(
255      payload_metadata.data(), payload_metadata.size(), nullptr));
256
257  const uint8_t* read_pointer = payload_metadata.data();
258  TEST_AND_RETURN_FALSE(
259      memcmp(read_pointer, kDeltaMagic, sizeof(kDeltaMagic)) == 0);
260  read_pointer += sizeof(kDeltaMagic);
261
262  uint64_t major_version;
263  memcpy(&major_version, read_pointer, sizeof(major_version));
264  read_pointer += sizeof(major_version);
265  major_version = be64toh(major_version);
266  TEST_AND_RETURN_FALSE(major_version == kChromeOSMajorPayloadVersion ||
267                        major_version == kBrilloMajorPayloadVersion);
268  if (out_major_version)
269    *out_major_version = major_version;
270
271  uint64_t manifest_size = 0;
272  memcpy(&manifest_size, read_pointer, sizeof(manifest_size));
273  read_pointer += sizeof(manifest_size);
274  manifest_size = be64toh(manifest_size);
275
276  uint32_t metadata_signature_size = 0;
277  if (major_version == kBrilloMajorPayloadVersion) {
278    memcpy(&metadata_signature_size, read_pointer,
279           sizeof(metadata_signature_size));
280    read_pointer += sizeof(metadata_signature_size);
281    metadata_signature_size = be32toh(metadata_signature_size);
282  }
283  if (out_metadata_signature_size)
284    *out_metadata_signature_size = metadata_signature_size;
285
286  uint64_t header_size = read_pointer - payload_metadata.data();
287  uint64_t metadata_size = header_size + manifest_size;
288  if (out_metadata_size)
289    *out_metadata_size = metadata_size;
290
291  size_t bytes_read = payload_metadata.size();
292  payload_metadata.resize(metadata_size);
293  TEST_AND_RETURN_FALSE(
294      payload_file->ReadAllBlocking(payload_metadata.data() + bytes_read,
295                                    payload_metadata.size() - bytes_read,
296                                    nullptr));
297  if (out_manifest) {
298    TEST_AND_RETURN_FALSE(out_manifest->ParseFromArray(
299        payload_metadata.data() + header_size, manifest_size));
300  }
301  if (out_payload_metadata)
302    *out_payload_metadata = std::move(payload_metadata);
303  return true;
304}
305
306bool PayloadSigner::VerifySignedPayload(const string& payload_path,
307                                        const string& public_key_path) {
308  DeltaArchiveManifest manifest;
309  uint64_t metadata_size;
310  uint32_t metadata_signature_size;
311  TEST_AND_RETURN_FALSE(LoadPayloadMetadata(payload_path,
312                                            nullptr,
313                                            &manifest,
314                                            nullptr,
315                                            &metadata_size,
316                                            &metadata_signature_size));
317  brillo::Blob payload;
318  TEST_AND_RETURN_FALSE(utils::ReadFile(payload_path, &payload));
319  TEST_AND_RETURN_FALSE(manifest.has_signatures_offset() &&
320                        manifest.has_signatures_size());
321  uint64_t signatures_offset = metadata_size + metadata_signature_size +
322                               manifest.signatures_offset();
323  CHECK_EQ(payload.size(), signatures_offset + manifest.signatures_size());
324  brillo::Blob payload_hash, metadata_hash;
325  TEST_AND_RETURN_FALSE(CalculateHashFromPayload(payload,
326                                                 metadata_size,
327                                                 metadata_signature_size,
328                                                 signatures_offset,
329                                                 &payload_hash,
330                                                 &metadata_hash));
331  brillo::Blob signature_blob(payload.begin() + signatures_offset,
332                              payload.end());
333  TEST_AND_RETURN_FALSE(PayloadVerifier::PadRSA2048SHA256Hash(&payload_hash));
334  TEST_AND_RETURN_FALSE(PayloadVerifier::VerifySignature(
335      signature_blob, public_key_path, payload_hash));
336  if (metadata_signature_size) {
337    signature_blob.assign(payload.begin() + metadata_size,
338                          payload.begin() + metadata_size +
339                          metadata_signature_size);
340    TEST_AND_RETURN_FALSE(
341        PayloadVerifier::PadRSA2048SHA256Hash(&metadata_hash));
342    TEST_AND_RETURN_FALSE(PayloadVerifier::VerifySignature(
343        signature_blob, public_key_path, metadata_hash));
344  }
345  return true;
346}
347
348bool PayloadSigner::SignHash(const brillo::Blob& hash,
349                             const string& private_key_path,
350                             brillo::Blob* out_signature) {
351  LOG(INFO) << "Signing hash with private key: " << private_key_path;
