nacl_validation_query.h 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_NACL_LOADER_NACL_VALIDATION_QUERY_H_
  5. #define COMPONENTS_NACL_LOADER_NACL_VALIDATION_QUERY_H_
  6. #include <stddef.h>
  7. #include <string>
  8. #include "base/memory/raw_ptr.h"
  9. #include "base/strings/string_piece.h"
  10. #include "crypto/hmac.h"
  11. struct NaClValidationCache;
  12. class NaClValidationDB;
  13. class NaClValidationQuery;
  14. class NaClValidationQueryContext {
  15. public:
  16. NaClValidationQueryContext(NaClValidationDB* db,
  17. const std::string& profile_key,
  18. const std::string& nacl_version);
  19. NaClValidationQuery* CreateQuery();
  20. private:
  21. raw_ptr<NaClValidationDB> db_;
  22. // A key used by HMAC that is specific to this installation of Chrome.
  23. std::string profile_key_;
  24. // Bytes indicating the "version" of the validator being used. This is used
  25. // to implicitly invalidate the cache - changing the version will change the
  26. // hashes that are produced.
  27. std::string nacl_version_;
  28. };
  29. class NaClValidationQuery {
  30. public:
  31. // SHA256 digest size.
  32. static const size_t kDigestLength = 32;
  33. NaClValidationQuery(NaClValidationDB* db, const std::string& profile_key);
  34. NaClValidationQuery(const NaClValidationQuery&) = delete;
  35. NaClValidationQuery& operator=(const NaClValidationQuery&) = delete;
  36. void AddData(const char* data, size_t length);
  37. void AddData(const unsigned char* data, size_t length);
  38. void AddData(const base::StringPiece& data);
  39. int QueryKnownToValidate();
  40. void SetKnownToValidate();
  41. private:
  42. enum QueryState {
  43. READY,
  44. GET_CALLED,
  45. SET_CALLED
  46. };
  47. // The HMAC interface currently does not support incremental signing. To work
  48. // around this, each piece of data is signed and the signature is added to a
  49. // buffer. If there is not enough space in the buffer to accommodate new
  50. // data, the buffer contents are signed and the new signature replaces the
  51. // contents of the buffer. CompressBuffer performs this operation. In
  52. // affect, a hash tree is constructed to emulate incremental signing.
  53. void CompressBuffer();
  54. // Track the state of the query to detect suspicious method calls.
  55. QueryState state_;
  56. crypto::HMAC hasher_;
  57. raw_ptr<NaClValidationDB> db_;
  58. // The size of buffer_ is a somewhat arbitrary choice. It needs to be at
  59. // at least kDigestLength * 2, but it can be arbitrarily large. In practice
  60. // there are 4 calls to AddData (version, architechture, cpu features, and
  61. // code), so 4 times digest length means the buffer will not need to be
  62. // compressed as an intermediate step in the expected use cases.
  63. char buffer_[kDigestLength * 4];
  64. size_t buffer_length_;
  65. };
  66. // Create a validation cache interface for use by sel_ldr.
  67. struct NaClValidationCache* CreateValidationCache(
  68. NaClValidationDB* db, const std::string& profile_key,
  69. const std::string& nacl_version);
  70. #endif // COMPONENTS_NACL_LOADER_NACL_VALIDATION_QUERY_H_