From 6faf0265c9b58db2c15b53f6d29025629d52f882 Mon Sep 17 00:00:00 2001 From: Yabin Cui Date: Thu, 9 Jun 2016 14:09:39 -0700 Subject: Verify wipe package when wiping A/B device in recovery. To increase the security of wiping A/B devices, let uncrypt write wipe package in misc partition. Then recovery verifies the wipe package before wiping the device. Bug: 29159185 Change-Id: I186691bab1928d3dc036bc5542abd64a81bc2168 --- install.cpp | 60 +++++++++++++++++++++++++++++++++++++----------------------- 1 file changed, 37 insertions(+), 23 deletions(-) (limited to 'install.cpp') diff --git a/install.cpp b/install.cpp index 5a439a1d6..518337fef 100644 --- a/install.cpp +++ b/install.cpp @@ -70,20 +70,27 @@ static int parse_build_number(std::string str) { return -1; } -// Read the build.version.incremental of src/tgt from the metadata and log it to last_install. -static void read_source_target_build(ZipArchive* zip, std::vector& log_buffer) { +bool read_metadata_from_package(ZipArchive* zip, std::string* meta_data) { const ZipEntry* meta_entry = mzFindZipEntry(zip, METADATA_PATH); if (meta_entry == nullptr) { LOGE("Failed to find %s in update package.\n", METADATA_PATH); - return; + return false; } - std::string meta_data(meta_entry->uncompLen, '\0'); - if (!mzReadZipEntry(zip, meta_entry, &meta_data[0], meta_entry->uncompLen)) { + meta_data->resize(meta_entry->uncompLen, '\0'); + if (!mzReadZipEntry(zip, meta_entry, &(*meta_data)[0], meta_entry->uncompLen)) { LOGE("Failed to read metadata in update package.\n"); - return; + return false; } + return true; +} +// Read the build.version.incremental of src/tgt from the metadata and log it to last_install. +static void read_source_target_build(ZipArchive* zip, std::vector& log_buffer) { + std::string meta_data; + if (!read_metadata_from_package(zip, &meta_data)) { + return; + } // Examples of the pre-build and post-build strings in metadata: // pre-build-incremental=2943039 // post-build-incremental=2951741 @@ -300,31 +307,16 @@ really_install_package(const char *path, bool* wipe_cache, bool needs_mount, return INSTALL_CORRUPT; } - // Load keys. - std::vector loadedKeys; - if (!load_keys(PUBLIC_KEYS_FILE, loadedKeys)) { - LOGE("Failed to load keys\n"); - return INSTALL_CORRUPT; - } - LOGI("%zu key(s) loaded from %s\n", loadedKeys.size(), PUBLIC_KEYS_FILE); - // Verify package. - ui->Print("Verifying update package...\n"); - auto t0 = std::chrono::system_clock::now(); - int err = verify_file(map.addr, map.length, loadedKeys); - std::chrono::duration duration = std::chrono::system_clock::now() - t0; - ui->Print("Update package verification took %.1f s (result %d).\n", duration.count(), err); - if (err != VERIFY_SUCCESS) { - LOGE("signature verification failed\n"); + if (!verify_package(map.addr, map.length)) { log_buffer.push_back(android::base::StringPrintf("error: %d", kZipVerificationFailure)); - sysReleaseMap(&map); return INSTALL_CORRUPT; } // Try to open the package. ZipArchive zip; - err = mzOpenZipArchive(map.addr, map.length, &zip); + int err = mzOpenZipArchive(map.addr, map.length, &zip); if (err != 0) { LOGE("Can't open %s\n(%s)\n", path, err != -1 ? strerror(err) : "bad"); log_buffer.push_back(android::base::StringPrintf("error: %d", kZipOpenFailure)); @@ -387,3 +379,25 @@ install_package(const char* path, bool* wipe_cache, const char* install_file, } return result; } + +bool verify_package(const unsigned char* package_data, size_t package_size) { + std::vector loadedKeys; + if (!load_keys(PUBLIC_KEYS_FILE, loadedKeys)) { + LOGE("Failed to load keys\n"); + return false; + } + LOGI("%zu key(s) loaded from %s\n", loadedKeys.size(), PUBLIC_KEYS_FILE); + + // Verify package. + ui->Print("Verifying update package...