diff options
Diffstat (limited to '')
-rw-r--r-- | install.cpp | 258 |
1 files changed, 215 insertions, 43 deletions
diff --git a/install.cpp b/install.cpp index 92a62db5f..4a856cd71 100644 --- a/install.cpp +++ b/install.cpp @@ -17,6 +17,7 @@ #include <ctype.h> #include <errno.h> #include <fcntl.h> +#include <inttypes.h> #include <limits.h> #include <string.h> #include <sys/stat.h> @@ -24,12 +25,15 @@ #include <unistd.h> #include <chrono> +#include <limits> +#include <map> #include <string> #include <vector> #include <android-base/parseint.h> #include <android-base/stringprintf.h> #include <android-base/strings.h> +#include <cutils/properties.h> #include <android-base/logging.h> #include "common.h" @@ -45,6 +49,8 @@ extern RecoveryUI* ui; #define ASSUMED_UPDATE_BINARY_NAME "META-INF/com/google/android/update-binary" +static constexpr const char* AB_OTA_PAYLOAD_PROPERTIES = "payload_properties.txt"; +static constexpr const char* AB_OTA_PAYLOAD = "payload.bin"; #define PUBLIC_KEYS_FILE "/res/keys" static constexpr const char* METADATA_PATH = "META-INF/com/android/metadata"; @@ -69,20 +75,27 @@ static int parse_build_number(const std::string& str) { return -1; } -// Read the build.version.incremental of src/tgt from the metadata and log it to last_install. -static void read_source_target_build(ZipArchive* zip, std::vector<std::string>& log_buffer) { +bool read_metadata_from_package(ZipArchive* zip, std::string* meta_data) { const ZipEntry* meta_entry = mzFindZipEntry(zip, METADATA_PATH); if (meta_entry == nullptr) { LOG(ERROR) << "Failed to find " << METADATA_PATH << " in update package"; - return; + return false; } - std::string meta_data(meta_entry->uncompLen, '\0'); - if (!mzReadZipEntry(zip, meta_entry, &meta_data[0], meta_entry->uncompLen)) { + meta_data->resize(meta_entry->uncompLen, '\0'); + if (!mzReadZipEntry(zip, meta_entry, &(*meta_data)[0], meta_entry->uncompLen)) { LOG(ERROR) << "Failed to read metadata in update package"; - return; + return false; } + return true; +} +// Read the build.version.incremental of src/tgt from the metadata and log it to last_install. +static void read_source_target_build(ZipArchive* zip, std::vector<std::string>& log_buffer) { + std::string meta_data; + if (!read_metadata_from_package(zip, &meta_data)) { + return; + } // Examples of the pre-build and post-build strings in metadata: // pre-build-incremental=2943039 // post-build-incremental=2951741 @@ -105,17 +118,148 @@ static void read_source_target_build(ZipArchive* zip, std::vector<std::string>& } } -// If the package contains an update binary, extract it and run it. +// Extract the update binary from the open zip archive |zip| located at |path| +// and store into |cmd| the command line that should be called. The |status_fd| +// is the file descriptor the child process should use to report back the +// progress of the update. static int -try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, - std::vector<std::string>& log_buffer, int retry_count) +update_binary_command(const char* path, ZipArchive* zip, int retry_count, + int status_fd, std::vector<std::string>* cmd); + +#ifdef AB_OTA_UPDATER + +// Parses the metadata of the OTA package in |zip| and checks whether we are +// allowed to accept this A/B package. Downgrading is not allowed unless +// explicitly enabled in the package and only for incremental packages. +static int check_newer_ab_build(ZipArchive* zip) { - read_source_target_build(zip, log_buffer); + std::string metadata_str; + if (!read_metadata_from_package(zip, &metadata_str)) { + return INSTALL_CORRUPT; + } + std::map<std::string, std::string> metadata; + for (const std::string& line : android::base::Split(metadata_str, "\n")) { + size_t eq = line.find('='); + if (eq != std::string::npos) { + metadata[line.substr(0, eq)] = line.substr(eq + 1); + } + } + char value[PROPERTY_VALUE_MAX]; + + property_get("ro.product.device", value, ""); + const std::string& pkg_device = metadata["pre-device"]; + if (pkg_device != value || pkg_device.empty()) { + LOG(ERROR) << "Package is for product " << pkg_device << " but expected " << value; + return INSTALL_ERROR; + } + + // We allow the package