352  // We expect unpadded SHA256 hash coming in
353  TEST_AND_RETURN_FALSE(hash.size() == 32);
354  brillo::Blob padded_hash(hash);
355  PayloadVerifier::PadRSA2048SHA256Hash(&padded_hash);
356
357  // The code below executes the equivalent of:
358  //
359  // openssl rsautl -raw -sign -inkey |private_key_path|
360  //   -in |padded_hash| -out |out_signature|
361
362  FILE* fprikey = fopen(private_key_path.c_str(), "rb");
363  TEST_AND_RETURN_FALSE(fprikey != nullptr);
364  RSA* rsa = PEM_read_RSAPrivateKey(fprikey, nullptr, nullptr, nullptr);
365  fclose(fprikey);
366  TEST_AND_RETURN_FALSE(rsa != nullptr);
367  brillo::Blob signature(RSA_size(rsa));
368  ssize_t signature_size = RSA_private_encrypt(padded_hash.size(),
369                                               padded_hash.data(),
370                                               signature.data(),
371                                               rsa,
372                                               RSA_NO_PADDING);
373  RSA_free(rsa);
374  if (signature_size < 0) {
375    LOG(ERROR) << "Signing hash failed: "
376               << ERR_error_string(ERR_get_error(), nullptr);
377    return false;
378  }
379  TEST_AND_RETURN_FALSE(static_cast<size_t>(signature_size) ==
380                        signature.size());
381  out_signature->swap(signature);
382  return true;
383}
384
385bool PayloadSigner::SignHashWithKeys(const brillo::Blob& hash_data,
386                                     const vector<string>& private_key_paths,
387                                     brillo::Blob* out_signature_blob) {
388  vector<brillo::Blob> signatures;
389  for (const string& path : private_key_paths) {
390    brillo::Blob signature;
391    TEST_AND_RETURN_FALSE(SignHash(hash_data, path, &signature));
392    signatures.push_back(signature);
393  }
394  TEST_AND_RETURN_FALSE(ConvertSignatureToProtobufBlob(signatures,
395                                                       out_signature_blob));
396  return true;
397}
398
399bool PayloadSigner::SignPayload(const string& unsigned_payload_path,
400                                const vector<string>& private_key_paths,
401                                const uint64_t metadata_size,
402                                const uint32_t metadata_signature_size,
403                                const uint64_t signatures_offset,
404                                brillo::Blob* out_signature_blob) {
405  brillo::Blob payload;
406  TEST_AND_RETURN_FALSE(utils::ReadFile(unsigned_payload_path, &payload));
407  brillo::Blob hash_data;
408  TEST_AND_RETURN_FALSE(CalculateHashFromPayload(payload,
409                                                 metadata_size,
410                                                 metadata_signature_size,
411                                                 signatures_offset,
412                                                 &hash_data,
413                                                 nullptr));
414  TEST_AND_RETURN_FALSE(SignHashWithKeys(hash_data,
415                                         private_key_paths,
416                                         out_signature_blob));
417  return true;
418}
419
420bool PayloadSigner::SignatureBlobLength(const vector<string>& private_key_paths,
421                                        uint64_t* out_length) {
422  DCHECK(out_length);
423  brillo::Blob x_blob(1, 'x'), hash_blob, sig_blob;
424  TEST_AND_RETURN_FALSE(HashCalculator::RawHashOfBytes(x_blob.data(),
425                                                       x_blob.size(),
426                                                       &hash_blob));
427  TEST_AND_RETURN_FALSE(
428      SignHashWithKeys(hash_blob, private_key_paths, &sig_blob));
429  *out_length = sig_blob.size();
430  return true;
431}
432
433bool PayloadSigner::HashPayloadForSigning(const string& payload_path,
434                                          const vector<int>& signature_sizes,
435                                          brillo::Blob* out_payload_hash_data,
436                                          brillo::Blob* out_metadata_hash) {
437  // Create a signature blob with signatures filled with 0.
438  // Will be used for both payload signature and metadata signature.
439  vector<brillo::Blob> signatures;
440  for (int signature_size : signature_sizes) {
441    signatures.emplace_back(signature_size, 0);
442  }
443  brillo::Blob signature_blob;
444  TEST_AND_RETURN_FALSE(ConvertSignatureToProtobufBlob(signatures,
445                                                       &signature_blob));
446
447  brillo::Blob payload;
448  uint64_t metadata_size, signatures_offset;
449  uint32_t metadata_signature_size;
450  // Prepare payload for hashing.
