This release has a fix to check if a delta file exists before trying to
apply it, and a fix to recover from missing or bad bundle manifest files.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
This addresses #94.
We can't verify that bundles are correct if a bundle manifest we need
is missing or corrupted.
We first check if these files are missing, and download them before
verifying them.
If they are present or have just been downloaded, we can verify the
hash checksum. If this fails to verify, we immediately erase the bad
file and return an error code.
Because the overlying routines properly retries, we'll get back to the
start of this routine again and download the proper bundle manifest
file, completing the recovery.
To support running swupd on distros without an HTTP2-enabled curl
package, explicitly check for the "unsupported protocol" error, returned
by libcurl in this event.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
This release includes a change to configure.ac to support supplying values for
the config files swupd-client uses to figure out the URL and format it needs,
lots of code cleanups, memory leak fixes, segfault fixes in some corner cases,
enabling HTTP2 protocol with HTTP1 fallback, and enabling TLS1.2.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
The only test that is really useful for an OSV is the one that is run first,
which assumes all content passed in is correct. If that fails, the content
must be bad and an update would fail; if that test passes, then we know
at the very least verification and updates would succeed, and the content
is what we expect it to be. The tests performed after use combinations of
invalid inputs, which of course should all fail, and would raise huge red
flags regarding the OpenSSL implementation if they did not - pointing to
regressions or bugs in OpenSSL itself.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
This script checks that a given data file and signature verify correctly against
a certificate. Without introducing fuzzing, this covers all (8) combinations of
valid and invalid files that may occur, and corrupts them in the more often
seen ways, such as a partially downloaded Manifest, or a wrong signature file.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
In some circumstances, files were incorrectly not being installed
during an update.
Currently when a new bundle (A) is added by being included in another
already installed bundle (B) as part of update and bundle A contains a
file (F) not installed in the current version AND B does not include F
in the current version but will include F after the update the file
will erroneously not be installed after the update completes.
The fix for this issue is to check during the manifest link stage of
update if the server and current version contain the same file
(matching hashes and not deleted) but the current version is not
currently tracked (the bundle containing the file isn't installed) to
not create the link between current and server versions. This allows
the tracked server version to be used in consolidate_files instead of
the untracked current version. With the correct version being used,
create_update_list will add the file to the update list because it
will be newer than the current OS version and be added to the
filesystem once the update completes successfully.
Signed-off-by: Brad T. Peters <brad.t.peters@intel.com>
Valgrind shows a few leaks in swupd search which are trivially fixed up
based on inspection of the search.c. Valgrind points at lines 364 and
369 (query_total_download_size() leaks untard file most passes through
a loop) and line 410 (search_main() leaks struct manifest MoM).
Signed-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>
Remaining hits by findstatic.pl are public API functions and
dangling statistic increments (but those last are fixed by the
PR cleaning up the stats, so they can be ignored for this PR).
This is a negligable performance increase and more of a cleanup
of symbol space. In order for these to inline, we need the stats
to be exported instead, so we go from 8+1 exports to 1+1.
Add configuration support for contenturl, versionurl, and formatid.
The order or preference for state config options is now:
1. swupd cmdline: -u or -v options passed to the specific command
2. ./configure: --with-contenturl=, --with-versionurl=, or --with-formatid=
3. Fall back to the defaults provided in /usr/share/defaults/swupd
While adding these new configure options, this patch also adds a report
out from the configure script, showing selected options
Signed-off-by: Brad T. Peters <brad.t.peters@intel.com>
Fix double-free which happens when loading a key fails. This patch
ensures fp_pubkey cleanup only happens in terminate_signature().
Signed-off-by: Brad T. Peters <brad.t.peters@intel.com>
Because libcurl has many different error codes, referring the end user
to curl.h is not ideal for the errors swupd does not handle explicitly.
Instead, call curl_easy_strerror() to print a generic error string as
indicated by the error code.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
X509_STORE_CTX_free() is being called in the "verify success" path, but
not in the error path.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
The X509_STORE_free() function is called in terminate_signature()
already, so avoid the double frees from calling it twice. Also,
X509_LOOKUP_free() is already called by X509_STORE_free(), so it must
not be called here.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Since signature initialization occurs in swupd_init(), use the same
convention as other init steps by defining/using a special error code.
As a side effect, the return value type is fixed (int vs bool) for the
signature init failure case.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
In the case when trying to remove the non existing bundle
first warn about that fact, then fail with an error.
Signed-off-by: Jaime A. Garcia <jaime.garcia.naranjo@intel.com>
We've had some issues where bundle manifest hashes were
mismatching against the MoM. We think we know why, but are
partly guessing, because we don't know which version of bundle
manifest was in play. We know the version at the point of the
printf, so add it to the output.
Signed-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>
The issue with TLS versions is on the server side. The client
must specify which version to use, but that version must be
supported by the server. And sadly the server world is often
running old OS's with old libraries and daemons.
Signed-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>
To make compile-time options more easily discoverable at runtime, make
the --version output more verbose by printing a few of them. Other
options can be easily added in the future by adding an appropriate
AC_DEFINE call in configure.ac, and updating the new header added in
this commit (swupd-build-opts.h).
