summaryrefslogtreecommitdiffstats
path: root/install.cpp
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--install.cpp269
1 files changed, 225 insertions, 44 deletions
diff --git a/install.cpp b/install.cpp
index 427bea1a7..83ddc4b0c 100644
--- a/install.cpp
+++ b/install.cpp
@@ -17,6 +17,7 @@
#include <ctype.h>
#include <errno.h>
#include <fcntl.h>
+#include <inttypes.h>
#include <limits.h>
#include <string.h>
#include <sys/stat.h>
@@ -24,6 +25,8 @@
#include <unistd.h>
#include <chrono>
+#include <limits>
+#include <map>
#include <string>
#include <vector>
@@ -32,6 +35,8 @@
#include <android-base/parseint.h>
#include <android-base/stringprintf.h>
#include <android-base/strings.h>
+#include <cutils/properties.h>
+#include <android-base/logging.h>
#include "common.h"
#include "error_code.h"
@@ -46,6 +51,8 @@
extern RecoveryUI* ui;
#define ASSUMED_UPDATE_BINARY_NAME "META-INF/com/google/android/update-binary"
+static constexpr const char* AB_OTA_PAYLOAD_PROPERTIES = "payload_properties.txt";
+static constexpr const char* AB_OTA_PAYLOAD = "payload.bin";
#define PUBLIC_KEYS_FILE "/res/keys"
static constexpr const char* METADATA_PATH = "META-INF/com/android/metadata";
static constexpr const char* UNCRYPT_STATUS = "/cache/recovery/uncrypt_status";
@@ -71,20 +78,27 @@ static int parse_build_number(const std::string& str) {
return -1;
}
-// Read the build.version.incremental of src/tgt from the metadata and log it to last_install.
-static void read_source_target_build(ZipArchive* zip, std::vector<std::string>& log_buffer) {
+bool read_metadata_from_package(ZipArchive* zip, std::string* meta_data) {
const ZipEntry* meta_entry = mzFindZipEntry(zip, METADATA_PATH);
if (meta_entry == nullptr) {
LOG(ERROR) << "Failed to find " << METADATA_PATH << " in update package";
- return;
+ return false;
}
- std::string meta_data(meta_entry->uncompLen, '\0');
- if (!mzReadZipEntry(zip, meta_entry, &meta_data[0], meta_entry->uncompLen)) {
+ meta_data->resize(meta_entry->uncompLen, '\0');
+ if (!mzReadZipEntry(zip, meta_entry, &(*meta_data)[0], meta_entry->uncompLen)) {
LOG(ERROR) << "Failed to read metadata in update package";
- return;
+ return false;
}
+ return true;
+}
+// Read the build.version.incremental of src/tgt from the metadata and log it to last_install.
+static void read_source_target_build(ZipArchive* zip, std::vector<std::string>& log_buffer) {
+ std::string meta_data;
+ if (!read_metadata_from_package(zip, &meta_data)) {
+ return;
+ }
// Examples of the pre-build and post-build strings in metadata:
// pre-build-incremental=2943039
// post-build-incremental=2951741
@@ -107,17 +121,148 @@ static void read_source_target_build(ZipArchive* zip, std::vector<std::string>&
}
}
-// If the package contains an update binary, extract it and run it.
+// Extract the update binary from the open zip archive |zip| located at |path|
+// and store into |cmd| the command line that should be called. The |status_fd|
+// is the file descriptor the child process should use to report back the
+// progress of the update.
static int
-try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache,
- std::vector<std::string>& log_buffer, int retry_count)
+update_binary_command(const char* path, ZipArchive* zip, int retry_count,
+ int status_fd, std::vector<std::string>* cmd);
+
+#ifdef AB_OTA_UPDATER
+
+// Parses the metadata of the OTA package in |zip| and checks whether we are
+// allowed to accept this A/B package. Downgrading is not allowed unless
+// explicitly enabled in the package and only for incremental packages.
