Skip to content

Commit 33080c3

Browse files
umbynosumbynos
authoredSep 26, 2023
Add signature verification to V2 tool install endpoint (#826)
* modify examples * add signature * goa gen github.com/arduino/arduino-create-agent/design * make signatureKey global * move `verifyCommandLine` to utilities package * implement signature verification in case of tool install with URL The endpoint affected is `/v2/pkgs/tools/installed`. If the signature is invalid the endpoint returns 500 with "rsa verification error" If the signature is not present we try to install the tool using "name, version, packager" arguments * use subtests and add test cases
·
1.7.1-rc11.3.3-rc2
1 parent e740ad9 commit 33080c3

File tree

16 files changed

+304
-169
lines changed

16 files changed

+304
-169
lines changed
 

‎conn.go

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,7 @@ package main
1919

2020
import (
2121
"bytes"
22-
"crypto"
23-
"crypto/rsa"
24-
"crypto/sha256"
25-
"crypto/x509"
26-
"encoding/hex"
2722
"encoding/json"
28-
"encoding/pem"
29-
"errors"
3023
"fmt"
3124
"net/http"
3225
"os"
@@ -114,7 +107,7 @@ func uploadHandler(c *gin.Context) {
114107
return
115108
}
116109

117-
err := verifyCommandLine(data.Commandline, data.Signature)
110+
err := utilities.VerifyInput(data.Commandline, data.Signature)
118111

119112
if err != nil {
120113
c.String(http.StatusBadRequest, "signature is invalid")
@@ -219,23 +212,6 @@ func send(args map[string]string) {
219212
h.broadcastSys <- mapB
220213
}
221214

222-
func verifyCommandLine(input string, signature string) error {
223-
sign, _ := hex.DecodeString(signature)
224-
block, _ := pem.Decode([]byte(*signatureKey))
225-
if block == nil {
226-
return errors.New("invalid key")
227-
}
228-
key, err := x509.ParsePKIXPublicKey(block.Bytes)
229-
if err != nil {
230-
return err
231-
}
232-
rsaKey := key.(*rsa.PublicKey)
233-
h := sha256.New()
234-
h.Write([]byte(input))
235-
d := h.Sum(nil)
236-
return rsa.VerifyPKCS1v15(rsaKey, crypto.SHA256, d, sign)
237-
}
238-
239215
func wsHandler() *WsServer {
240216
server, err := socketio.NewServer(nil)
241217
if err != nil {

‎design/pkgs.go

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -110,20 +110,29 @@ var ToolPayload = Type("arduino.tool", func() {
110110
TypeName("ToolPayload")
111111

112112
Attribute("name", String, "The name of the tool", func() {
113-
Example("avrdude")
113+
Example("bossac")
114114
})
115115
Attribute("version", String, "The version of the tool", func() {
116-
Example("6.3.0-arduino9")
116+
Example("1.7.0-arduino3")
117117
})
118118
Attribute("packager", String, "The packager of the tool", func() {
119119
Example("arduino")
120120
})
121121

122122
Attribute("url", String, `The url where the package can be found. Optional.
123-
If present checksum must also be present.`)
123+
If present checksum must also be present.`, func() {
124+
Example("http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz")
125+
})
124126

125127
Attribute("checksum", String, `A checksum of the archive. Mandatory when url is present.
126-
This ensures that the package is downloaded correcly.`)
128+
This ensures that the package is downloaded correcly.`, func() {
129+
Example("SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100")
130+
})
131+
132+
Attribute("signature", String, `The signature used to sign the url. Mandatory when url is present.
133+
This ensure the security of the file downloaded`, func() {
134+
Example("382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0")
135+
})
127136

128137
Required("name", "version", "packager")
129138
})

‎gen/http/cli/arduino_create_agent/cli.go

Lines changed: 9 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎gen/http/openapi.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎gen/http/openapi.yaml

