Add support for secure upgrade #2698

ycoheNvidia · 2023-02-28T08:05:56Z

What I did
Added support for secure upgrade

How I did it
It includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities).
HLD can be found in the following PR: sonic-net/SONiC#1024

How to verify it
Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it.
In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios.

Feature dependencies
In order for this feature to work smoothly, need to have secure boot feature implemented as well.
The Secure boot feature will be merged in the near future.

sonic-buildimage PR: sonic-net/sonic-buildimage#11862

Fixed return value from cms verification script used for secure upgrade. Also modified and added prints to be similar to ONIE verification

Yarden-Z · 2023-03-12T14:56:38Z

@qiluo-msft Can you please review and approve this PR?
Containing the original secure upgrade item and a fix for the bug found in aboot.

This reverts commit e98011f.

liat-grozovik · 2023-04-09T09:01:37Z

@qiluo-msft , @Yarden-Z @xumia please help to review this PR. this one must go into 202211 as well .

zhangyanzhao · 2023-05-01T22:50:13Z

moved to 202305 release

liat-grozovik · 2023-05-10T18:03:21Z

@qiluo-msft kindly reminder to review and provide feedback

qiluo-msft · 2023-05-30T04:50:19Z

sonic_installer/bootloader/bootloader.py

@@ -75,6 +75,10 @@ def supports_package_migration(self, image):
        """tells if the image supports package migration"""
        return True

+    def verify_image_sign(self, image_path):


verify_image_sign

A unsecure normal image is considered not signed image, and should return False. #Closed

We want to verify image signature only of secure boot flag is enabled. This flow was already merged in previous PR #2337 (that was reverted even though it had a fix ready in a day) and described and approved in the HLD as well (sonic-net/SONiC#1024)

@qiluo-msft please add your comments/approval

After checking HLD, my comment is still applicable.
I understand "We want to verify image signature only of secure boot flag is enabled." This is the base class implementation, if subclass does not override, it will confuse user that an unsecure normal image is considered "verify_image_sign"-ed.

What do you suggest to do? @qiluo-msft Does the user read the python code? If we move the prints around verify_image_sign call in main.py inside grub bootloader will it be enough? I Can also add print inside base bootloader ("image verification not implemented, continue without verification"). Returning False here will make other vendor's CI fail, as the previous PR did, and I don't think implementing this method for each bootloader will be positive

If you mean "image verification not implemented", you should either throw NotImplmented exception or return a reasonable value to indicate the error. Silently "continue without verification" does not make sense.

Modified the code as suggested, please review @qiluo-msft

ycoheNvidia · 2023-06-25T08:38:26Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2023-06-25T08:38:32Z

Commenter does not have sufficient privileges for PR 2698 in repo sonic-net/sonic-utilities

ycoheNvidia · 2023-06-25T18:23:19Z

@qiluo-msft @liat-grozovik fixed minor print and issues - CI tests pass

StormLiangMS · 2023-06-30T01:46:27Z

@DavidZagury still got some question.

for device which support this secure upgrade
a. disabled, to boot unsecure image would be ok.
b. enabled, unsecure image will be failed to boot.
for device which doesn't support this secure upgrade feature.
a. unsecure image would be ok to boot/install.

DavidZagury · 2023-06-30T08:31:03Z

@DavidZagury still got some question.

for device which support this secure upgrade
a. disabled, to boot unsecure image would be ok.
b. enabled, unsecure image will be failed to boot.

for device which doesn't support this secure upgrade feature.
a. unsecure image would be ok to boot/install.

Yes, if Secure Boot is enabled, only Secured OS can be installed and booted. Unsecured images will fail to be installed, and if were already pre-installed, will fail to boot.
Devices that don't support Secure Boot will not check anything related to the security of the image, and any it will be possible to install and boot any image, just as it were in the past.

- What I did Added support for secure upgrade - How I did it It includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). HLD can be found in the following PR: sonic-net/SONiC#1024 - How to verify it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future.