+static int check_newer_ab_build(ZipArchive* zip)
{
- read_source_target_build(zip, log_buffer);
+ std::string metadata_str;
+ if (!read_metadata_from_package(zip, &metadata_str)) {
+ return INSTALL_CORRUPT;
+ }
+ std::map<std::string, std::string> metadata;
+ for (const std::string& line : android::base::Split(metadata_str, "\n")) {
+ size_t eq = line.find('=');
+ if (eq != std::string::npos) {
+ metadata[line.substr(0, eq)] = line.substr(eq + 1);
+ }
+ }
+ char value[PROPERTY_VALUE_MAX];
+
+ property_get("ro.product.device", value, "");
+ const std::string& pkg_device = metadata["pre-device"];
+ if (pkg_device != value || pkg_device.empty()) {
+ LOG(ERROR) << "Package is for product " << pkg_device << " but expected " << value;
+ return INSTALL_ERROR;
+ }
+
+ // We allow the package to not have any serialno, but if it has a non-empty
+ // value it should match.
+ property_get("ro.serialno", value, "");
+ const std::string& pkg_serial_no = metadata["serialno"];
+ if (!pkg_serial_no.empty() && pkg_serial_no != value) {
+ LOG(ERROR) << "Package is for serial " << pkg_serial_no;
+ return INSTALL_ERROR;
+ }
+
+ if (metadata["ota-type"] != "AB") {
+ LOG(ERROR) << "Package is not A/B";
+ return INSTALL_ERROR;
+ }
+
+ // Incremental updates should match the current build.
+ property_get("ro.build.version.incremental", value, "");
+ const std::string& pkg_pre_build = metadata["pre-build-incremental"];
+ if (!pkg_pre_build.empty() && pkg_pre_build != value) {
+ LOG(ERROR) << "Package is for source build " << pkg_pre_build << " but expected " << value;
+ return INSTALL_ERROR;
+ }
+ property_get("ro.build.fingerprint", value, "");
+ const std::string& pkg_pre_build_fingerprint = metadata["pre-build"];
+ if (!pkg_pre_build_fingerprint.empty() &&
+ pkg_pre_build_fingerprint != value) {
+ LOG(ERROR) << "Package is for source build " << pkg_pre_build_fingerprint
+ << " but expected " << value;
+ return INSTALL_ERROR;
+ }
+
+ // Check for downgrade version.
+ int64_t build_timestamp = property_get_int64(
+ "ro.build.date.utc", std::numeric_limits<int64_t>::max());
+ int64_t pkg_post_timestamp = 0;
+ // We allow to full update to the same version we are running, in case there
+ // is a problem with the current copy of that version.
+ if (metadata["post-timestamp"].empty() ||
+ !android::base::ParseInt(metadata["post-timestamp"].c_str(),
+ &pkg_post_timestamp) ||
+ pkg_post_timestamp < build_timestamp) {
+ if (metadata["ota-downgrade"] != "yes") {
+ LOG(ERROR) << "Update package is older than the current build, expected a build "
+ "newer than timestamp " << build_timestamp << " but package has "
+ "timestamp " << pkg_post_timestamp << " and downgrade not allowed.";
+ return INSTALL_ERROR;
+ }
+ if (pkg_pre_build_fingerprint.empty()) {
+ LOG(ERROR) << "Downgrade package must have a pre-build version set, not allowed.";
+ return INSTALL_ERROR;
+ }
+ }
+
+ return 0;
+}
+
+static int
+update_binary_command(const char* path, ZipArchive* zip, int retry_count,
+ int status_fd, std::vector<std::string>* cmd)
+{
+ int ret = check_newer_ab_build(zip);
+ if (ret) {
+ return ret;
+ }
+
+ // For A/B updates we extract the payload properties to a buffer and obtain
+ // the RAW payload offset in the zip file.