Lines changed: 52 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ paths:
2626
type: array
2727
items:
2828
type: string
29-
example: Repudiandae dignissimos consectetur eos molestiae culpa soluta.
29+
example: Pariatur laudantium inventore qui.
3030
"400":
3131
description: Bad Request response.
3232
schema:
@@ -193,14 +193,14 @@ definitions:
193193
timeout:
194194
type: boolean
195195
description: Is the error a timeout?
196-
example: false
196+
example: true
197197
description: url invalid (default view)
198198
example:
199199
fault: false
200200
id: 123abc
201201
message: parameter 'p' must be an integer
202202
name: bad_request
203-
temporary: false
203+
temporary: true
204204
timeout: false
205205
required:
206206
- name
@@ -241,7 +241,7 @@ definitions:
241241
fault:
242242
type: boolean
243243
description: Is the error a server-side fault?
244-
example: true
244+
example: false
245245
id:
246246
type: string
247247
description: ID is a unique identifier for this particular occurrence of the problem.
@@ -261,14 +261,14 @@ definitions:
261261
timeout:
262262
type: boolean
263263
description: Is the error a timeout?
264-
example: false
264+
example: true
265265
description: url invalid (default view)
266266
example:
267-
fault: true
267+
fault: false
268268
id: 123abc
269269
message: parameter 'p' must be an integer
270270
name: bad_request
271-
temporary: true
271+
temporary: false
272272
timeout: true
273273
required:
274274
- name
@@ -284,7 +284,7 @@ definitions:
284284
fault:
285285
type: boolean
286286
description: Is the error a server-side fault?
287-
example: false
287+
example: true
288288
id:
289289
type: string
290290
description: ID is a unique identifier for this particular occurrence of the problem.
@@ -300,19 +300,19 @@ definitions:
300300
temporary:
301301
type: boolean
302302
description: Is the error temporary?
303-
example: true
303+
example: false
304304
timeout:
305305
type: boolean
306306
description: Is the error a timeout?
307-
example: true
307+
example: false
308308
description: url invalid (default view)
309309
example:
310-
fault: false
310+
fault: true
311311
id: 123abc
312312
message: parameter 'p' must be an integer
313313
name: bad_request
314314
temporary: true
315-
timeout: false
315+
timeout: true
316316
required:
317317
- name
318318
- id
@@ -352,20 +352,20 @@ definitions:
352352
name:
353353
type: string
354354
description: The name of the tool
355-
example: avrdude
355+
example: bossac
356356
packager:
357357
type: string
358358
description: The packager of the tool
359359
example: arduino
360360
version:
361361
type: string
362362
description: The version of the tool
363-
example: 6.3.0-arduino9
363+
example: 1.7.0-arduino3
364364
description: A tool is an executable program that can upload sketches. (default view)
365365
example:
366-
name: avrdude
366+
name: bossac
367367
packager: arduino
368-
version: 6.3.0-arduino9
368+
version: 1.7.0-arduino3
369369
required:
370370
- name
371371
- version
@@ -377,29 +377,36 @@ definitions:
377377
checksum:
378378
type: string
379379
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
380-
example: Totam cum inventore exercitationem in.
380+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
381381
name:
382382
type: string
383383
description: The name of the tool
384-
example: avrdude
384+
example: bossac
385385
packager:
386386
type: string
387387
description: The packager of the tool
388388
example: arduino
389+
signature:
390+
type: string
391+
description: |-
392+
The signature used to sign the url. Mandatory when url is present.
393+
This ensure the security of the file downloaded
394+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
389395
url:
390396
type: string
391397
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
392-
example: Totam vero ipsum corporis nihil voluptatem id.
398+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
393399
version:
394400
type: string
395401
description: The version of the tool
396-
example: 6.3.0-arduino9
402+
example: 1.7.0-arduino3
397403
example:
398-
checksum: Modi dolorem reprehenderit perspiciatis illo aspernatur.
399-
name: avrdude
404+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
405+
name: bossac
400406
packager: arduino
401-
url: Officia optio inventore atque in voluptatibus qui.
402-
version: 6.3.0-arduino9
407+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
408+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
409+
version: 1.7.0-arduino3
403410
required:
404411
- name
405412
- version
@@ -424,14 +431,21 @@ definitions:
424431
checksum:
425432
type: string
426433
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
427-
example: Et qui id et cumque illo.
434+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
435+
signature:
436+
type: string
437+
description: |-
438+
The signature used to sign the url. Mandatory when url is present.
439+
This ensure the security of the file downloaded
440+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
428441
url:
429442
type: string
430443
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
431-
example: Officia maiores reiciendis est nemo.
444+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
432445
example:
433-
checksum: Corporis eum et numquam sapiente.
434-
url: Est voluptatem eos reprehenderit quo sint quod.
446+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
447+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
448+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
435449
ToolsRemoveResponseBody:
436450
title: 'Mediatype identifier: application/vnd.arduino.operation; view=default'
437451
type: object
@@ -452,9 +466,15 @@ definitions:
452466
$ref: '#/definitions/ToolResponse'
453467
description: AvailableResponseBody is the result type for an array of ToolResponse (default view)
454468
example:
455-
- name: avrdude
469+
- name: bossac
470+
packager: arduino
471+
version: 1.7.0-arduino3
472+
- name: bossac
473+
packager: arduino
474+
version: 1.7.0-arduino3
475+
- name: bossac
456476
packager: arduino
457-
version: 6.3.0-arduino9
458-
- name: avrdude
477+
version: 1.7.0-arduino3
478+
- name: bossac
459479
packager: arduino
460-
version: 6.3.0-arduino9
480+
version: 1.7.0-arduino3

