| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "extensions/browser/verified_contents.h" | 5 #include "extensions/browser/verified_contents.h" |
| 6 | 6 |
| 7 #include <stddef.h> |
| 8 |
| 7 #include "base/base64url.h" | 9 #include "base/base64url.h" |
| 8 #include "base/files/file_util.h" | 10 #include "base/files/file_util.h" |
| 9 #include "base/json/json_reader.h" | 11 #include "base/json/json_reader.h" |
| 10 #include "base/strings/string_util.h" | 12 #include "base/strings/string_util.h" |
| 11 #include "base/values.h" | 13 #include "base/values.h" |
| 12 #include "components/crx_file/id_util.h" | 14 #include "components/crx_file/id_util.h" |
| 13 #include "crypto/signature_verifier.h" | 15 #include "crypto/signature_verifier.h" |
| 14 #include "extensions/common/extension.h" | 16 #include "extensions/common/extension.h" |
| 15 | 17 |
| 16 using base::DictionaryValue; | 18 using base::DictionaryValue; |
| 17 using base::ListValue; | 19 using base::ListValue; |
| 18 using base::Value; | 20 using base::Value; |
| 19 | 21 |
| 20 namespace { | 22 namespace { |
| 21 | 23 |
| 22 // Note: this structure is an ASN.1 which encodes the algorithm used with its | 24 // Note: this structure is an ASN.1 which encodes the algorithm used with its |
| 23 // parameters. The signature algorithm is "RSA256" aka "RSASSA-PKCS-v1_5 using | 25 // parameters. The signature algorithm is "RSA256" aka "RSASSA-PKCS-v1_5 using |
| 24 // SHA-256 hash algorithm". This is defined in PKCS #1 (RFC 3447). | 26 // SHA-256 hash algorithm". This is defined in PKCS #1 (RFC 3447). |
| 25 // It is encoding: { OID sha256WithRSAEncryption PARAMETERS NULL } | 27 // It is encoding: { OID sha256WithRSAEncryption PARAMETERS NULL } |
| 26 const uint8 kSignatureAlgorithm[15] = {0x30, 0x0d, 0x06, 0x09, 0x2a, | 28 const uint8_t kSignatureAlgorithm[15] = {0x30, 0x0d, 0x06, 0x09, 0x2a, |
| 27 0x86, 0x48, 0x86, 0xf7, 0x0d, | 29 0x86, 0x48, 0x86, 0xf7, 0x0d, |
| 28 0x01, 0x01, 0x0b, 0x05, 0x00}; | 30 0x01, 0x01, 0x0b, 0x05, 0x00}; |
| 29 | 31 |
| 30 const char kBlockSizeKey[] = "block_size"; | 32 const char kBlockSizeKey[] = "block_size"; |
| 31 const char kContentHashesKey[] = "content_hashes"; | 33 const char kContentHashesKey[] = "content_hashes"; |
| 32 const char kDescriptionKey[] = "description"; | 34 const char kDescriptionKey[] = "description"; |
| 33 const char kFilesKey[] = "files"; | 35 const char kFilesKey[] = "files"; |
| 34 const char kFormatKey[] = "format"; | 36 const char kFormatKey[] = "format"; |
| 35 const char kHashBlockSizeKey[] = "hash_block_size"; | 37 const char kHashBlockSizeKey[] = "hash_block_size"; |
| 36 const char kHeaderKidKey[] = "header.kid"; | 38 const char kHeaderKidKey[] = "header.kid"; |
| 37 const char kItemIdKey[] = "item_id"; | 39 const char kItemIdKey[] = "item_id"; |
| 38 const char kItemVersionKey[] = "item_version"; | 40 const char kItemVersionKey[] = "item_version"; |
| (...skipping 21 matching lines...) Expand all Loading... |
| 60 if (dictionary->GetString(key, &found_value) && found_value == value) | 62 if (dictionary->GetString(key, &found_value) && found_value == value) |
| 61 return dictionary; | 63 return dictionary; |
| 62 } | 64 } |
| 63 return NULL; | 65 return NULL; |
| 64 } | 66 } |
| 65 | 67 |
| 66 } // namespace | 68 } // namespace |
| 67 | 69 |
| 68 namespace extensions { | 70 namespace extensions { |
| 69 | 71 |
| 70 VerifiedContents::VerifiedContents(const uint8* public_key, int public_key_size) | 72 VerifiedContents::VerifiedContents(const uint8_t* public_key, |