to not have any serialno, but if it has a non-empty + // value it should match. + property_get("ro.serialno", value, ""); + const std::string& pkg_serial_no = metadata["serialno"]; + if (!pkg_serial_no.empty() && pkg_serial_no != value) { + LOG(ERROR) << "Package is for serial " << pkg_serial_no; + return INSTALL_ERROR; + } + + if (metadata["ota-type"] != "AB") { + LOG(ERROR) << "Package is not A/B"; + return INSTALL_ERROR; + } + + // Incremental updates should match the current build. + property_get("ro.build.version.incremental", value, ""); + const std::string& pkg_pre_build = metadata["pre-build-incremental"]; + if (!pkg_pre_build.empty() && pkg_pre_build != value) { + LOG(ERROR) << "Package is for source build " << pkg_pre_build << " but expected " << value; + return INSTALL_ERROR; + } + property_get("ro.build.fingerprint", value, ""); + const std::string& pkg_pre_build_fingerprint = metadata["pre-build"]; + if (!pkg_pre_build_fingerprint.empty() && + pkg_pre_build_fingerprint != value) { + LOG(ERROR) << "Package is for source build " << pkg_pre_build_fingerprint + << " but expected " << value; + return INSTALL_ERROR; + } + + // Check for downgrade version. + int64_t build_timestamp = property_get_int64( + "ro.build.date.utc", std::numeric_limits<int64_t>::max()); + int64_t pkg_post_timestamp = 0; + // We allow to full update to the same version we are running, in case there + // is a problem with the current copy of that version. + if (metadata["post-timestamp"].empty() || + !android::base::ParseInt(metadata["post-timestamp"].c_str(), + &pkg_post_timestamp) || + pkg_post_timestamp < build_timestamp) { + if (metadata["ota-downgrade"] != "yes") { + LOG(ERROR) << "Update package is older than the current build, expected a build " + "newer than timestamp " << build_timestamp << " but package has " + "timestamp " << pkg_post_timestamp << " and downgrade not allowed."; + return INSTALL_ERROR; + } + if (pkg_pre_build_fingerprint.empty()) { + LOG(ERROR) << "Downgrade package must have a pre-build version set, not allowed."; + return INSTALL_ERROR; + } + } + + return 0; +} + +static int +update_binary_command(const char* path, ZipArchive* zip, int retry_count, + int status_fd, std::vector<std::string>* cmd) +{ + int ret = check_newer_ab_build(zip); + if (ret) { + return ret; + } + + // For A/B updates we extract the payload properties to a buffer and obtain + // the RAW payload offset in the zip file. + const ZipEntry* properties_entry = + mzFindZipEntry(zip, AB_OTA_PAYLOAD_PROPERTIES); + if (!properties_entry) { + LOG(ERROR) << "Can't find " << AB_OTA_PAYLOAD_PROPERTIES; + return INSTALL_CORRUPT; + } + std::vector<unsigned char> payload_properties( + mzGetZipEntryUncompLen(properties_entry)); + if (!mzExtractZipEntryToBuffer(zip, properties_entry, + payload_properties.data())) { + LOG(ERROR) << "Can't extract " << AB_OTA_PAYLOAD_PROPERTIES; + return INSTALL_CORRUPT; + } + + const ZipEntry* payload_entry = mzFindZipEntry(zip, AB_OTA_PAYLOAD); + if (!payload_entry) { + LOG(ERROR) << "Can't find " << AB_OTA_PAYLOAD; + return INSTALL_CORRUPT; + } + long payload_offset = mzGetZipEntryOffset(payload_entry); + *cmd = { + "/sbin/update_engine_sideload", + android::base::StringPrintf("--payload=file://%s", path), + android::base::StringPrintf("--offset=%ld", payload_offset), + "--headers=" + std::string(payload_properties.begin(), + payload_properties.end()), + android::base::StringPrintf("--status_fd=%d", status_fd), + }; + return 0; +} +#else // !AB_OTA_UPDATER + +static int +update_binary_command(const char* path, ZipArchive* zip, int retry_count, + int status_fd, std::vector<std::string>* cmd) +{ + // On traditional updates we extract the update binary from the package. const ZipEntry* binary_entry = mzFindZipEntry(zip, ASSUMED_UPDATE_BINARY_NAME); if (binary_entry == NULL) { - mzCloseZipArchive(zip); return INSTALL_CORRUPT; } @@ -124,21 +268,47 @@ try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, int fd = creat(binary, 0755); if (fd < 0) { PLOG(ERROR) << "Can't make " << binary; - mzCloseZipArchive(zip); return INSTALL_ERROR; } bool ok = mzExtractZipEntryToFile(zip, binary_entry, fd); close(fd); - mzCloseZipArchive(zip); if (!ok) { LOG(ERROR) << "Can't copy " << ASSUMED_UPDATE_BINARY_NAME; return INSTALL_ERROR; } + *cmd = { + binary, + EXPAND(RECOVERY_API_VERSION), // defined in Android.mk + std::to_string(status_fd), + path, + }; + if (retry_count > 0) + cmd->push_back("retry"); + return 0; +} +#endif // !AB_OTA_UPDATER + +// If the package contains an update binary, extract it and run it. +static int +try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, + std::vector<std::string>& log_buffer, int retry_count) +{ + read_source_target_build(zip, log_buffer); + int pipefd[2]; pipe(pipefd); + std::vector<std::string> args; + int ret = update_binary_command(path, zip, retry_count, pipefd[1], &args); + mzCloseZipArchive(zip); + if (ret) { + close(pipefd[0]); + close(pipefd[1]); + return ret; + } + // When executing the update binary contained in the package, the // arguments passed are: // @@ -188,22 +358,19 @@ try_update_binary(const char* path, ZipArchive* zip, bool* wipe_cache, // update attempt. // - const char* args[6]; - args[0] = binary; - args[1] = EXPAND(RECOVERY_API_VERSION); // defined in Android.mk - char temp[16]; - snprintf(temp, sizeof(temp), "%d", pipefd[1]); - args[2] = temp; - args[3] = path; - args[4] = retry_count > 0 ? "retry" : NULL; - args[5] = NULL; + // Convert the vector to a NULL-terminated char* array suitable for execv. + const char* chr_args[args.size() + 1]; + chr_args[args.size()] = NULL; + for (size_t i = 0; i < args.size(); i++) { + chr_args[i] = args[i].c_str(); + } pid_t pid = fork(); if (pid == 0) { umask(022); close(pipefd[0]); - execv(binary, const_cast<char**>(args)); - fprintf(stdout, "E:Can't run %s (%s)\n", binary, strerror(errno)); + execv(chr_args[0], const_cast<char**>(chr_args)); + fprintf(stdout, "E:Can't run %s (%s)\n", chr_args[0], strerror(errno)); _exit(-1); } close(pipefd[1]); @@ -299,33 +466,16 @@ really_install_package(const char *path, bool* wipe_cache, bool needs_mount, return INSTALL_CORRUPT; } - // Load keys. - std::vector<Certificate> loadedKeys; - if (!load_keys(PUBLIC_KEYS_FILE, loadedKeys)) { - LOG(ERROR) << "Failed to load keys"; - sysReleaseMap(&map); - return INSTALL_CORRUPT; - } - LOG(INFO) << loadedKeys.size() << " key(s) loaded from " << PUBLIC_KEYS_FILE; - // Verify package. - ui->Print("Verifying update package...\n"); - - auto t0 = std::chrono::system_clock::now(); - int err = verify_file(map.addr, map.length, loadedKeys); - std::chrono::duration<double> duration = std::chrono::system_clock::now() - t0; - ui->Print("Update package verification took %.1f s (result %d).\n", duration.count(), err); - if (err != VERIFY_SUCCESS) { - LOG(ERROR) << "signature verification failed"; + if (!verify_package(map.addr, map.length)) { log_buffer.push_back(android::base::StringPrintf("error: %d", kZipVerificationFailure)); - sysReleaseMap(&map); return INSTALL_CORRUPT; } // Try to open the package. ZipArchive zip; - err = mzOpenZipArchive(map.addr, map.length, &zip); + int err = mzOpenZipArchive(map.addr, map.length, &zip); if (err != 0) { LOG(ERROR) << "Can't open " << path; log_buffer.push_back(android::base::StringPrintf("error: %d", kZipOpenFailure)); @@ -388,3 +538,25 @@ install_package(const char* path, bool* wipe_cache, const char* install_file, } return result; } + +bool verify_package(const unsigned char* package_data, size_t package_size) { + std::vector<Certificate> loadedKeys; + if (!load_keys(PUBLIC_KEYS_FILE, loadedKeys)) { + LOG(ERROR) << "Failed to load keys"; + return false; + } + LOG(INFO) << loadedKeys.size() << " key(s) loaded from " << PUBLIC_KEYS_FILE; + + // Verify package. + ui->Print("Verifying update package...\n"); + auto t0 = std::chrono::system_clock::now(); + int err = verify_file(const_cast<unsigned char*>(package_data), package_size, loadedKeys); + std::chrono::duration<double> duration = std::chrono::system_clock::now() - t0; + ui->Print("Update package verification took %.1f s (result %d).\n", duration.count(), err); + if (err != VERIFY_SUCCESS) { + LOG(ERROR) << "Signature verification failed"; + LOG(ERROR) << "error: " << kZipVerificationFailure; + return false; + } + return true; +} |