AU: Add more signing unit tests.

delta_performer_unittest.cc

 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <sys/mount.h>
 #include <inttypes.h>
 
 #include <algorithm>
 #include <string>
 #include <vector>
@@ skipping 77 matching lines @@
   ScopedFdCloser fd_closer(&fd);
   off_t rc = lseek(fd, size + 1, SEEK_SET);
   TEST_AND_RETURN_FALSE_ERRNO(rc != static_cast<off_t>(-1));
   int return_code = ftruncate(fd, size);
   TEST_AND_RETURN_FALSE_ERRNO(return_code == 0);
   return true;
 }
 }  // namespace {}
 
 namespace {
+enum SignatureTest {
+  kSignatureNone,  // No payload signing.
+  kSignatureGenerator,  // Sign the payload at generation time.
+  kSignatureGenerated,  // Sign the payload after it's generated.
+  kSignatureGeneratedShell,  // Sign the generated payload through shell cmds.
+};
+
+size_t GetSignatureSize() {
+  const vector<char> data(1, 'x');
+  vector<char> hash;
+  EXPECT_TRUE(OmahaHashCalculator::RawHashOfData(data, &hash));
+  vector<char> signature;
+  EXPECT_TRUE(PayloadSigner::SignHash(hash,
+                                      kUnittestPrivateKeyPath,
+                                      &signature));
+  return signature.size();
+}
+
+void SignGeneratedPayload(const string& payload_path) {
+  int signature_size = GetSignatureSize();
+  vector<char> hash;
+  ASSERT_TRUE(PayloadSigner::HashPayloadForSigning(payload_path,
+                                                   signature_size,
+                                                   &hash));
+  vector<char> signature;
+  ASSERT_TRUE(PayloadSigner::SignHash(hash,
+                                      kUnittestPrivateKeyPath,
+                                      &signature));
+  ASSERT_TRUE(PayloadSigner::AddSignatureToPayload(payload_path,
+                                                   signature,
+                                                   payload_path));
+  EXPECT_TRUE(PayloadSigner::VerifySignedPayload(payload_path,
+                                                 kUnittestPublicKeyPath));
+}
+
+void SignGeneratedShellPayload(const string& payload_path) {
+  int signature_size = GetSignatureSize();
+  string hash_file;
+  ASSERT_TRUE(utils::MakeTempFile("/tmp/hash.XXXXXX", &hash_file, NULL));
+  ScopedPathUnlinker hash_unlinker(hash_file);
+
+  ASSERT_EQ(0,
+            System(StringPrintf(
+                "./delta_generator -in_file %s -signature_size %d "
+                "-out_hash_file %s",
+                payload_path.c_str(),
+                signature_size,
+                hash_file.c_str())));
+
+  string sig_file;
+  ASSERT_TRUE(utils::MakeTempFile("/tmp/signature.XXXXXX", &sig_file, NULL));
+  ScopedPathUnlinker sig_unlinker(sig_file);
+  ASSERT_EQ(0,
+            System(StringPrintf(
+                "/usr/bin/openssl rsautl -pkcs -sign -inkey %s -in %s -out %s",
+                kUnittestPrivateKeyPath,
+                hash_file.c_str(),
+                sig_file.c_str())));
+  ASSERT_EQ(0,
+            System(StringPrintf(
+                "./delta_generator -in_file %s -signature_file %s "
+                "-out_file %s",
+                payload_path.c_str(),
+                sig_file.c_str(),
+                payload_path.c_str())));
+  ASSERT_EQ(0,
+            System(StringPrintf(
+                "./delta_generator -in_file %s -public_key %s",
+                payload_path.c_str(),
+                kUnittestPublicKeyPath)));
+}
+
 void DoSmallImageTest(bool full_kernel, bool full_rootfs, bool noop,
-                      bool post_sign) {
+                      SignatureTest signature_test) {
   string a_img, b_img;
   EXPECT_TRUE(utils::MakeTempFile("/tmp/a_img.XXXXXX", &a_img, NULL));
   ScopedPathUnlinker a_img_unlinker(a_img);
   EXPECT_TRUE(utils::MakeTempFile("/tmp/b_img.XXXXXX", &b_img, NULL));
   ScopedPathUnlinker b_img_unlinker(b_img);
 