Update sonic-utilities submodule pointer to include the following: * ff380e04 [hash]: Implement GH frontend ([sonic-net#2580](sonic-net/sonic-utilities#2580)) * 61bad064 [db_migrator] Set correct CURRENT_VERSION, extend UT ([sonic-net#2895](sonic-net/sonic-utilities#2895)) * 6b8ee47c [CLI][Show][BGP] Show BGP Change for no neighbor scenario ([sonic-net#2885](sonic-net/sonic-utilities#2885)) * 73d8d633 [doc] Update Command-Reference.md, change show bgp peer command to show bfd peer ([sonic-net#2750](sonic-net/sonic-utilities#2750)) * 7bc08c28 [db_migrator] Remove hardcoded config and migrate config from minigraph ([sonic-net#2887](sonic-net/sonic-utilities#2887)) * b1aa9426 [generate_dump]: Enhance show techsupport for Marvell platform ([sonic-net#2676](sonic-net/sonic-utilities#2676)) * 316b14c0 Add support for secure upgrade ([sonic-net#2698](sonic-net/sonic-utilities#2698)) * dc2945bc [dns] Implement config and show commands for static DNS. ([sonic-net#2737](sonic-net/sonic-utilities#2737)) * 8414a709 [chassis][multi asic] change acl_loader to use tcp socket for db communication ([sonic-net#2525](sonic-net/sonic-utilities#2525)) * 0b629ba1 Revert [chassis][voq] Clear fabric counters queue/port (2789) ([sonic-net#2882](sonic-net/sonic-utilities#2882)) * 3ba8241a [db_migtrator] Add migration of FLEX_COUNTER_DELAY_STATUS during 1911->master upgrade + fast-reboot. Add UT. ([sonic-net#2839](sonic-net/sonic-utilities#2839)) * fceef2ed [chassis][voq] Clear fabric counters queue/port ([sonic-net#2789](sonic-net/sonic-utilities#2789)) Signed-off-by: dgsudharsan <sudharsand@nvidia.com>

Update sonic-utilities submodule pointer to include the following: * ff380e04 [hash]: Implement GH frontend ([#2580](sonic-net/sonic-utilities#2580)) * 61bad064 [db_migrator] Set correct CURRENT_VERSION, extend UT ([#2895](sonic-net/sonic-utilities#2895)) * 6b8ee47c [CLI][Show][BGP] Show BGP Change for no neighbor scenario ([#2885](sonic-net/sonic-utilities#2885)) * 73d8d633 [doc] Update Command-Reference.md, change show bgp peer command to show bfd peer ([#2750](sonic-net/sonic-utilities#2750)) * 7bc08c28 [db_migrator] Remove hardcoded config and migrate config from minigraph ([#2887](sonic-net/sonic-utilities#2887)) * b1aa9426 [generate_dump]: Enhance show techsupport for Marvell platform ([#2676](sonic-net/sonic-utilities#2676)) * 316b14c0 Add support for secure upgrade ([#2698](sonic-net/sonic-utilities#2698)) * dc2945bc [dns] Implement config and show commands for static DNS. ([#2737](sonic-net/sonic-utilities#2737)) * 8414a709 [chassis][multi asic] change acl_loader to use tcp socket for db communication ([#2525](sonic-net/sonic-utilities#2525)) * 0b629ba1 Revert [chassis][voq] Clear fabric counters queue/port (2789) ([#2882](sonic-net/sonic-utilities#2882)) * 3ba8241a [db_migtrator] Add migration of FLEX_COUNTER_DELAY_STATUS during 1911->master upgrade + fast-reboot. Add UT. ([#2839](sonic-net/sonic-utilities#2839)) * fceef2ed [chassis][voq] Clear fabric counters queue/port ([#2789](sonic-net/sonic-utilities#2789)) Signed-off-by: dgsudharsan <sudharsand@nvidia.com>

- What I did Added support for secure upgrade - How I did it It includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). HLD can be found in the following PR: sonic-net/SONiC#1024 - How to verify it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future.