‎gen/http/openapi3.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎gen/http/openapi3.yaml

Lines changed: 72 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,17 @@ paths:
2222
type: array
2323
items:
2424
type: string
25-
example: Eveniet iure nihil optio qui.
25+
example: Rerum et soluta laudantium.
2626
example:
27-
- Et perferendis eveniet voluptas.
28-
- Ut aut illum eaque dolor magni.
29-
- Amet illo veritatis laudantium optio.
27+
- Et deserunt.
28+
- Impedit iusto libero explicabo.
29+
- Dolor adipisci nulla.
30+
- Quam voluptas voluptates expedita rem ipsum.
3031
example:
31-
- Illo enim vero qui rerum ut inventore.
32-
- Dolorem nihil autem minima alias.
32+
- Dignissimos consectetur eos molestiae culpa soluta deserunt.
33+
- Nobis sint dolorem unde.
34+
- Quia doloremque.
35+
- Atque iusto tempore sit quod dolor repellat.
3336
"400":
3437
description: 'invalid_url: url invalid'
3538
content:
@@ -108,15 +111,15 @@ paths:
108111
schema:
109112
$ref: '#/components/schemas/ToolCollection'
110113
example:
111-
- name: avrdude
114+
- name: bossac
112115
packager: arduino
113-
version: 6.3.0-arduino9
114-
- name: avrdude
116+
version: 1.7.0-arduino3
117+
- name: bossac
115118
packager: arduino
116-
version: 6.3.0-arduino9
117-
- name: avrdude
119+
version: 1.7.0-arduino3
120+
- name: bossac
118121
packager: arduino
119-
version: 6.3.0-arduino9
122+
version: 1.7.0-arduino3
120123
/v2/pkgs/tools/installed:
121124
get:
122125
tags:
@@ -131,15 +134,15 @@ paths:
131134
schema:
132135
$ref: '#/components/schemas/ToolCollection'
133136
example:
134-
- name: avrdude
137+
- name: bossac
135138
packager: arduino
136-
version: 6.3.0-arduino9
137-
- name: avrdude
139+
version: 1.7.0-arduino3
140+
- name: bossac
138141
packager: arduino
139-
version: 6.3.0-arduino9
140-
- name: avrdude
142+
version: 1.7.0-arduino3
143+
- name: bossac
141144
packager: arduino
142-
version: 6.3.0-arduino9
145+
version: 1.7.0-arduino3
143146
post:
144147
tags:
145148
- tools
@@ -152,11 +155,12 @@ paths:
152155
schema:
153156
$ref: '#/components/schemas/InstallRequestBody'
154157
example:
155-
checksum: Beatae dolor adipisci nulla et quam voluptas.
156-
name: avrdude
158+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
159+
name: bossac
157160
packager: arduino
158-
url: Deserunt voluptatem impedit iusto libero.
159-
version: 6.3.0-arduino9
161+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
162+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
163+
version: 1.7.0-arduino3
160164
responses:
161165
"200":
162166
description: OK response.
@@ -189,26 +193,27 @@ paths:
189193
schema:
190194
type: string
191195
description: The name of the tool
192-
example: avrdude
193-
example: avrdude
196+
example: bossac
197+
example: bossac
194198
- name: version
195199
in: path
196200
description: The version of the tool
197201
required: true
198202
schema:
199203
type: string
200204
description: The version of the tool
201-
example: 6.3.0-arduino9
202-
example: 6.3.0-arduino9
205+
example: 1.7.0-arduino3
206+
example: 1.7.0-arduino3
203207
requestBody:
204208
required: true
205209
content:
206210
application/json:
207211
schema:
208212
$ref: '#/components/schemas/RemoveRequestBody'
209213
example:
210-
checksum: Ipsa minima quia.
211-
url: Expedita rem ipsum quasi harum nostrum.
214+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
215+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
216+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
212217
responses:
213218
"200":
214219
description: OK response.
@@ -237,20 +242,20 @@ components:
237242
name:
238243
type: string
239244
description: The name of the tool
240-
example: avrdude
245+
example: bossac
241246
packager:
242247
type: string
243248
description: The packager of the tool
244249
example: arduino
245250
version:
246251
type: string
247252
description: The version of the tool
248-