   CreateExtImageAtPath(a_img, NULL);
 
   int image_size = static_cast<int>(utils::FileSize(a_img));
 
@@ skipping 84 matching lines @@
       new_kernel.c_str(), &new_kernel_data[0], new_kernel_data.size()));
 
   string delta_path;
   EXPECT_TRUE(utils::MakeTempFile("/tmp/delta.XXXXXX", &delta_path, NULL));
   LOG(INFO) << "delta path: " << delta_path;
   ScopedPathUnlinker delta_path_unlinker(delta_path);
   {
     string a_mnt, b_mnt;
     ScopedLoopMounter a_mounter(a_img, &a_mnt, MS_RDONLY);
     ScopedLoopMounter b_mounter(b_img, &b_mnt, MS_RDONLY);
-
+    const string private_key =
+        signature_test == kSignatureGenerator ? kUnittestPrivateKeyPath : "";
     EXPECT_TRUE(
         DeltaDiffGenerator::GenerateDeltaUpdateFile(
             full_rootfs ? "" : a_mnt,
             full_rootfs ? "" : a_img,
             b_mnt,
             b_img,
             full_kernel ? "" : old_kernel,
             new_kernel,
             delta_path,
-            post_sign ? "" : kUnittestPrivateKeyPath));
+            private_key));
   }
 
-  if (post_sign) {
-    int signature_size;
-    {
-      const vector<char> data(1, 'x');
-      vector<char> hash;
-      ASSERT_TRUE(OmahaHashCalculator::RawHashOfData(data, &hash));
-      vector<char> signature;
-      ASSERT_TRUE(PayloadSigner::SignHash(hash,
-                                          kUnittestPrivateKeyPath,
-                                          &signature));
-      signature_size = signature.size();
-    }
-
-    vector<char> hash;
-    ASSERT_TRUE(PayloadSigner::HashPayloadForSigning(delta_path,
-                                                     signature_size,
-                                                     &hash));
-    vector<char> signature;
-    ASSERT_TRUE(PayloadSigner::SignHash(hash,
-                                        kUnittestPrivateKeyPath,
-                                        &signature));
-    ASSERT_TRUE(PayloadSigner::AddSignatureToPayload(delta_path,
-                                                     signature,
-                                                     delta_path));
-    EXPECT_TRUE(PayloadSigner::VerifySignedPayload(delta_path,
-                                                   kUnittestPublicKeyPath));
+  if (signature_test == kSignatureGenerated) {
+    SignGeneratedPayload(delta_path);
+  } else if (signature_test == kSignatureGeneratedShell) {
+    SignGeneratedShellPayload(delta_path);
   }
 
   // Read delta into memory.
   vector<char> delta;
   EXPECT_TRUE(utils::ReadFile(delta_path, &delta));
 
   uint64_t manifest_metadata_size;
 
   // Check the metadata.
   {
     LOG(INFO) << "delta size: " << delta.size();
     DeltaArchiveManifest manifest;
     const int kManifestSizeOffset = 12;
     const int kManifestOffset = 20;
     uint64_t manifest_size = 0;
     memcpy(&manifest_size, &delta[kManifestSizeOffset], sizeof(manifest_size));
     manifest_size = be64toh(manifest_size);
     LOG(INFO) << "manifest size: " << manifest_size;
     EXPECT_TRUE(manifest.ParseFromArray(&delta[kManifestOffset],
                                         manifest_size));
-    EXPECT_TRUE(manifest.has_signatures_offset());
     manifest_metadata_size = kManifestOffset + manifest_size;
 
