Add support for secure upgrade #11862

ycoheNvidia · 2022-08-28T07:47:46Z

What I did

Added support for secure upgrade.

How I did it

During sonic_installer install, added secure upgrade image verification.
HLD can be found in the following PR: sonic-net/SONiC#1024

Why I did it

Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it.

How I did it

Feature includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities).

How to verify it

In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios.

Feature dependencies

In order for this feature to work smoothly, need to have secure boot feature implemented as well.
The Secure boot feature will be merged in the near future.

In addition, image verification code, during image install, including tests are added as part of sonic-utilities repo PR - sonic-net/sonic-utilities#2698

linux-foundation-easycla · 2022-08-28T07:47:51Z

The committers listed above are authorized under a signed CLA.

✅ login: ycoheNvidia (41665e5, 5848e45, b3fdcb4, e11fb1d, 56c9fa6, f44a67b)

liat-grozovik · 2022-10-30T08:09:11Z

@yxieca could you please help to review or suggest a reviewer?

xumia · 2022-11-14T01:23:34Z

rules/config

+# SECURE_UPGRADE_MODE - enum value for secure upgrade mode, valid options are "dev", "prod" and "no_sign"
+#SECURE_UPGRADE_DEV_SIGNING_KEY = 
+#SECURE_UPGRADE_DEV_SIGNING_CERT =  
+SECURE_UPGRADE_MODE = "no_sign"


Can we only give two options: sign, no_sign? The dev or prod is depended on what kinds of certificates users used, and we can provide a script to generate all dev certificates.

We may be not necessary to provide some options only for DEV.

#SECURE_UPGRADE_DEV_SIGNING_KEY = #SECURE_UPGRADE_DEV_SIGNING_CERT =

Suggest change as below:

#SECURE_UPGRADE_SIGNING_KEY = #SECURE_UPGRADE_SIGNING_CERT =

Do we need to distinguish the UPGRADE/NONE-UPGRADE certificate? The signed image can be used for both fresh installation or upgrade, right?

This mechanism is part of the feature architecture, as described in its HLD. Doing as your suggestion will change our architecture and we prefer not to do so in this stage. There is a serious demand from our costumers, to allow production signing with their own signing mechanisms. If someone wants to use the current flags they can take the DEV_SIGNING flags and assign it to a different variable or flag.
For your last question - signed image can be used for both fresh installation (from ONIE) or upgrade (from SONIC). In case of ONIE installation - ONIE master is currently not verifying the image - it can be implemented in the future if required and approved

…mage

liat-grozovik · 2023-01-29T11:54:54Z

@ycoheNvidia can you please handle conflicts?
@qiluo-msft , @xumia appreciate your feedback to have this PR approved.

#### What I did Added support for secure upgrade #### How I did it It includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). HLD can be found in the following PR: sonic-net/SONiC#1024 #### How to verify it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. #### Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future. sonic-buildimage PR: sonic-net/sonic-buildimage#11862

liat-grozovik · 2023-02-06T15:41:09Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2023-02-06T15:41:32Z

Azure Pipelines successfully started running 1 pipeline(s).

ycoheNvidia · 2023-02-21T07:57:08Z

@qiluo-msft , @xumia, would appreciate your review

liat-grozovik · 2023-03-01T08:33:39Z

@ycoheNvidia please handle conflict.
@xumia the conflict will be handled soon, can you please approve the PR?

StormLiangMS · 2023-06-29T15:09:11Z

@ycoheNvidia not in this PR, but I'm trying to understand the behavior when we have this feature. In the HLD, it says that it read the enable from BIOS, if read failure, it fall into non secure case to continue the install/boot, or failed to install or boot?

DavidZagury · 2023-06-29T17:27:20Z

@ycoheNvidia not in this PR, but I'm trying to understand the behavior when we have this feature. In the HLD, it says that it read the enable from BIOS, if read failure, it fall into non secure case to continue the install/boot, or failed to install or boot?

@StormLiangMS If Secure Boot is not supported on the devices BIOS it will be installed and boot without any validation on the signature.
This is done this way to be able to install the same image also on devices that don't support the Secure Boot feature.