example: 6.3.0-arduino9
253+
example: 1.7.0-arduino3
249254
description: A tool is an executable program that can upload sketches.
250255
example:
251-
name: avrdude
256+
name: bossac
252257
packager: arduino
253-
version: 6.3.0-arduino9
258+
version: 1.7.0-arduino3
254259
required:
255260
- name
256261
- version
@@ -277,7 +282,7 @@ components:
277282
temporary:
278283
type: boolean
279284
description: Is the error temporary?
280-
example: false
285+
example: true
281286
timeout:
282287
type: boolean
283288
description: Is the error a timeout?
@@ -288,8 +293,8 @@ components:
288293
id: 123abc
289294
message: parameter 'p' must be an integer
290295
name: bad_request
291-
temporary: false
292-
timeout: true
296+
temporary: true
297+
timeout: false
293298
required:
294299
- name
295300
- id
@@ -303,29 +308,36 @@ components:
303308
checksum:
304309
type: string
305310
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
306-
example: Sint odio sed consequatur numquam.
311+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
307312
name:
308313
type: string
309314
description: The name of the tool
310-
example: avrdude
315+
example: bossac
311316
packager:
312317
type: string
313318
description: The packager of the tool
314319
example: arduino
320+
signature:
321+
type: string
322+
description: |-
323+
The signature used to sign the url. Mandatory when url is present.
324+
This ensure the security of the file downloaded
325+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
315326
url:
316327
type: string
317328
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
318-
example: Et quo doloremque sapiente atque.
329+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
319330
version:
320331
type: string
321332
description: The version of the tool
322-
example: 6.3.0-arduino9
333+
example: 1.7.0-arduino3
323334
example:
324-
checksum: Mollitia commodi sunt.
325-
name: avrdude
335+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
336+
name: bossac
326337
packager: arduino
327-
url: Quae reprehenderit provident provident debitis illo.
328-
version: 6.3.0-arduino9
338+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
339+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
340+
version: 1.7.0-arduino3
329341
required:
330342
- name
331343
- version
@@ -347,31 +359,35 @@ components:
347359
checksum:
348360
type: string
349361
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
350-
example: Ea culpa.
362+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
363+
signature:
364+
type: string
365+
description: |-
366+
The signature used to sign the url. Mandatory when url is present.
367+
This ensure the security of the file downloaded
368+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
351369
url:
352370
type: string
353371
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
354-
example: Odit officiis illo qui quia provident illo.
372+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
355373
example:
356-
checksum: Rerum eum esse corporis ex.
357-
url: Molestiae dolor quaerat enim.
374+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
375+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
376+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
358377
ToolCollection:
359378
type: array
360379
items:
361380
$ref: '#/components/schemas/ArduinoTool'
362381
example:
363-
- name: avrdude
364-
packager: arduino
365-
version: 6.3.0-arduino9
366-
- name: avrdude
382+
- name: bossac
367383
packager: arduino
368-
version: 6.3.0-arduino9
369-
- name: avrdude
384+
version: 1.7.0-arduino3
385+
- name: bossac
370386
packager: arduino
371-
version: 6.3.0-arduino9
372-
- name: avrdude
387+
version: 1.7.0-arduino3
388+
- name: bossac
373389
packager: arduino
374-
version: 6.3.0-arduino9
390+
version: 1.7.0-arduino3
375391
tags:
376392
- name: indexes
377393
description: The indexes service manages the package_index files

