1 // 2 // Copyright (C) 2010 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 // 16 17 #ifndef UPDATE_ENGINE_PAYLOAD_GENERATOR_PAYLOAD_SIGNER_H_ 18 #define UPDATE_ENGINE_PAYLOAD_GENERATOR_PAYLOAD_SIGNER_H_ 19 20 #include <string> 21 #include <vector> 22 23 #include <base/macros.h> 24 #include <brillo/key_value_store.h> 25 #include <brillo/secure_blob.h> 26 27 #include "update_engine/update_metadata.pb.h" 28 29 // This class encapsulates methods used for payload signing. 30 // See update_metadata.proto for more info. 31 32 namespace chromeos_update_engine { 33 34 class PayloadSigner { 35 public: 36 // Reads the payload metadata from the given |payload_path| into the 37 // |out_payload_metadata| vector if not null. It also parses the manifest 38 // protobuf in the payload and returns it in |out_manifest| if not null, along 39 // with the major version of the payload in |out_major_version| if not null, 40 // the size of the entire metadata in |out_metadata_size| and the size of 41 // metadata signature in |out_metadata_signature_size| if not null. Returns 42 // whether a valid payload metadata was found and parsed. 43 static bool LoadPayloadMetadata(const std::string& payload_path, 44 brillo::Blob* out_payload_metadata, 45 DeltaArchiveManifest* out_manifest, 46 uint64_t* out_major_version, 47 uint64_t* out_metadata_size, 48 uint32_t* out_metadata_signature_size); 49 50 // Returns true if the payload in |payload_path| is signed and its hash can be 51 // verified using the public key in |public_key_path| with the signature 52 // of a given version in the signature blob. Returns false otherwise. 53 static bool VerifySignedPayload(const std::string& payload_path, 54 const std::string& public_key_path); 55 56 // Adds specified signature offset/length to given |manifest|, also adds a 57 // dummy operation that points to a signature blob located at the specified 58 // offset/length if |add_dummy_op| is true. 59 static void AddSignatureToManifest(uint64_t signature_blob_offset, 60 uint64_t signature_blob_length, 61 bool add_dummy_op, 62 DeltaArchiveManifest* manifest); 63 64 // Given a raw |hash| and a private key in |private_key_path| calculates the 65 // raw signature in |out_signature|. Returns true on success, false otherwise. 66 static bool SignHash(const brillo::Blob& hash, 67 const std::string& private_key_path, 68 brillo::Blob* out_signature); 69 70 // Sign |hash_data| blob with all private keys in |private_key_paths|, then 71 // convert the signatures to protobuf blob. 72 static bool SignHashWithKeys( 73 const brillo::Blob& hash_data, 74 const std::vector<std::string>& private_key_paths, 75 brillo::Blob* out_signature_blob); 76 77 // Given an unsigned payload in |unsigned_payload_path|, private keys in 78 // |private_key_path|, metadata size in |metadata_size|, metadata signature 79 // size in |metadata_signature_size| and signatures offset in 80 // |signatures_offset|, calculates the payload signature blob into 81 // |out_signature_blob|. Note that the payload must already have an 82 // updated manifest that includes the dummy signature op and correct metadata 83 // signature size in header. Returns true on success, false otherwise. 84 static bool SignPayload(const std::string& unsigned_payload_path, 85 const std::vector<std::string>& private_key_paths, 86 const uint64_t metadata_size, 87 const uint32_t metadata_signature_size, 88 const uint64_t signatures_offset, 89 brillo::Blob* out_signature_blob); 90 91 // Returns the length of out_signature_blob that will result in a call 92 // to SignPayload with the given private keys. Returns true on success. 93 static bool SignatureBlobLength( 94 const std::vector<std::string>& private_key_paths, 95 uint64_t* out_length); 96 97 // Given an unsigned payload in |payload_path|, 98 // this method does two things: 99 // 1. It loads the payload into memory, and inserts placeholder signature 100 // operations and placeholder metadata signature to make the header and 101 // the manifest match what the final signed payload will look like based 102 // on |signatures_sizes|, if needed. 103 // 2. It calculates the raw SHA256 hash of the payload and the metadata in 104 // |payload_path| (except signatures) and returns the result in 105 // |out_hash_data| and |out_metadata_hash| respectively. 106 // 107 // The changes to payload are not preserved or written to disk. 108 static bool HashPayloadForSigning(const std::string& payload_path, 109 const std::vector<int>& signature_sizes, 110 brillo::Blob* out_payload_hash_data, 111 brillo::Blob* out_metadata_hash); 112 113 // Given an unsigned payload in |payload_path| (with no dummy signature op) 114 // and the raw |payload_signatures| and |metadata_signatures| updates the 115 // payload to include the signature thus turning it into a signed payload. The 116 // new payload is stored in |signed_payload_path|. |payload_path| and 117 // |signed_payload_path| can point to the same file. Populates 118 // |out_metadata_size| with the size of the metadata after adding the 119 // signature operation in the manifest. Returns true on success, false 120 // otherwise. 121 static bool AddSignatureToPayload( 122 const std::string& payload_path, 123 const std::vector<brillo::Blob>& payload_signatures, 124 const std::vector<brillo::Blob>& metadata_signatures, 125 const std::string& signed_payload_path, 126 uint64_t* out_metadata_size); 127 128 // Computes the SHA256 hash of the first metadata_size bytes of |metadata| 129 // and signs the hash with the given private_key_path and writes the signed 130 // hash in |out_signature|. Returns true if successful or false if there was 131 // any error in the computations. 132 static bool GetMetadataSignature(const void* const metadata, 133 size_t metadata_size, 134 const std::string& private_key_path, 135 std::string* out_signature); 136 137 static bool ExtractPayloadProperties(const std::string& payload_path, 138 brillo::KeyValueStore* properties); 139 140 private: 141 // This should never be constructed 142 DISALLOW_IMPLICIT_CONSTRUCTORS(PayloadSigner); 143 }; 144 145 } // namespace chromeos_update_engine 146 147 #endif // UPDATE_ENGINE_PAYLOAD_GENERATOR_PAYLOAD_SIGNER_H_ 148