- What I did Added support for secure upgrade. - How I did it During sonic_installer install, added secure upgrade image verification. HLD can be found in the following PR: sonic-net/SONiC#1024 - Why I did it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. - How I did it Feature includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). - How to verify it In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future.

mssonicbld · 2023-06-30T13:10:33Z

Cherry-pick PR to 202211: #15690

- What I did Added support for secure upgrade. - How I did it During sonic_installer install, added secure upgrade image verification. HLD can be found in the following PR: sonic-net/SONiC#1024 - Why I did it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. - How I did it Feature includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). - How to verify it In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future.

mssonicbld · 2023-06-30T13:10:38Z

Cherry-pick PR to 202305: #15691

- What I did Added support for secure upgrade. - How I did it During sonic_installer install, added secure upgrade image verification. HLD can be found in the following PR: sonic-net/SONiC#1024 - Why I did it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. - How I did it Feature includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). - How to verify it In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future.

- What I did Added support for secure upgrade. - How I did it During sonic_installer install, added secure upgrade image verification. HLD can be found in the following PR: sonic-net/SONiC#1024 - Why I did it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. - How I did it Feature includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). - How to verify it In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future. Co-authored-by: ycoheNvidia <99744138+ycoheNvidia@users.noreply.github.com>

#### What I did Added support for secure upgrade #### How I did it It includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). HLD can be found in the following PR: sonic-net/SONiC#1024 #### How to verify it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. #### Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future. sonic-buildimage PR: sonic-net/sonic-buildimage#11862

- What I did Added support for secure upgrade. - How I did it During sonic_installer install, added secure upgrade image verification. HLD can be found in the following PR: sonic-net/SONiC#1024 - Why I did it Feature is used to allow image was not modified since built from vendor. During installation, image can be verified with a signature attached to it. - How I did it Feature includes image signing during build (in sonic buildimage repo) and verification during image install (in sonic-utilities). - How to verify it In order for image verification - image must be signed - need to provide signing key and certificate (paths in SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT in rules/config) during build , and during image install, need to enable secure boot flag in bios, and signing_certificate should be available in bios. - Feature dependencies In order for this feature to work smoothly, need to have secure boot feature implemented as well. The Secure boot feature will be merged in the near future.

Highlight change, the DHCP config removed from master branch. files/image_config/resolv-config/resolv.conf Related work items: sonic-net#49, sonic-net#2598, sonic-net#11862, sonic-net#12530, sonic-net#14000, sonic-net#14549, sonic-net#14814, sonic-net#15077, sonic-net#15252, sonic-net#15253, sonic-net#15357, sonic-net#15384, sonic-net#15394, sonic-net#15399, sonic-net#15405, sonic-net#15566, sonic-net#15591, sonic-net#15592, sonic-net#15593, sonic-net#15602, sonic-net#15604, sonic-net#15611, sonic-net#15621, sonic-net#15625, sonic-net#15634, sonic-net#15635

Merge code from master to internal Related work items: sonic-net#32, sonic-net#49, sonic-net#376, sonic-net#2598, sonic-net#11862, sonic-net#12530, sonic-net#14000, sonic-net#14547, sonic-net#14549, sonic-net#14814, sonic-net#15077, sonic-net#15239, sonic-net#15252, sonic-net#15253, sonic-net#15298, sonic-net#15357, sonic-net#15384, sonic-net#15394, sonic-net#15399, sonic-net#15405, sonic-net#15511, sonic-net#15566, sonic-net#15583, sonic-net#15591, sonic-net#15592, sonic-net#15593, sonic-net#15602, sonic-net#15604, sonic-net#15611, sonic-net#15621, sonic-net#15625, sonic-net#15634, sonic-net#15635, sonic-net#15645, sonic-net#15646, sonic-net#15647, sonic-net#15657, sonic-net#15658, sonic-net#15697, sonic-net#15699

ycoheNvidia and others added 6 commits August 15, 2022 15:05

Implemented secure upgrade

41665e5

Fixed weird binary related sha1 issue

5848e45

Fixed sha1 installer issue

b3fdcb4

Fixed minor sharch_body.sh issue

e11fb1d

minor typo fix

56c9fa6

newline

f44a67b

ycoheNvidia requested review from qiluo-msft, xumia and lguohan as code owners August 28, 2022 07:47