‎gen/http/tools/client/cli.go

Lines changed: 11 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎gen/http/tools/client/types.go

Lines changed: 15 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎gen/http/tools/server/types.go

Lines changed: 15 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎gen/tools/service.go

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎globals/globals.go

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Copyright 2022 Arduino SA
2+
//
3+
// This program is free software: you can redistribute it and/or modify
4+
// it under the terms of the GNU Affero General Public License as published
5+
// by the Free Software Foundation, either version 3 of the License, or
6+
// (at your option) any later version.
7+
//
8+
// This program is distributed in the hope that it will be useful,
9+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
// GNU Affero General Public License for more details.
12+
//
13+
// You should have received a copy of the GNU Affero General Public License
14+
// along with this program. If not, see <https://www.gnu.org/licenses/>.
15+
16+
package globals
17+
18+
// DefaultIndexURL is the default index url
19+
var (
20+
// SignatureKey is the public key used to verify commands and url sent by the builder
21+
SignatureKey = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF\nIE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1\nZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1\npFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z\nCeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn\n2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9\ntwIDAQAB\n-----END PUBLIC KEY-----"
22+
)

‎main.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import (
3535
cors "github.com/andela/gin-cors"
3636
cert "github.com/arduino/arduino-create-agent/certificates"
3737
"github.com/arduino/arduino-create-agent/config"
38+
"github.com/arduino/arduino-create-agent/globals"
3839
"github.com/arduino/arduino-create-agent/systray"
3940
"github.com/arduino/arduino-create-agent/tools"
4041
"github.com/arduino/arduino-create-agent/updater"
@@ -79,7 +80,7 @@ var (
7980
logDump = iniConf.String("log", "off", "off = (default)")
8081
origins = iniConf.String("origins", "", "Allowed origin list for CORS")
8182
regExpFilter = iniConf.String("regex", "usb|acm|com", "Regular expression to filter serial port list")
82-
signatureKey = iniConf.String("signatureKey", "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF\nIE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1\nZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1\npFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z\nCeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn\n2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9\ntwIDAQAB\n-----END PUBLIC KEY-----", "Pem-encoded public key to verify signed commandlines")
83+
signatureKey = iniConf.String("signatureKey", globals.SignatureKey, "Pem-encoded public key to verify signed commandlines")
8384
updateURL = iniConf.String("updateUrl", "", "")
8485
verbose = iniConf.Bool("v", true, "show debug logging")
8586
crashreport = iniConf.Bool("crashreport", false, "enable crashreport logging")

‎main_test.go

Lines changed: 53 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"crypto/x509"
2121
"encoding/json"
2222
"encoding/pem"
23+
"fmt"
2324
"io"
2425
"net/http"
2526
"net/http/httptest"
@@ -85,34 +86,68 @@ func TestUploadHandlerAgainstEvilFileNames(t *testing.T) {
8586
}
8687
}
8788

88-
func TestInstallToolDifferentContentType(t *testing.T) {
89+
func TestInstallToolV2(t *testing.T) {
8990
r := gin.New()
9091
goa := v2.Server(config.GetDataDir().String())
9192
r.Any("/v2/*path", gin.WrapH(goa))
9293
ts := httptest.NewServer(r)
9394