Update sonic-utilities submodule pointer to include the following: * ff380e04 [hash]: Implement GH frontend ([sonic-net#2580](sonic-net/sonic-utilities#2580)) * 61bad064 [db_migrator] Set correct CURRENT_VERSION, extend UT ([sonic-net#2895](sonic-net/sonic-utilities#2895)) * 6b8ee47c [CLI][Show][BGP] Show BGP Change for no neighbor scenario ([sonic-net#2885](sonic-net/sonic-utilities#2885)) * 73d8d633 [doc] Update Command-Reference.md, change show bgp peer command to show bfd peer ([sonic-net#2750](sonic-net/sonic-utilities#2750)) * 7bc08c28 [db_migrator] Remove hardcoded config and migrate config from minigraph ([sonic-net#2887](sonic-net/sonic-utilities#2887)) * b1aa9426 [generate_dump]: Enhance show techsupport for Marvell platform ([sonic-net#2676](sonic-net/sonic-utilities#2676)) * 316b14c0 Add support for secure upgrade ([sonic-net#2698](sonic-net/sonic-utilities#2698)) * dc2945bc [dns] Implement config and show commands for static DNS. ([sonic-net#2737](sonic-net/sonic-utilities#2737)) * 8414a709 [chassis][multi asic] change acl_loader to use tcp socket for db communication ([sonic-net#2525](sonic-net/sonic-utilities#2525)) * 0b629ba1 Revert [chassis][voq] Clear fabric counters queue/port (2789) ([sonic-net#2882](sonic-net/sonic-utilities#2882)) * 3ba8241a [db_migtrator] Add migration of FLEX_COUNTER_DELAY_STATUS during 1911->master upgrade + fast-reboot. Add UT. ([sonic-net#2839](sonic-net/sonic-utilities#2839)) * fceef2ed [chassis][voq] Clear fabric counters queue/port ([sonic-net#2789](sonic-net/sonic-utilities#2789)) Signed-off-by: dgsudharsan <sudharsand@nvidia.com>

ycoheNvidia and others added 11 commits August 15, 2022 15:09

implemented secure upgrade

b972cde

fixed minor issues

6504dd8

minor fixes after review

3efcc95

Update main.py

22d197c

Minor syntax issue fixed

311b702

fixed sonic installer test issues

baa6918

Fixed coverage issues

3cf5935

Fixed a bug regarding secure upgrade verify

e5f3d6f

Fixed return value from cms verification script used for secure upgrade. Also modified and added prints to be similar to ONIE verification

Fixed issues raised in review

f747fd1

Added bootloader fix for image verification

30aaa86

Merge branch 'master' into secure_upgrade_v2

d844370

ycoheNvidia requested review from xumia, Yarden-Z and qiluo-msft February 28, 2023 08:08

liat-grozovik added the Request for 202211 Branch label Mar 1, 2023

Merge branch 'sonic-net:master' into secure_upgrade_v2

9a69423

ycoheNvidia mentioned this pull request Mar 6, 2023

fixed bootloader method verify_image_sign to have dummy implementation… #2646

Closed

judyjoseph mentioned this pull request Mar 15, 2023

Other images cannot be installed on Arista devices from current master branch image sonic-net/sonic-buildimage#13808

Open

Revert "Revert "Secure upgrade (sonic-net#2337)" (sonic-net#2675)"

d9b0543

This reverts commit e98011f.

zhangyanzhao removed the Request for 202211 Branch label Mar 28, 2023

liat-grozovik added the Request for 202211 Branch label Apr 9, 2023

Yarden-Z approved these changes Apr 17, 2023

View reviewed changes

zhangyanzhao removed the Request for 202211 Branch label May 1, 2023

ycoheNvidia mentioned this pull request May 18, 2023

Add support for secure upgrade sonic-net/sonic-buildimage#11862

Merged

DavidZagury added a commit to DavidZagury/sonic-utilities that referenced this pull request May 23, 2023

