components/nacl/loader/nacl_validation_query.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "components/nacl/loader/nacl_validation_query.h"
   6
   7 #include "base/logging.h"
   8 #include "components/nacl/loader/nacl_validation_db.h"
   9 #include "crypto/nss_util.h"
  10 #include "native_client/src/include/portability.h"
  11 #include "native_client/src/public/validation_cache.h"
  12
  13 NaClValidationQueryContext::NaClValidationQueryContext(
  14     NaClValidationDB* db,
  15     const std::string& profile_key,
  16     const std::string& nacl_version)
  17     : db_(db),
  18       profile_key_(profile_key),
  19       nacl_version_(nacl_version) {
  20
  21   // Sanity checks.
  22   CHECK(profile_key.length() >= 8);
  23   CHECK(nacl_version.length() >= 4);
  24 }
  25
  26 NaClValidationQuery* NaClValidationQueryContext::CreateQuery() {
  27   NaClValidationQuery* query = new NaClValidationQuery(db_, profile_key_);
  28   // Changing the version effectively invalidates existing hashes.
  29   query->AddData(nacl_version_);
  30   return query;
  31 }
  32
  33 NaClValidationQuery::NaClValidationQuery(NaClValidationDB* db,
  34                                          const std::string& profile_key)
  35     : state_(READY),
  36       hasher_(crypto::HMAC::SHA256),
  37       db_(db),
  38       buffer_length_(0) {
  39   CHECK(hasher_.Init(profile_key));
  40 }
  41
  42 void NaClValidationQuery::AddData(const char* data, size_t length) {
  43   CHECK(state_ == READY);
  44   CHECK(buffer_length_ <= sizeof(buffer_));
  45   // Chrome's HMAC class doesn't support incremental signing.  Work around
  46   // this by using a (small) temporary buffer to accumulate data.
  47   // Check if there is space in the buffer.
  48   if (buffer_length_ + kDigestLength > sizeof(buffer_)) {
  49     // Hash the buffer to make space.
  50     CompressBuffer();
  51   }
  52   // Hash the input data into the buffer.  Assumes that sizeof(buffer_) >=
  53   // kDigestLength * 2 (the buffer can store at least two digests.)
  54   CHECK(hasher_.Sign(base::StringPiece(data, length),
  55                      reinterpret_cast<unsigned char*>(buffer_ + buffer_length_),
  56                      kDigestLength));
  57   buffer_length_ += kDigestLength;
  58 }
  59
  60 void NaClValidationQuery::AddData(const unsigned char* data, size_t length) {
  61   AddData(reinterpret_cast<const char*>(data), length);
  62 }
  63
  64 void NaClValidationQuery::AddData(const base::StringPiece& data) {
  65   AddData(data.data(), data.length());
  66 }
  67
  68 int NaClValidationQuery::QueryKnownToValidate() {
  69   CHECK(state_ == READY);
  70   // It is suspicious if we have less than a digest's worth of data.
  71   CHECK(buffer_length_ >= kDigestLength);
  72   CHECK(buffer_length_ <= sizeof(buffer_));
  73   state_ = GET_CALLED;
  74   // Ensure the buffer contains only one digest worth of data.
  75   CompressBuffer();
  76   return db_->QueryKnownToValidate(std::string(buffer_, buffer_length_));
  77 }
  78
  79 void NaClValidationQuery::SetKnownToValidate() {
  80   CHECK(state_ == GET_CALLED);
  81   CHECK(buffer_length_ == kDigestLength);
  82   state_ = SET_CALLED;
  83   db_->SetKnownToValidate(std::string(buffer_, buffer_length_));
  84 }
  85
  86 // Reduce the size of the data in the buffer by hashing it and writing it back
  87 // to the buffer.
  88 void NaClValidationQuery::CompressBuffer() {
  89   // Calculate the digest into a temp buffer.  It is likely safe to calculate it
  90   // directly back into the buffer, but this is an "accidental" semantic we're
  91   // avoiding depending on.
  92   unsigned char temp[kDigestLength];
  93   CHECK(hasher_.Sign(base::StringPiece(buffer_, buffer_length_), temp,
  94                      kDigestLength));
  95   memcpy(buffer_, temp, kDigestLength);
  96   buffer_length_ = kDigestLength;
  97 }
  98
  99 // OO wrappers
 100
 101 static void* CreateQuery(void* handle) {
 102   return static_cast<NaClValidationQueryContext*>(handle)->CreateQuery();
 103 }
 104
 105 static void AddData(void* query, const uint8* data, size_t length) {
 106   static_cast<NaClValidationQuery*>(query)->AddData(data, length);
 107 }
 108
 109 static int QueryKnownToValidate(void* query) {
 110   return static_cast<NaClValidationQuery*>(query)->QueryKnownToValidate();
 111 }
 112
 113 static void SetKnownToValidate(void* query) {
 114   static_cast<NaClValidationQuery*>(query)->SetKnownToValidate();
 115 }
 116
 117 static void DestroyQuery(void* query) {
 118   delete static_cast<NaClValidationQuery*>(query);
 119 }
 120
 121 struct NaClValidationCache* CreateValidationCache(
 122     NaClValidationDB* db, const std::string& profile_key,
 123     const std::string& nacl_version) {
 124   NaClValidationCache* cache =
 125       static_cast<NaClValidationCache*>(malloc(sizeof(NaClValidationCache)));
 126   // Make sure any fields introduced in a cross-repo change are zeroed.
 127   memset(cache, 0, sizeof(*cache));
 128   cache->handle = new NaClValidationQueryContext(db, profile_key, nacl_version);
 129   cache->CreateQuery = CreateQuery;
 130   cache->AddData = AddData;
 131   cache->QueryKnownToValidate = QueryKnownToValidate;
 132   cache->SetKnownToValidate = SetKnownToValidate;
 133   cache->DestroyQuery = DestroyQuery;
 134   return cache;
 135 }