+ const ZipEntry* properties_entry =
+ mzFindZipEntry(zip, AB_OTA_PAYLOAD_PROPERTIES);
+ if (!properties_entry) {
+ LOG(ERROR) << "Can't find " << AB_OTA_PAYLOAD_PROPERTIES;
+ return INSTALL_CORRUPT;
+ }
+ std::vector<unsigned char> payload_properties(
+ mzGetZipEntryUncompLen(properties_entry));
+ if (!mzExtractZipEntryToBuffer(zip, properties_entry,
+ payload_properties.data())) {
+ LOG(ERROR) << "Can't extract " << AB_OTA_PAYLOAD_PROPERTIES;
+ return INSTALL_CORRUPT;
+ }
+
+ const ZipEntry* payload_entry = mzFindZipEntry(zip, AB_OTA_PAYLOAD);
+ if (!payload_entry) {
+ LOG(ERROR) << "Can't find " << AB_OTA_PAYLOAD;
+ return INSTALL_CORRUPT;
+ }
+ long payload_offset = mzGetZipEntryOffset(payload_entry);
+ *cmd = {
+ "/sbin/update_engine_sideload",
+ android::base::StringPrintf("--payload=file://%s", path),
+ android::base::StringPrintf("--offset=%ld", payload_offset),
+ "--headers=" + std::string(payload_properties.begin(),
+ payload_properties.end()),
+ android::base::StringPrintf("--status_fd=%d", status_fd),
+ };
+ return 0;
+}
+
+#else // !AB_OTA_UPDATER
+static int
+update_binary_command(const char* path, ZipArchive* zip, int retry_count,
+ int status_fd, std::vector<std::string>* cmd)
+{
+ // On traditional updates we extract the update binary from the package.
const ZipEntry* binary_entry =
mzFindZipEntry(zip, ASSUMED_UPDATE_BINARY_NAME);
if (binary_entry == NULL) {
- mzCloseZipArchive(zip);
return INSTALL_CORRUPT;
}
@@ -126,21 +271,47 @@ try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache,
int fd = creat(binary, 0755);
if (fd < 0) {
PLOG(ERROR) << "Can't make " << binary;
- mzCloseZipArchive(zip);
return INSTALL_ERROR;
}
bool ok = mzExtractZipEntryToFile(zip, binary_entry, fd);
close(fd);
- mzCloseZipArchive(zip);
if (!ok) {
LOG(ERROR) << "Can't copy " << ASSUMED_UPDATE_BINARY_NAME;
return INSTALL_ERROR;
}
+ *cmd = {
+ binary,
+ EXPAND(RECOVERY_API_VERSION), // defined in Android.mk
+ std::to_string(status_fd),
+ path,
+ };
+ if (retry_count > 0)
+ cmd->push_back("retry");
+ return 0;
+}
+#endif // !AB_OTA_UPDATER
+
+// If the package contains an update binary, extract it and run it.
+static int
+try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache,
+ std::vector<std::string>& log_buffer, int retry_count)
+{
+ read_source_target_build(zip, log_buffer);
+
int pipefd[2];
pipe(pipefd);
+ std::vector<std::string> args;
+ int ret = update_binary_command(path, zip, retry_count, pipefd[1], &args);
+ mzCloseZipArchive(zip);
+ if (ret) {
+ close(pipefd[0]);
+ close(pipefd[1]);
+ return ret;
+ }
+
// When executing the update binary contained in the package, the
// arguments passed are:
//
@@ -190,22 +361,27 @@ try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache,
// update attempt.
//
- const char* args[6];
- args[0] = binary;
- args[1] = EXPAND(RECOVERY_API_VERSION); // defined in Android.mk
- char temp[16];
- snprintf(temp, sizeof(temp), "%d", pipefd[1]);
- args[2] = temp;
- args[3] = path;
- args[4] = retry_count > 0 ? "retry" : NULL;
- args[5] = NULL;
+ // Convert the vector to a NULL-terminated char* array suitable for execv.