This was referenced Aug 28, 2022

Secure upgrade sonic-net/sonic-utilities#2337

Merged

Secure upgrade HLD sonic-net/SONiC#1024

Merged

zhangyanzhao requested a review from yxieca November 11, 2022 20:07

xumia reviewed Nov 14, 2022

View reviewed changes

davidpil2002 mentioned this pull request Nov 28, 2022

Secure Boot HLD sonic-net/SONiC#1028

Merged

fixed secure upgrade image creation bug copying irrelevant files to i…

02d126a

…mage

Merge branch 'master' into secure_upgrade

ea214ef

liat-grozovik changed the title ~~Secure upgrade~~ Add support for secure upgrade Feb 6, 2023

Merge branch 'sonic-net:master' into secure_upgrade

1de4175

davidpil2002 mentioned this pull request Feb 27, 2023

Add Secure Boot Support #12692

Merged

9 tasks

ycoheNvidia mentioned this pull request Feb 28, 2023

Add support for secure upgrade sonic-net/sonic-utilities#2698

Merged

Merge branch 'master' into secure_upgrade

19c4118

liat-grozovik added the Request for 202211 Branch label Mar 1, 2023

ycoheNvidia force-pushed the secure_upgrade branch from 7d7b567 to f43f02d Compare May 30, 2023 06:57

Merge branch 'sonic-net:master' into secure_upgrade

7faa74c

DavidZagury added a commit to DavidZagury/sonic-buildimage that referenced this pull request May 31, 2023

[202211_SPC4] Add support for secure upgrade sonic-net#11862

2f05ccd

qiluo-msft approved these changes Jun 5, 2023

View reviewed changes

liat-grozovik merged commit ccf1cd5 into sonic-net:master Jun 26, 2023

liat-grozovik added the Request for 202305 Branch label Jun 26, 2023

StormLiangMS added Approved for 202211 Branch Approved for 202305 Branch labels Jun 30, 2023

mssonicbld added the Created PR to 202211 Branch label Jun 30, 2023

mssonicbld mentioned this pull request Jun 30, 2023

[action] [PR:11862] Add support for secure upgrade #15690

Merged

mssonicbld added the Created PR to 202305 Branch label Jun 30, 2023

mssonicbld mentioned this pull request Jun 30, 2023

[action] [PR:11862] Add support for secure upgrade #15691

Merged

mssonicbld added Included in 202211 Branch and removed Approved for 202211 Branch Created PR to 202211 Branch labels Jul 12, 2023

mssonicbld added Included in 202305 Branch and removed Created PR to 202305 Branch labels Jul 19, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for secure upgrade #11862

Add support for secure upgrade #11862

ycoheNvidia commented Aug 28, 2022 •

edited

Loading

linux-foundation-easycla bot commented Aug 28, 2022 •

edited

Loading

liat-grozovik commented Oct 30, 2022

xumia Nov 14, 2022 •

edited

Loading

ycoheNvidia Nov 14, 2022

liat-grozovik commented Jan 29, 2023

liat-grozovik commented Feb 6, 2023

azure-pipelines bot commented Feb 6, 2023

ycoheNvidia commented Feb 21, 2023 •

edited

Loading

liat-grozovik commented Mar 1, 2023

StormLiangMS commented Jun 29, 2023

DavidZagury commented Jun 29, 2023

mssonicbld commented Jun 30, 2023

mssonicbld commented Jun 30, 2023

Add support for secure upgrade #11862

Add support for secure upgrade #11862

Conversation

ycoheNvidia commented Aug 28, 2022 • edited Loading

What I did

How I did it

Why I did it

How I did it

How to verify it

Feature dependencies

linux-foundation-easycla bot commented Aug 28, 2022 • edited Loading

liat-grozovik commented Oct 30, 2022

xumia Nov 14, 2022 • edited Loading

Choose a reason for hiding this comment

ycoheNvidia Nov 14, 2022

Choose a reason for hiding this comment

liat-grozovik commented Jan 29, 2023

liat-grozovik commented Feb 6, 2023

azure-pipelines bot commented Feb 6, 2023

ycoheNvidia commented Feb 21, 2023 • edited Loading

liat-grozovik commented Mar 1, 2023

StormLiangMS commented Jun 29, 2023

DavidZagury commented Jun 29, 2023

mssonicbld commented Jun 30, 2023

mssonicbld commented Jun 30, 2023

ycoheNvidia commented Aug 28, 2022 •

edited

Loading

linux-foundation-easycla bot commented Aug 28, 2022 •

edited

Loading

xumia Nov 14, 2022 •

edited

Loading

ycoheNvidia commented Feb 21, 2023 •

edited

Loading