\n"); + auto t0 = std::chrono::system_clock::now(); + int err = verify_file(const_cast(package_data), package_size, loadedKeys); + std::chrono::duration duration = std::chrono::system_clock::now() - t0; + ui->Print("Update package verification took %.1f s (result %d).\n", duration.count(), err); + if (err != VERIFY_SUCCESS) { + LOGE("Signature verification failed\n"); + LOGE("error: %d\n", kZipVerificationFailure); + return false; + } + return true; +} -- cgit v1.2.3 From 4344d636d4f8687054593f88ddd7509ff8581419 Mon Sep 17 00:00:00 2001 From: Alex Deymo Date: Wed, 3 Aug 2016 21:03:53 -0700 Subject: Call update_engine_sideload from recovery. This patch enables sideloading an OTA on A/B devices while running from recovery. Recovery accepts the same OTA package format as recent versions of GMS, which consists of .zip file with the payload in it. Bug: 27178350 TEST=`adb sideload` successfully a full OTA (*) TEST=Failed to take several invalid payloads (wrong product, fingerprint, update type, serial, etc). (*) with no postinstall script. Change-Id: I951869340100feb5a37e41fac0ee59c10095659e --- install.cpp | 199 ++++++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 181 insertions(+), 18 deletions(-) (limited to 'install.cpp') diff --git a/install.cpp b/install.cpp index 518337fef..cde9cbafd 100644 --- a/install.cpp +++ b/install.cpp @@ -24,12 +24,15 @@ #include #include +#include +#include #include #include #include #include #include +#include #include "common.h" #include "error_code.h" @@ -46,6 +49,8 @@ extern RecoveryUI* ui; #define ASSUMED_UPDATE_BINARY_NAME "META-INF/com/google/android/update-binary" +static constexpr const char* AB_OTA_PAYLOAD_PROPERTIES = "payload_properties.txt"; +static constexpr const char* AB_OTA_PAYLOAD = "payload.bin"; #define PUBLIC_KEYS_FILE "/res/keys" static constexpr const char* METADATA_PATH = "META-INF/com/android/metadata"; @@ -113,17 +118,152 @@ static void read_source_target_build(ZipArchive* zip, std::vector& } } -// If the package contains an update binary, extract it and run it. +// Extract the update binary from the open zip archive |zip| located at |path| +// and store into |cmd| the command line that should be called. The |status_fd| +// is the file descriptor the child process should use to report back the +// progress of the update. static int -try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, - std::vector& log_buffer, int retry_count) +update_binary_command(const char* path, ZipArchive* zip, int retry_count, + int status_fd, std::vector* cmd); + +#ifdef AB_OTA_UPDATER + +// Parses the metadata of the OTA package in |zip| and checks whether we are +// allowed to accept this A/B package. Downgrading is not allowed unless +// explicitly enabled in the package and only for incremental packages. +static int check_newer_ab_build(ZipArchive* zip) { - read_source_target_build(zip, log_buffer); + std::string metadata_str; + if (!read_metadata_from_package(zip, &metadata_str)) { + return INSTALL_CORRUPT; + } + std::map metadata; + for (const std::string& line : android::base::Split(metadata_str, "\n")) { + size_t eq = line.find('='); + if (eq != std::string::npos) { + metadata[line.substr(0, eq)] = line.substr(eq + 1); + } + } + char value[PROPERTY_VALUE_MAX]; + + property_get("ro.product.device", value, ""); + const std::string& pkg_device = metadata["pre-device"]; + if (pkg_device != value || pkg_device.empty()) { + LOGE("Package is for product %s but expected %s\n", + pkg_device.c_str(), value); + return INSTALL_ERROR; + } + + // We allow the package to not have any serialno, but if it has a non-empty + // value it should match. + property_get("ro.serialno", value, ""); + const std::string& pkg_serial_no = metadata["serialno"]; + if (!pkg_serial_no.empty() && pkg_serial_no != value) { + LOGE("Package is for serial %s\n", pkg_serial_no.c_str()); + return INSTALL_ERROR; + } + if (metadata["ota-type"] != "AB") { + LOGE("Package is not A/B\n"); + return INSTALL_ERROR; + } + + // Incremental updates should match the current build. + property_get("ro.build.version.incremental", value, ""); + const std::string& pkg_pre_build = metadata["pre-build-incremental"]; + if (!pkg_pre_build.empty() && pkg_pre_build != value) { + LOGE("Package is for source build %s but expected %s\n", + pkg_pre_build.c_str(), value); + return INSTALL_ERROR; + } + property_get("ro.build.fingerprint", value, ""); + const std::string& pkg_pre_build_fingerprint = metadata["pre-build"]; + if (!pkg_pre_build_fingerprint.empty() && + pkg_pre_build_fingerprint != value) { + LOGE("Package is for source build %s but expected %s\n", + pkg_pre_build_fingerprint.c_str(), value); + return INSTALL_ERROR; + } + + // Check for downgrade version. + int64_t build_timestampt = property_get_int64( + "ro.build.date.utc", std::numeric_limits::max()); + int64_t pkg_post_timespampt = 0; + // We allow to full update to the same version we are running, in case there + // is a problem with the current copy of that version. + if (metadata["post-timestamp"].empty() || + !android::base::ParseInt(metadata["post-timestamp"].c_str(), + &pkg_post_timespampt) || + pkg_post_timespampt < build_timestampt) { + if (metadata["ota-downgrade"] != "yes") { + LOGE("Update package is older than the current build, expected a " + "build newer than timestamp %" PRIu64 " but package has " + "timestamp %" PRIu64 " and downgrade not allowed.\n", + build_timestampt, pkg_post_timespampt); + return INSTALL_ERROR; + } + if (pkg_pre_build_fingerprint.empty()) { + LOGE("Downgrade package must have a pre-build version set, not " + "allowed.\n"); + return INSTALL_ERROR; + } + } + + return 0; +} + +static int +update_binary_command(const char* path, ZipArchive* zip, int retry_count, + int status_fd, std::vector* cmd) +{ + int ret = check_newer_ab_build(zip); + if (ret) { + return ret; + } + + // For A/B updates we extract the payload properties to a buffer and obtain + // the RAW payload offset in the zip file. + const ZipEntry* properties_entry = + mzFindZipEntry(zip, AB_OTA_PAYLOAD_PROPERTIES); + if (!properties_entry) { + LOGE("Can't find %s\n", AB_OTA_PAYLOAD_PROPERTIES); + return INSTALL_CORRUPT; + } + std::vector payload_properties( + mzGetZipEntryUncompLen(properties_entry)); + if (!mzExtractZipEntryToBuffer(zip, properties_entry, + payload_properties.data())) { + LOGE("Can't extract %s\n", AB_OTA_PAYLOAD_PROPERTIES); + return INSTALL_CORRUPT; + } + + const ZipEntry* payload_entry = mzFindZipEntry(zip, AB_OTA_PAYLOAD); + if (!payload_entry) { + LOGE("Can't find %s\n", AB_OTA_PAYLOAD); + return INSTALL_CORRUPT; + } + long payload_offset = mzGetZipEntryOffset(payload_entry); + *cmd = { + "/sbin/update_engine_sideload", + android::base::StringPrintf("--payload=file://%s", path), + android::base::StringPrintf("--offset=%ld", payload_offset), + "--headers=" + std::string(payload_properties.begin(), + payload_properties.end()), + android::base::StringPrintf("--status_fd=%d", status_fd), + }; + return 0; +} + +#else // !AB_OTA_UPDATER + +static int +update_binary_command(const char* path, ZipArchive* zip, int retry_count, + int status_fd, std::vector* cmd) +{ + // On traditional updates we extract the update binary from the package. const ZipEntry* binary_entry = mzFindZipEntry(zip, ASSUMED_UPDATE_BINARY_NAME); if (binary_entry == NULL) { - mzCloseZipArchive(zip); return INSTALL_CORRUPT; } @@ -131,22 +271,48 @@ try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, unlink(binary); int fd = creat(binary, 0755); if (fd < 0) { - mzCloseZipArchive(zip); LOGE("Can't make %s\n", binary); return INSTALL_ERROR; } bool ok = mzExtractZipEntryToFile(zip, binary_entry, fd); close(fd); - mzCloseZipArchive(zip); if (!ok) { LOGE("Can't copy %s\n", ASSUMED_UPDATE_BINARY_NAME); return INSTALL_ERROR; } + *cmd = { + binary, + EXPAND(RECOVERY_API_VERSION), // defined in Android.mk + std::to_string(status_fd), + path, + }; + if (retry_count > 0) + cmd->push_back("retry"); + return 0; +} +#endif // !AB_OTA_UPDATER + +// If the package contains an update binary, extract it and run it. +static int +try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, + std::vector& log_buffer, int retry_count) +{ + read_source_target_build(zip, log_buffer); + int pipefd[2]; pipe(pipefd); + std::vector args; + int ret = update_binary_command(path, zip, retry_count, pipefd[1], &args); + mzCloseZipArchive(zip); + if (ret) { + close(pipefd[0]); + close(pipefd[1]); + return ret; + } + // When executing the update binary contained in the package, the // arguments passed are: // @@ -196,22 +362,19 @@ try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, // update attempt. // - const char** args = (const char**)malloc(sizeof(char*) * 6); - args[0] = binary; - args[1] = EXPAND(RECOVERY_API_VERSION); // defined in Android.mk - char* temp = (char*)malloc(10); - sprintf(temp, "%d", pipefd[1]); - args[2] = temp; - args[3] = (char*)path; - args[4] = retry_count > 0 ? "retry" : NULL; - args[5] = NULL; + // Convert the vector to a NULL-terminated char* array suitable for execv. + const char* chr_args[args.size() + 1]; + chr_args[args.size()] = NULL; + for (size_t i = 0; i < args.size(); i++) { + chr_args[i] = args[i].c_str(); + } pid_t pid = fork(); if (pid == 0) { umask(022); close(pipefd[0]); - execv(binary, (char* const*)args); - fprintf(stdout, "E:Can't run %s (%s)\n", binary, strerror(errno)); + execv(chr_args[0], const_cast(chr_args)); + fprintf(stdout, "E:Can't run %s (%s)\n", chr_args[0], strerror(errno)); _exit(-1); } close(pipefd[1]); -- cgit v1.2.3 From 53c107f06836ac3942ec51625038b9756a49f933 Mon Sep 17 00:00:00 2001 From: Alex Deymo Date: Fri, 12 Aug 2016 13:43:04 -0700 Subject: Add inttypes.h for PRIu64. This missing header is needed to use PRIu64 macros. Bug: 27178350 TEST=`mma bootable/recovery` on the failing branch. Change-Id: I165701e8019256426d3f6a4168db52c6a0197c4d --- install.cpp | 1 + 1 file changed, 1 insertion(+) (limited to 'install.cpp') diff --git a/install.cpp b/install.cpp index cde9cbafd..02c845cb8 100644 --- a/install.cpp +++ b/install.cpp @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include -- cgit v1.2.3