-    Signatures sigs_message;
-    EXPECT_TRUE(sigs_message.ParseFromArray(
-        &delta[manifest_metadata_size + manifest.signatures_offset()],
-        manifest.signatures_size()));
-    EXPECT_EQ(1, sigs_message.signatures_size());
-    const Signatures_Signature& signature = sigs_message.signatures(0);
-    EXPECT_EQ(1, signature.version());
+    if (signature_test == kSignatureNone) {
+      EXPECT_FALSE(manifest.has_signatures_offset());
+      EXPECT_FALSE(manifest.has_signatures_size());
+    } else {
+      EXPECT_TRUE(manifest.has_signatures_offset());
+      EXPECT_TRUE(manifest.has_signatures_size());
+      Signatures sigs_message;
+      EXPECT_TRUE(sigs_message.ParseFromArray(
+          &delta[manifest_metadata_size + manifest.signatures_offset()],
+          manifest.signatures_size()));
+      EXPECT_EQ(1, sigs_message.signatures_size());
+      const Signatures_Signature& signature = sigs_message.signatures(0);
+      EXPECT_EQ(1, signature.version());
 
-    uint64_t expected_sig_data_length = 0;
-    EXPECT_TRUE(PayloadSigner::SignatureBlobLength(kUnittestPrivateKeyPath,
-                                                   &expected_sig_data_length));
-    EXPECT_EQ(expected_sig_data_length, manifest.signatures_size());
-    EXPECT_FALSE(signature.data().empty());
+      uint64_t expected_sig_data_length = 0;
+      EXPECT_TRUE(PayloadSigner::SignatureBlobLength(
+          kUnittestPrivateKeyPath, &expected_sig_data_length));
+      EXPECT_EQ(expected_sig_data_length, manifest.signatures_size());
+      EXPECT_FALSE(signature.data().empty());
+    }
 
     if (noop) {
       EXPECT_EQ(1, manifest.install_operations_size());
       EXPECT_EQ(1, manifest.kernel_install_operations_size());
     }
 
     if (full_kernel) {
       EXPECT_FALSE(manifest.has_old_kernel_info());
     } else {
       EXPECT_EQ(old_kernel_data.size(), manifest.old_kernel_info().size());
@@ skipping 18 matching lines @@
   EXPECT_CALL(prefs, SetInt64(kPrefsManifestMetadataSize,
                               manifest_metadata_size)).WillOnce(Return(true));
   EXPECT_CALL(prefs, SetInt64(kPrefsUpdateStateNextOperation, _))
       .WillRepeatedly(Return(true));
   EXPECT_CALL(prefs, GetInt64(kPrefsUpdateStateNextOperation, _))
       .WillOnce(Return(false));
   EXPECT_CALL(prefs, SetInt64(kPrefsUpdateStateNextDataOffset, _))
       .WillRepeatedly(Return(true));
   EXPECT_CALL(prefs, SetString(kPrefsUpdateStateSHA256Context, _))
       .WillRepeatedly(Return(true));
-  EXPECT_CALL(prefs, SetString(kPrefsUpdateStateSignedSHA256Context, _))
-      .WillOnce(Return(true));
+  if (signature_test != kSignatureNone) {
+    EXPECT_CALL(prefs, SetString(kPrefsUpdateStateSignedSHA256Context, _))
+        .WillOnce(Return(true));
+  }
 
   // Update the A image in place.
   DeltaPerformer performer(&prefs);
 
   vector<char> rootfs_hash;
   EXPECT_EQ(image_size,
             OmahaHashCalculator::RawHashOfFile(a_img,
                                                image_size,
                                                &rootfs_hash));
   performer.set_current_rootfs_hash(rootfs_hash);
@@ skipping 17 matching lines @@
 
   CompareFilesByBlock(old_kernel, new_kernel);
   CompareFilesByBlock(a_img, b_img);
 
   vector<char> updated_kernel_partition;
   EXPECT_TRUE(utils::ReadFile(old_kernel, &updated_kernel_partition));
   EXPECT_EQ(0, strncmp(&updated_kernel_partition[0], new_data_string,
                        strlen(new_data_string)));
 