+ const char* chr_args[args.size() + 1];
+ chr_args[args.size()] = NULL;
+ for (size_t i = 0; i < args.size(); i++) {
+ chr_args[i] = args[i].c_str();
+ }
pid_t pid = fork();
+
+ if (pid == -1) {
+ close(pipefd[0]);
+ close(pipefd[1]);
+ PLOG(ERROR) << "Failed to fork update binary";
+ return INSTALL_ERROR;
+ }
+
if (pid == 0) {
umask(022);
close(pipefd[0]);
- execv(binary, const_cast<char**>(args));
- fprintf(stdout, "E:Can't run %s (%s)\n", binary, strerror(errno));
+ execv(chr_args[0], const_cast<char**>(chr_args));
+ fprintf(stdout, "E:Can't run %s (%s)\n", chr_args[0], strerror(errno));
_exit(-1);
}
close(pipefd[1]);
@@ -301,33 +477,16 @@ really_install_package(const char *path, bool* wipe_cache, bool needs_mount,
return INSTALL_CORRUPT;
}
- // Load keys.
- std::vector<Certificate> loadedKeys;
- if (!load_keys(PUBLIC_KEYS_FILE, loadedKeys)) {
- LOG(ERROR) << "Failed to load keys";
- sysReleaseMap(&map);
- return INSTALL_CORRUPT;
- }
- LOG(INFO) << loadedKeys.size() << " key(s) loaded from " << PUBLIC_KEYS_FILE;
-
// Verify package.
- ui->Print("Verifying update package...\n");
-
- auto t0 = std::chrono::system_clock::now();
- int err = verify_file(map.addr, map.length, loadedKeys);
- std::chrono::duration<double> duration = std::chrono::system_clock::now() - t0;
- ui->Print("Update package verification took %.1f s (result %d).\n", duration.count(), err);
- if (err != VERIFY_SUCCESS) {
- LOG(ERROR) << "signature verification failed";
+ if (!verify_package(map.addr, map.length)) {
log_buffer.push_back(android::base::StringPrintf("error: %d", kZipVerificationFailure));
-
sysReleaseMap(&map);
return INSTALL_CORRUPT;
}
// Try to open the package.
ZipArchive zip;
- err = mzOpenZipArchive(map.addr, map.length, &zip);
+ int err = mzOpenZipArchive(map.addr, map.length, &zip);
if (err != 0) {
LOG(ERROR) << "Can't open " << path;
log_buffer.push_back(android::base::StringPrintf("error: %d", kZipOpenFailure));
@@ -377,7 +536,7 @@ install_package(const char* path, bool* wipe_cache, const char* install_file,
std::string uncrypt_status;
if (!android::base::ReadFileToString(UNCRYPT_STATUS, &uncrypt_status)) {
PLOG(WARNING) << "failed to read uncrypt status";
- } else if (!android::base::StartsWith(uncrypt_status, "uncrypt_:")) {
+ } else if (!android::base::StartsWith(uncrypt_status, "uncrypt_")) {
PLOG(WARNING) << "corrupted uncrypt_status: " << uncrypt_status;
} else {
log_buffer.push_back(android::base::Trim(uncrypt_status));
@@ -402,3 +561,25 @@ install_package(const char* path, bool* wipe_cache, const char* install_file,
return result;
}
+
+bool verify_package(const unsigned char* package_data, size_t package_size) {
+ std::vector<Certificate> loadedKeys;
+ if (!load_keys(PUBLIC_KEYS_FILE, loadedKeys)) {
+ LOG(ERROR) << "Failed to load keys";
+ return false;
+ }
+ LOG(INFO) << loadedKeys.size() << " key(s) loaded from " << PUBLIC_KEYS_FILE;
+
+ // Verify package.
+ ui->Print("Verifying update package...\n");
+ auto t0 = std::chrono::system_clock::now();
+ int err = verify_file(const_cast<unsigned char*>(package_data), package_size, loadedKeys);
+ std::chrono::duration<double> duration = std::chrono::system_clock::now() - t0;
+ ui->Print("Update package verification took %.1f s (result %d).\n", duration.count(), err);
+ if (err != VERIFY_SUCCESS) {
+ LOG(ERROR) << "Signature verification failed";
+ LOG(ERROR) << "error: " << kZipVerificationFailure;
+ return false;
+ }
+ return true;
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-30 20:00:11 +0100