1 //
2 // Copyright (C) 2018 The Android Open Source Project
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 //
16 
17 #ifndef UPDATE_ENGINE_PAYLOAD_CONSUMER_PAYLOAD_METADATA_H_
18 #define UPDATE_ENGINE_PAYLOAD_CONSUMER_PAYLOAD_METADATA_H_
19 
20 #include <inttypes.h>
21 
22 #include <string>
23 #include <vector>
24 
25 #include <base/macros.h>
26 #include <brillo/secure_blob.h>
27 
28 #include "update_engine/common/error_code.h"
29 #include "update_engine/payload_consumer/payload_verifier.h"
30 #include "update_engine/update_metadata.pb.h"
31 
32 namespace chromeos_update_engine {
33 
34 enum class MetadataParseResult {
35   kSuccess,
36   kError,
37   kInsufficientData,
38 };
39 
40 // This class parses payload metadata and validate its signature.
41 class PayloadMetadata {
42  public:
43   static const uint64_t kDeltaVersionOffset;
44   static const uint64_t kDeltaVersionSize;
45   static const uint64_t kDeltaManifestSizeOffset;
46   static const uint64_t kDeltaManifestSizeSize;
47   static const uint64_t kDeltaMetadataSignatureSizeSize;
48 
49   PayloadMetadata() = default;
50 
51   // Attempts to parse the update payload header starting from the beginning of
52   // |payload|. On success, returns kMetadataParseSuccess. Returns
53   // kMetadataParseInsufficientData if more data is needed to parse the complete
54   // metadata. Returns kMetadataParseError if the metadata can't be parsed given
55   // the payload.
56   MetadataParseResult ParsePayloadHeader(const brillo::Blob& payload,
57                                          ErrorCode* error);
58   MetadataParseResult ParsePayloadHeader(const unsigned char* payload,
59                                          size_t size,
60                                          ErrorCode* error);
61   // Simpler version of the above, returns true on success.
62   bool ParsePayloadHeader(const brillo::Blob& payload);
63 
64   // Given the |payload|, verifies that the signed hash of its metadata matches
65   // |metadata_signature| (if present) or the metadata signature in payload
66   // itself (if present). Returns ErrorCode::kSuccess on match or a suitable
67   // error code otherwise. This method must be called before any part of the
68   // metadata is parsed so that an on-path attack on the SSL connection
69   // to the payload server doesn't exploit any vulnerability in the code that
70   // parses the protocol buffer.
71   ErrorCode ValidateMetadataSignature(
72       const brillo::Blob& payload,
73       const std::string& metadata_signature,
74       const PayloadVerifier& payload_verifier) const;
75 
76   // Returns the major payload version. If the version was not yet parsed,
77   // returns zero.
GetMajorVersion()78   uint64_t GetMajorVersion() const { return major_payload_version_; }
79 
80   // Returns the size of the payload metadata, which includes the payload header
81   // and the manifest. If the header was not yet parsed, returns zero.
GetMetadataSize()82   uint64_t GetMetadataSize() const { return metadata_size_; }
83 
84   // Returns the size of the payload metadata signature. If the header was not
85   // yet parsed, returns zero.
GetMetadataSignatureSize()86   uint32_t GetMetadataSignatureSize() const { return metadata_signature_size_; }
87 
88   // Set |*out_manifest| to the manifest in |payload|.
89   // Returns true on success.
90   bool GetManifest(const brillo::Blob& payload,
91                    DeltaArchiveManifest* out_manifest) const;
92 
93   bool GetManifest(const unsigned char* payload,
94                    size_t size,
95                    DeltaArchiveManifest* out_manifest) const;
96 
97   // Parses a payload file |payload_path| and prepares the metadata properties,
98   // manifest and metadata signatures. Can be used as an easy to use utility to
99   // get the payload information without manually the process.
100   bool ParsePayloadFile(const std::string& payload_path,
101                         DeltaArchiveManifest* manifest,
102                         Signatures* metadata_signatures);
103 
104  private:
105   // Returns the byte offset at which the manifest protobuf begins in a payload.
106   uint64_t GetManifestOffset() const;
107 
108   // Returns the byte offset where the size of the metadata signature is stored
109   // in a payload.
110   uint64_t GetMetadataSignatureSizeOffset() const;
111 
112   uint64_t metadata_size_{0};
113   uint64_t manifest_size_{0};
114   uint32_t metadata_signature_size_{0};
115   uint64_t major_payload_version_{0};
116 
117   DISALLOW_COPY_AND_ASSIGN(PayloadMetadata);
118 };
119 
120 }  // namespace chromeos_update_engine
121 
122 #endif  // UPDATE_ENGINE_PAYLOAD_CONSUMER_PAYLOAD_METADATA_H_
123