   EXPECT_TRUE(utils::FileExists(kUnittestPublicKeyPath));
-  EXPECT_TRUE(performer.VerifyPayload(
-      kUnittestPublicKeyPath,
-      OmahaHashCalculator::OmahaHashOfData(delta),
-      delta.size()));
+  EXPECT_EQ(signature_test != kSignatureNone,
+            performer.VerifyPayload(
+                kUnittestPublicKeyPath,
+                OmahaHashCalculator::OmahaHashOfData(delta),
+                delta.size()));
 
   uint64_t new_kernel_size;
   vector<char> new_kernel_hash;
   uint64_t new_rootfs_size;
   vector<char> new_rootfs_hash;
   EXPECT_TRUE(performer.GetNewPartitionInfo(&new_kernel_size,
                                             &new_kernel_hash,
                                             &new_rootfs_size,
                                             &new_rootfs_hash));
   EXPECT_EQ(4096, new_kernel_size);
   vector<char> expected_new_kernel_hash;
   EXPECT_TRUE(OmahaHashCalculator::RawHashOfData(new_kernel_data,
                                                  &expected_new_kernel_hash));
   EXPECT_TRUE(expected_new_kernel_hash == new_kernel_hash);
   EXPECT_EQ(image_size, new_rootfs_size);
   vector<char> expected_new_rootfs_hash;
   EXPECT_EQ(image_size,
             OmahaHashCalculator::RawHashOfFile(b_img,
                                                image_size,
                                                &expected_new_rootfs_hash));
   EXPECT_TRUE(expected_new_rootfs_hash == new_rootfs_hash);
 }
 }
 
 TEST(DeltaPerformerTest, RunAsRootSmallImageTest) {
-  DoSmallImageTest(false, false, false, false);
+  DoSmallImageTest(false, false, false, kSignatureGenerator);
 }
 
 TEST(DeltaPerformerTest, RunAsRootFullKernelSmallImageTest) {
-  DoSmallImageTest(true, false, false, false);
+  DoSmallImageTest(true, false, false, kSignatureGenerator);
 }
 
 TEST(DeltaPerformerTest, RunAsRootFullSmallImageTest) {
-  DoSmallImageTest(true, true, false, false);
+  DoSmallImageTest(true, true, false, kSignatureGenerator);
 }
 
 TEST(DeltaPerformerTest, RunAsRootNoopSmallImageTest) {
-  DoSmallImageTest(false, false, true, false);
+  DoSmallImageTest(false, false, true, kSignatureGenerator);
 }
 
-TEST(DeltaPerformerTest, RunAsRootSmallImagePostSignTest) {
-  DoSmallImageTest(false, false, false, true);
+TEST(DeltaPerformerTest, RunAsRootSmallImageSignNoneTest) {
+  DoSmallImageTest(false, false, false, kSignatureNone);
+}
+
+TEST(DeltaPerformerTest, RunAsRootSmallImageSignGeneratedTest) {
+  DoSmallImageTest(false, false, false, kSignatureGenerated);
+}
+
+TEST(DeltaPerformerTest, RunAsRootSmallImageSignGeneratedShellTest) {
+  DoSmallImageTest(false, false, false, kSignatureGeneratedShell);
 }
 
 TEST(DeltaPerformerTest, BadDeltaMagicTest) {
   PrefsMock prefs;
   DeltaPerformer performer(&prefs);
   EXPECT_EQ(0, performer.Open("/dev/null", 0, 0));
   EXPECT_TRUE(performer.OpenKernel("/dev/null"));
   EXPECT_EQ(4, performer.Write("junk", 4));
   EXPECT_EQ(8, performer.Write("morejunk", 8));
   EXPECT_LT(performer.Write("morejunk", 8), 0);
@@ skipping 10 matching lines @@
   op.clear_src_extents();
   *(op.add_src_extents()) = ExtentForRange(5, 3);
   EXPECT_TRUE(DeltaPerformer::IsIdempotentOperation(op));
   *(op.add_dst_extents()) = ExtentForRange(20, 6);
   EXPECT_TRUE(DeltaPerformer::IsIdempotentOperation(op));
   *(op.add_src_extents()) = ExtentForRange(19, 2);
   EXPECT_FALSE(DeltaPerformer::IsIdempotentOperation(op));
 }
 
 }  // namespace chromeos_update_engine