| 73 int public_key_size) |
| 71 : public_key_(public_key), | 74 : public_key_(public_key), |
| 72 public_key_size_(public_key_size), | 75 public_key_size_(public_key_size), |
| 73 valid_signature_(false), // Guilty until proven innocent. | 76 valid_signature_(false), // Guilty until proven innocent. |
| 74 block_size_(0) { | 77 block_size_(0) {} |
| 75 } | |
| 76 | 78 |
| 77 VerifiedContents::~VerifiedContents() { | 79 VerifiedContents::~VerifiedContents() { |
| 78 } | 80 } |
| 79 | 81 |
| 80 // The format of the payload json is: | 82 // The format of the payload json is: |
| 81 // { | 83 // { |
| 82 // "item_id": "<extension id>", | 84 // "item_id": "<extension id>", |
| 83 // "item_version": "<extension version>", | 85 // "item_version": "<extension version>", |
| 84 // "content_hashes": [ | 86 // "content_hashes": [ |
| 85 // { | 87 // { |
| (...skipping 213 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 299 return false; | 301 return false; |
| 300 | 302 |
| 301 return true; | 303 return true; |
| 302 } | 304 } |
| 303 | 305 |
| 304 bool VerifiedContents::VerifySignature(const std::string& protected_value, | 306 bool VerifiedContents::VerifySignature(const std::string& protected_value, |
| 305 const std::string& payload, | 307 const std::string& payload, |
| 306 const std::string& signature_bytes) { | 308 const std::string& signature_bytes) { |
| 307 crypto::SignatureVerifier signature_verifier; | 309 crypto::SignatureVerifier signature_verifier; |
| 308 if (!signature_verifier.VerifyInit( | 310 if (!signature_verifier.VerifyInit( |
| 309 kSignatureAlgorithm, | 311 kSignatureAlgorithm, sizeof(kSignatureAlgorithm), |
| 310 sizeof(kSignatureAlgorithm), | 312 reinterpret_cast<const uint8_t*>(signature_bytes.data()), |
| 311 reinterpret_cast<const uint8*>(signature_bytes.data()), | 313 signature_bytes.size(), public_key_, public_key_size_)) { |
| 312 signature_bytes.size(), | |
| 313 public_key_, | |
| 314 public_key_size_)) { | |
| 315 VLOG(1) << "Could not verify signature - VerifyInit failure"; | 314 VLOG(1) << "Could not verify signature - VerifyInit failure"; |
| 316 return false; | 315 return false; |
| 317 } | 316 } |
| 318 | 317 |
| 319 signature_verifier.VerifyUpdate( | 318 signature_verifier.VerifyUpdate( |
| 320 reinterpret_cast<const uint8*>(protected_value.data()), | 319 reinterpret_cast<const uint8_t*>(protected_value.data()), |
| 321 protected_value.size()); | 320 protected_value.size()); |
| 322 | 321 |
| 323 std::string dot("."); | 322 std::string dot("."); |
| 324 signature_verifier.VerifyUpdate(reinterpret_cast<const uint8*>(dot.data()), | 323 signature_verifier.VerifyUpdate(reinterpret_cast<const uint8_t*>(dot.data()), |
| 325 dot.size()); | 324 dot.size()); |
| 326 | 325 |
| 327 signature_verifier.VerifyUpdate( | 326 signature_verifier.VerifyUpdate( |
| 328 reinterpret_cast<const uint8*>(payload.data()), payload.size()); | 327 reinterpret_cast<const uint8_t*>(payload.data()), payload.size()); |
| 329 | 328 |
| 330 if (!signature_verifier.VerifyFinal()) { | 329 if (!signature_verifier.VerifyFinal()) { |
| 331 VLOG(1) << "Could not verify signature - VerifyFinal failure"; | 330 VLOG(1) << "Could not verify signature - VerifyFinal failure"; |
| 332 return false; | 331 return false; |
| 333 } | 332 } |
| 334 return true; | 333 return true; |
| 335 } | 334 } |
| 336 | 335 |
| 337 } // namespace extensions | 336 } // namespace extensions |
| OLD | NEW |