payload_signer.h revision 98e691cc6debda3ef671acba001bebd45da36377 
1//
2// Copyright (C) 2010 The Android Open Source Project
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8//      http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15//
16
17#ifndef UPDATE_ENGINE_PAYLOAD_GENERATOR_PAYLOAD_SIGNER_H_
18#define UPDATE_ENGINE_PAYLOAD_GENERATOR_PAYLOAD_SIGNER_H_
19
20#include <string>
21#include <vector>
22
23#include <base/macros.h>
24#include <brillo/key_value_store.h>
25#include <brillo/secure_blob.h>
26
27#include "update_engine/update_metadata.pb.h"
28
29// This class encapsulates methods used for payload signing.
30// See update_metadata.proto for more info.
31
32namespace chromeos_update_engine {
33
34class PayloadSigner {
35 public:
36  // Reads the payload metadata from the given |payload_path| into the
37  // |out_payload_metadata| vector if not null. It also parses the manifest
38  // protobuf in the payload and returns it in |out_manifest| if not null, along
39  // with the major version of the payload in |out_major_version| if not null,
40  // the size of the entire metadata in |out_metadata_size| and the size of
41  // metadata signature in |out_metadata_signature_size| if not null. Returns
42  // whether a valid payload metadata was found and parsed.
43  static bool LoadPayloadMetadata(const std::string& payload_path,
44                                  brillo::Blob* out_payload_metadata,
45                                  DeltaArchiveManifest* out_manifest,
46                                  uint64_t* out_major_version,
47                                  uint64_t* out_metadata_size,
48                                  uint32_t* out_metadata_signature_size);
49
50  // Returns true if the payload in |payload_path| is signed and its hash can be
51  // verified using the public key in |public_key_path| with the signature
52  // of a given version in the signature blob. Returns false otherwise.
53  static bool VerifySignedPayload(const std::string& payload_path,
54                                  const std::string& public_key_path);
55
56  // Adds specified signature offset/length to given |manifest|, also adds a
57  // dummy operation that points to a signature blob located at the specified
58  // offset/length if |add_dummy_op| is true.
59  static void AddSignatureToManifest(uint64_t signature_blob_offset,
60                                     uint64_t signature_blob_length,
61                                     bool add_dummy_op,
62                                     DeltaArchiveManifest* manifest);
63
64  // Given a raw |hash| and a private key in |private_key_path| calculates the
65  // raw signature in |out_signature|. Returns true on success, false otherwise.
66  static bool SignHash(const brillo::Blob& hash,
67                       const std::string& private_key_path,
68                       brillo::Blob* out_signature);
69
70  // Sign |hash_data| blob with all private keys in |private_key_paths|, then
71  // convert the signatures to protobuf blob.
72  static bool SignHashWithKeys(
73      const brillo::Blob& hash_data,
74      const std::vector<std::string>& private_key_paths,
75      brillo::Blob* out_signature_blob);
76
77  // Given an unsigned payload in |unsigned_payload_path|, private keys in
78  // |private_key_path|, metadata size in |metadata_size|, metadata signature
79  // size in |metadata_signature_size| and signatures offset in
80  // |signatures_offset|, calculates the payload signature blob into
81  // |out_signature_blob|. Note that the payload must already have an
82  // updated manifest that includes the dummy signature op and correct metadata
83  // signature size in header. Returns true on success, false otherwise.
84  static bool SignPayload(const std::string& unsigned_payload_path,
85                          const std::vector<std::string>& private_key_paths,
86                          const uint64_t metadata_size,
87                          const uint32_t metadata_signature_size,
88                          const uint64_t signatures_offset,
89                          brillo::Blob* out_signature_blob);
90
91  // Returns the length of out_signature_blob that will result in a call
92  // to SignPayload with the given private keys. Returns true on success.
93  static bool SignatureBlobLength(
94      const std::vector<std::string>& private_key_paths,
95      uint64_t* out_length);
96
97  // Given an unsigned payload in |payload_path|,
98  // this method does two things:
99  // 1. It loads the payload into memory, and inserts placeholder signature
100  //    operations and placeholder metadata signature to make the header and
101  //    the manifest match what the final signed payload will look like based
102  //    on |signatures_sizes|, if needed.
103  // 2. It calculates the raw SHA256 hash of the payload and the metadata in
104  //    |payload_path| (except signatures) and returns the result in
105  //    |out_hash_data| and |out_metadata_hash| respectively.
106  //
107  // The changes to payload are not preserved or written to disk.
108  static bool HashPayloadForSigning(const std::string& payload_path,
109                                    const std::vector<int>& signature_sizes,
110                                    brillo::Blob* out_payload_hash_data,
111                                    brillo::Blob* out_metadata_hash);
112
113  // Given an unsigned payload in |payload_path| (with no dummy signature op)
114  // and the raw |payload_signatures| and |metadata_signatures| updates the
115  // payload to include the signature thus turning it into a signed payload. The
116  // new payload is stored in |signed_payload_path|. |payload_path| and
117  // |signed_payload_path| can point to the same file. Populates
118  // |out_metadata_size| with the size of the metadata after adding the
119  // signature operation in the manifest. Returns true on success, false
120  // otherwise.
121  static bool AddSignatureToPayload(
122      const std::string& payload_path,
123      const std::vector<brillo::Blob>& payload_signatures,
124      const std::vector<brillo::Blob>& metadata_signatures,
125      const std::string& signed_payload_path,
126      uint64_t* out_metadata_size);
127
128  // Computes the SHA256 hash of the first metadata_size bytes of |metadata|
129  // and signs the hash with the given private_key_path and writes the signed
130  // hash in |out_signature|. Returns true if successful or false if there was
131  // any error in the computations.
132  static bool GetMetadataSignature(const void* const metadata,
133                                   size_t metadata_size,
134                                   const std::string& private_key_path,
135                                   std::string* out_signature);
136
137  static bool ExtractPayloadProperties(const std::string& payload_path,
138                                       brillo::KeyValueStore* properties);
139
140 private:
141  // This should never be constructed
142  DISALLOW_IMPLICIT_CONSTRUCTORS(PayloadSigner);
143};
144
145}  // namespace chromeos_update_engine
146
147#endif  // UPDATE_ENGINE_PAYLOAD_GENERATOR_PAYLOAD_SIGNER_H_
148