451  TEST_AND_RETURN_FALSE(AddSignatureBlobToPayload(payload_path,
452                                                  signature_blob,
453                                                  signature_blob,
454                                                  &payload,
455                                                  &metadata_size,
456                                                  &metadata_signature_size,
457                                                  &signatures_offset));
458  TEST_AND_RETURN_FALSE(CalculateHashFromPayload(payload,
459                                                 metadata_size,
460                                                 metadata_signature_size,
461                                                 signatures_offset,
462                                                 out_payload_hash_data,
463                                                 out_metadata_hash));
464  return true;
465}
466
467bool PayloadSigner::AddSignatureToPayload(
468    const string& payload_path,
469    const vector<brillo::Blob>& payload_signatures,
470    const vector<brillo::Blob>& metadata_signatures,
471    const string& signed_payload_path,
472    uint64_t *out_metadata_size) {
473  // TODO(petkov): Reduce memory usage -- the payload is manipulated in memory.
474
475  // Loads the payload and adds the signature op to it.
476  brillo::Blob signature_blob, metadata_signature_blob;
477  TEST_AND_RETURN_FALSE(ConvertSignatureToProtobufBlob(payload_signatures,
478                                                       &signature_blob));
479  if (!metadata_signatures.empty()) {
480    TEST_AND_RETURN_FALSE(
481        ConvertSignatureToProtobufBlob(metadata_signatures,
482                                       &metadata_signature_blob));
483  }
484  brillo::Blob payload;
485  uint64_t signatures_offset;
486  uint32_t metadata_signature_size;
487  TEST_AND_RETURN_FALSE(AddSignatureBlobToPayload(payload_path,
488                                                  signature_blob,
489                                                  metadata_signature_blob,
490                                                  &payload,
491                                                  out_metadata_size,
492                                                  &metadata_signature_size,
493                                                  &signatures_offset));
494
495  LOG(INFO) << "Signed payload size: " << payload.size();
496  TEST_AND_RETURN_FALSE(utils::WriteFile(signed_payload_path.c_str(),
497                                         payload.data(),
498                                         payload.size()));
499  return true;
500}
501
502bool PayloadSigner::GetMetadataSignature(const void* const metadata,
503                                         size_t metadata_size,
504                                         const string& private_key_path,
505                                         string* out_signature) {
506  // Calculates the hash on the updated payload. Note that the payload includes
507  // the signature op but doesn't include the signature blob at the end.
508  brillo::Blob metadata_hash;
509  TEST_AND_RETURN_FALSE(HashCalculator::RawHashOfBytes(metadata,
510                                                       metadata_size,
511                                                       &metadata_hash));
512
513  brillo::Blob signature;
514  TEST_AND_RETURN_FALSE(SignHash(metadata_hash,
515                                 private_key_path,
516                                 &signature));
517
518  *out_signature = brillo::data_encoding::Base64Encode(signature);
519  return true;
520}
521
522bool PayloadSigner::ExtractPayloadProperties(
523    const string& payload_path, brillo::KeyValueStore* properties) {
524  DeltaArchiveManifest manifest;
525  brillo::Blob payload_metadata;
526  uint64_t major_version, metadata_size;
527  uint32_t metadata_signature_size;
528  uint64_t file_size = utils::FileSize(payload_path);
529
530  TEST_AND_RETURN_FALSE(
531      PayloadSigner::LoadPayloadMetadata(payload_path,
532                                         &payload_metadata,
533                                         &manifest,
534                                         &major_version,
535                                         &metadata_size,
536                                         &metadata_signature_size));
537
538  properties->SetString(kPayloadPropertyFileSize, std::to_string(file_size));
539  properties->SetString(kPayloadPropertyMetadataSize,
540                        std::to_string(metadata_size));
541
542  brillo::Blob file_hash, metadata_hash;
543  TEST_AND_RETURN_FALSE(
544      HashCalculator::RawHashOfFile(payload_path, file_size, &file_hash) ==
545      static_cast<off_t>(file_size));
546  TEST_AND_RETURN_FALSE(HashCalculator::RawHashOfBytes(
547      payload_metadata.data(), payload_metadata.size(), &metadata_hash));
548
549  properties->SetString(kPayloadPropertyFileHash,
550                        brillo::data_encoding::Base64Encode(file_hash));
551  properties->SetString(kPayloadPropertyMetadataHash,
552                        brillo::data_encoding::Base64Encode(metadata_hash));
553  return true;
554}
555
556}  // namespace chromeos_update_engine
557