Generate and validate per-operation hashes
As part of securing the HTTP-based updates, we want to add a SHA256 hash
of the data blob for each operation so that they can't be tampered with
by a man in the middle. This CL adds support for generating and
including such hashes for each operation in the payload as well as
validating them in update_engine, if present.
BUG=chromium-os:34298
TEST=Tested on ZGB to make sure existing functionality works fine.
Existing unit tests cover all the new code paths.
Change-Id: Ie42ed1930a66ceaf183f36ce3af0dea719e44237
Reviewed-on: https://gerrit.chromium.org/gerrit/33389
Reviewed-by: Don Garrett <dgarrett@chromium.org>
Commit-Ready: Jay Srinivasan <jaysri@chromium.org>
Tested-by: Jay Srinivasan <jaysri@chromium.org>
diff --git a/delta_diff_generator.cc b/delta_diff_generator.cc
index 06952c6..26f3133 100644
--- a/delta_diff_generator.cc
+++ b/delta_diff_generator.cc
@@ -1178,6 +1178,9 @@
ssize_t rc = pread(in_fd, &buf[0], buf.size(), op->data_offset());
TEST_AND_RETURN_FALSE(rc == static_cast<ssize_t>(buf.size()));
+ // Add the hash of the data blobs for this operation
+ TEST_AND_RETURN_FALSE(AddOperationHash(op, buf));
+
op->set_data_offset(out_file_size);
TEST_AND_RETURN_FALSE(writer.Write(&buf[0], buf.size()));
out_file_size += buf.size();
@@ -1185,6 +1188,19 @@
return true;
}
+bool DeltaDiffGenerator::AddOperationHash(
+ DeltaArchiveManifest_InstallOperation* op,
+ const vector<char>& buf) {
+ OmahaHashCalculator hasher;
+
+ TEST_AND_RETURN_FALSE(hasher.Update(&buf[0], buf.size()));
+ TEST_AND_RETURN_FALSE(hasher.Finalize());
+
+ const vector<char>& hash = hasher.raw_hash();
+ op->set_data_sha256_hash(hash.data(), hash.size());
+ return true;
+}
+
bool DeltaDiffGenerator::ConvertCutToFullOp(Graph* graph,
const CutEdgeVertexes& cut,
const string& new_root,