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Allow curl to use the HTTP/2 protocol, with an automatic fallback to
HTTP/1.1.
Because of the optional nature, there's also no strict error handling
performed, if requesting HTTP/2 fails it fails.... and we get HTTP/1.1.
This release introduces a change to the hashing scheme regarding delta names,
and directory hashes. Fixes are also included for using consistent paths for
the certificates, attempting local signature verification before downloading
the Manifest.MoM and signature from the server, patching functional tests
to accomodate the new hash changes, and various memory leaks and code cleanup.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
To two latest commits introduce breaking changes to the updater, so the
static server content needs to be refreshed.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Calculate the hash for directories is desiderable to be independent
on the dirname due to the subsequent calculation on the staged/HASH
file. Here is used const "DIRECTORY" string for input name for
all folders.
Signed-off-by: Jose R Guzman <jose.r.guzman.mosqueda@intel.com>
There is an issue when two different files in a newer release have same hash:
This is, when swupd updates a file by applying a delta, it takes the HASH2 to
know the file where delta must be applyed. If files are different in current
release (before updating), there must be 2 deltas, one for each file but as
the two files have same hash in new release delta's name are the same:
FROM-TO-HASH2 and it is when issue arises due to just the last delta file is
kept when swupd server creates files and packs. So when swupd client tries to
apply the delta to one of the file that does not corresponds it will fail and
generates an error. At the first look it will seem like delta file is corrupted
however the issue is that delta file was created for another file.
To solve this issue we include the hash for the original file in the delta's
name so that swupd client can take the correct delta and apply it:
FROM-TO-HASH1-HASH2.
Warning: A corresponding patch to swupd server must be applied in order to
sync both sides and understand the new delta's name format.
Signed-off-by: Jose R Guzman <jose.r.guzman.mosqueda@intel.com>
In case the Manifest.MoM.sig already exists locally (e.g. it was shipped
inside the Manifest.MoM.tar), then try to verify the local copy first.
If the verify fails because the .sig is missing, or for any other
reason, then download a fresh copy from the server.
For the implementation, I refactored verify_signature() to not print
error messages if the verification fails the first time, because we
"retry" by downloading the fresh copy. If the verification fails the
second time, then error messages are printed. Also, I consolidated the
cleanup logic in this function to reduce duplication.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
This release enables support for verification of signed MoM manifests,
with the MoM being the root of trust for any swupd-client action that
references update content (i.e. 'update', 'verify', etc.). Also, to
complete the chain of trust rooted at the MoM, integrity checks have
been enabled for bundle manifests.
To enable this feature, pass the --enable-signature-verification option
to the configure script.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Because signature verification is a feature that we need separate
testing for, and swupd's output may print a verification error (or not)
depending on how swupd was built, add a helper function to remove the
verification error message when swupd is built with verification
enabled. If verification is not enabled, swupd will not print any
message, and the function is a no-op.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
To make the change in my next commit more uniform, make sure this test
checks for the presence of some of the initial lines printed by swupd.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
If the MoM is not found on the server to match the os version on which
you're running, swupd search's MoM downloader returns 0 instead of an
error. EMOM_NOTFOUND is a natural value to return.
When 0 is returned, the null MoM pointer is later derferenced leading to a
segfault.
Signed-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>
The poorly documented libcrypto in OpenSSL apparently does not like
its initialization and cleanup functions to be called but at process
start and exit. Swupd-client already has a swupd_init() so easy on
that side. But there was no common swupd_deinit() in which to place
terminate_signature(). I add one and put the common exit cleaners in it
and fix of a number of little inconsistencies around process exit cleanup
that have come to exist because there was a common cleaner.
With this, the signature verification of both the current and latest
MoM works, where prior only a first verification succeeded.
This patch also fixes a few memory leaks, though there are still many
memory leaks in swupd bundle-add and bundle-remove, unrelated to signature
verification. And swupd search is segfaulting due to how load_mom()
is introduced in 8cf0ef91dd.
Signed-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>
This patch adds functionality for the swupd client to do signature
verification on the MoM, which ensures a root of trust for the rest
of the update by guaranteeing the authenticity of the MoM and content
it includes.
As we focus now on just verifying the signed MoM, a number of functions now
become static to src/signature.c.
By default MoM signature verification is disabled. Configure
--enable-signature-verification to enable it. When enabled the default
cert for verification is /usr/share/clear/update-ca/ClearLinuxRoot.pem, as
specified by concatenation of SWUPDCERT onto UPDATE_CA_CERTS_PATH. The
SWUPDCERT can be overridden via configure --with-swupdcert=some.pem.
When signature verification is enabled, and the MoM's signature does _NOT_
verify, currently only a warning is presented but the swupd operation
continues. In the future signature verification will become mandatory.
We first need to sort out a few details with mixer to insure the right
thing happens there.
Signed-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
This commit expands the swupd BATS library to encapsulate more of the
boilerplate steps in the test cases.
Additionally, bundle manifest hashes needed updating now that swupd is
emitting warnings (and later on, errors). Better to be prepared for the
switch to errors on mismatches.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Tudor Marcu