From 367df46166fc63c71741dcb8833d991226eeff75 Mon Sep 17 00:00:00 2001 From: Arvid Norlander Date: Tue, 18 Aug 2020 16:59:17 +0200 Subject: [PATCH] Implements uunicorn/python-validity#26: Verify hash of downloaded drivers. --- bin/validity-sensors-firmware | 15 ++++++++++++--- validitysensor/firmware_tables.py | 7 +++++-- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/bin/validity-sensors-firmware b/bin/validity-sensors-firmware index 1f59aa8..e585f1c 100755 --- a/bin/validity-sensors-firmware +++ b/bin/validity-sensors-firmware @@ -19,6 +19,7 @@ # along with this program. If not, see . import argparse +import hashlib import os import shutil import subprocess @@ -28,15 +29,15 @@ import urllib.request from usb import core as usb_core -from validitysensor.usb import SupportedDevices from validitysensor.firmware_tables import FIRMWARE_NAMES, FIRMWARE_URIS - +from validitysensor.usb import SupportedDevices python_validity_data = '/usr/share/python-validity/' def download_and_extract_fw(dev_type, fwdir, fwuri=None): fwuri = fwuri if fwuri else FIRMWARE_URIS[dev_type]['driver'] + expected_hash = FIRMWARE_URIS[dev_type]['sha512'] fwarchive = os.path.join(fwdir, 'fwinstaller.exe') fwname = FIRMWARE_NAMES[dev_type] @@ -46,9 +47,17 @@ def download_and_extract_fw(dev_type, fwdir, fwuri=None): req.add_header('Referer', FIRMWARE_URIS[dev_type].get('referral', '')) req.add_header('User-Agent', 'Mozilla/5.0 (X11; U; Linux)') + hash = hashlib.sha512() with urllib.request.urlopen(req) as response: with open(fwarchive, 'wb') as out_file: - out_file.write(response.read()) + data = response.read() + hash.update(data) + out_file.write(data) + + actual_hash = hash.hexdigest() + if actual_hash != expected_hash: + raise Exception('Hash mismatch for driver download! Expected {}, got {}'.format( + expected_hash, actual_hash)) subprocess.check_call([ 'innoextract', '--output-dir', fwdir, '--include', fwname, '--collisions', 'overwrite', diff --git a/validitysensor/firmware_tables.py b/validitysensor/firmware_tables.py index b4ce3c4..cb5ec0a 100644 --- a/validitysensor/firmware_tables.py +++ b/validitysensor/firmware_tables.py @@ -6,14 +6,17 @@ FIRMWARE_URIS = { SupportedDevices.DEV_90: { 'driver': 'https://download.lenovo.com/pccbbs/mobiles/n1cgn08w.exe', 'referral': 'https://support.lenovo.com/us/en/downloads/DS120491', + 'sha512': 'd839fa65adf4c952ecb4a5c4b2fc5b5bdedd8e02a421564bdc7fae1d281be4ea26fcde2333f2ab78d56cef0fdccce0a3cf429300b89544cdc9cfee6d0fe0db55' }, SupportedDevices.DEV_97: { 'driver': 'https://download.lenovo.com/pccbbs/mobiles/nz3gf07w.exe', - 'referral': 'https://download.lenovo.com/pccbbs/mobiles/nz3gf07w.exe' + 'referral': 'https://download.lenovo.com/pccbbs/mobiles/nz3gf07w.exe', + 'sha512': 'a4a4e6058b1ea8ab721953d2cfd775a1e7bc589863d160e5ebbb90344858f147d695103677a8df0b2de0c95345df108bda97196245b067f45630038fb7c807cd' }, SupportedDevices.DEV_9a: { 'driver': 'https://download.lenovo.com/pccbbs/mobiles/nz3gf07w.exe', - 'referral': 'https://download.lenovo.com/pccbbs/mobiles/nz3gf07w.exe' + 'referral': 'https://download.lenovo.com/pccbbs/mobiles/nz3gf07w.exe', + 'sha512': 'a4a4e6058b1ea8ab721953d2cfd775a1e7bc589863d160e5ebbb90344858f147d695103677a8df0b2de0c95345df108bda97196245b067f45630038fb7c807cd' } }