[202211_SPC4] Secure upgrade v2 sonic-net#2698

f263c5f

qiluo-msft reviewed May 30, 2023

View reviewed changes

Added check for image verification support

64dab4a

ycoheNvidia force-pushed the secure_upgrade_v2 branch from 7062ef1 to 64dab4a Compare June 21, 2023 13:15

qiluo-msft previously approved these changes Jun 21, 2023

View reviewed changes

Merge branch 'sonic-net:master' into secure_upgrade_v2

cb08153

ycoheNvidia dismissed qiluo-msft’s stale review via 9b932e7 June 22, 2023 10:49

ycoheNvidia force-pushed the secure_upgrade_v2 branch from 9b932e7 to aeeeabe Compare June 22, 2023 11:18

Fixed grub verify_image_sign print

7877b3a

ycoheNvidia force-pushed the secure_upgrade_v2 branch from aeeeabe to 7877b3a Compare June 22, 2023 12:18

Merge branch 'sonic-net:master' into secure_upgrade_v2

8d9849c

qiluo-msft approved these changes Jun 26, 2023

View reviewed changes

liat-grozovik merged commit 316b14c into sonic-net:master Jun 26, 2023

liat-grozovik changed the title ~~Secure upgrade v2~~ Add support for secure upgrade Jun 26, 2023

liat-grozovik added the Request for 202305 Branch label Jun 26, 2023

This was referenced Jun 30, 2023

[action] [PR:11862] Add support for secure upgrade sonic-net/sonic-buildimage#15690

Merged

[action] [PR:11862] Add support for secure upgrade sonic-net/sonic-buildimage#15691

Merged

StormLiangMS added Included in 202211 Branch Included in 202305 Branch labels Jun 30, 2023

dgsudharsan mentioned this pull request Jul 11, 2023

[submodule] Advance sonic-utilities pointer sonic-net/sonic-buildimage#15779

Merged

11 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for secure upgrade #2698

Add support for secure upgrade #2698

ycoheNvidia commented Feb 28, 2023

Yarden-Z commented Mar 12, 2023

liat-grozovik commented Apr 9, 2023

zhangyanzhao commented May 1, 2023

liat-grozovik commented May 10, 2023

qiluo-msft May 30, 2023 •

edited

Loading

ycoheNvidia May 30, 2023

ycoheNvidia Jun 4, 2023

qiluo-msft Jun 5, 2023 •

edited

Loading

ycoheNvidia Jun 5, 2023 •

edited

Loading

qiluo-msft Jun 10, 2023

ycoheNvidia Jun 11, 2023

ycoheNvidia commented Jun 25, 2023

azure-pipelines bot commented Jun 25, 2023

ycoheNvidia commented Jun 25, 2023

StormLiangMS commented Jun 30, 2023

DavidZagury commented Jun 30, 2023 •

edited

Loading

Add support for secure upgrade #2698

Add support for secure upgrade #2698

Conversation

ycoheNvidia commented Feb 28, 2023

Yarden-Z commented Mar 12, 2023

liat-grozovik commented Apr 9, 2023

zhangyanzhao commented May 1, 2023

liat-grozovik commented May 10, 2023

qiluo-msft May 30, 2023 • edited Loading

Choose a reason for hiding this comment

ycoheNvidia May 30, 2023

Choose a reason for hiding this comment

ycoheNvidia Jun 4, 2023

Choose a reason for hiding this comment

qiluo-msft Jun 5, 2023 • edited Loading

Choose a reason for hiding this comment

ycoheNvidia Jun 5, 2023 • edited Loading

Choose a reason for hiding this comment

qiluo-msft Jun 10, 2023

Choose a reason for hiding this comment

ycoheNvidia Jun 11, 2023

Choose a reason for hiding this comment

ycoheNvidia commented Jun 25, 2023

azure-pipelines bot commented Jun 25, 2023

ycoheNvidia commented Jun 25, 2023

StormLiangMS commented Jun 30, 2023

DavidZagury commented Jun 30, 2023 • edited Loading

qiluo-msft May 30, 2023 •

edited

Loading

qiluo-msft Jun 5, 2023 •

edited

Loading

ycoheNvidia Jun 5, 2023 •

edited

Loading

DavidZagury commented Jun 30, 2023 •

edited

Loading