94-
URL := "http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz"
95-
Checksum := "SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100"
96-
request := tools.ToolPayload{
95+
type test struct {
96+
request tools.ToolPayload
97+
responseCode int
98+
responseBody string
99+
}
100+
101+
BossacURL := "http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz"
102+
BossacChecksum := "SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100"
103+
BossacSignature := "382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0"
104+
bossacInstallURLOK := tools.ToolPayload{
105+
Name: "bossac",
106+
Version: "1.7.0-arduino3",
107+
Packager: "arduino",
108+
URL: &BossacURL,
109+
Checksum: &BossacChecksum,
110+
Signature: &BossacSignature,
111+
}
112+
113+
WrongSignature := "wr0ngs1gn4tur3"
114+
bossacInstallWrongSig := tools.ToolPayload{
115+
Name: "bossac",
116+
Version: "1.7.0-arduino3",
117+
Packager: "arduino",
118+
URL: &BossacURL,
119+
Checksum: &BossacChecksum,
120+
Signature: &WrongSignature,
121+
}
122+
123+
bossacInstallNoURL := tools.ToolPayload{
97124
Name: "bossac",
98125
Version: "1.7.0-arduino3",
99126
Packager: "arduino",
100-
URL: &URL,
101-
Checksum: &Checksum,
102127
}
103128

104-
payload, err := json.Marshal(request)
105-
require.NoError(t, err)
129+
tests := []test{
130+
{bossacInstallURLOK, http.StatusOK, "ok"},
131+
{bossacInstallWrongSig, http.StatusInternalServerError, "verification error"},
132+
{bossacInstallNoURL, http.StatusBadRequest, "tool not found"}, //because the index is not added
133+
}
106134

107-
// for some reason the fronted sends requests with "text/plain" content type.
108-
// Even if the request body contains a json object.
109-
// With this test we verify is parsed correctly.
110-
for _, encoding := range []string{"encoding/json", "text/plain"} {
111-
resp, err := http.Post(ts.URL+"/v2/pkgs/tools/installed", encoding, bytes.NewBuffer(payload))
112-
require.NoError(t, err)
113-
body, err := io.ReadAll(resp.Body)
114-
require.NoError(t, err)
115-
require.Contains(t, string(body), "ok")
116-
require.Equal(t, http.StatusOK, resp.StatusCode)
135+
for _, test := range tests {
136+
t.Run(fmt.Sprintf("Installing %s", test.request.Name), func(t *testing.T) {
137+
payload, err := json.Marshal(test.request)
138+
require.NoError(t, err)
139+
140+
// for some reason the fronted sends requests with "text/plain" content type.
141+
// Even if the request body contains a json object.
142+
// With this test we verify is parsed correctly.
143+
for _, encoding := range []string{"encoding/json", "text/plain"} {
144+
resp, err := http.Post(ts.URL+"/v2/pkgs/tools/installed", encoding, bytes.NewBuffer(payload))
145+
require.NoError(t, err)
146+
body, err := io.ReadAll(resp.Body)
147+
require.NoError(t, err)
148+
require.Contains(t, string(body), test.responseBody)
149+
require.Equal(t, test.responseCode, resp.StatusCode)
150+
}
151+
})
117152
}
118153
}

‎utilities/utilities.go

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@ package utilities
1818
import (
1919
"archive/zip"
2020
"bytes"
21+
"crypto"
22+
"crypto/rsa"
23+
"crypto/sha256"
24+
"crypto/x509"
25+
"encoding/hex"
26+
"encoding/pem"
2127
"errors"
2228
"fmt"
2329
"io"
@@ -26,6 +32,8 @@ import (
2632
"path"
2733
"path/filepath"
2834
"strings"
35+
36+
"github.com/arduino/arduino-create-agent/globals"
2937
)
3038

3139
// SaveFileonTempDir creates a temp directory and saves the file data as the
@@ -162,3 +170,22 @@ func SafeJoin(parent, subdir string) (string, error) {
162170
}
163171
return res, nil
164172
}
173+
174+
// VerifyInput will verify an input against a signature
175+
// A valid signature is indicated by returning a nil error.
176+
func VerifyInput(input string, signature string) error {
177+
sign, _ := hex.DecodeString(signature)
178+
block, _ := pem.Decode([]byte(globals.SignatureKey))
179+
if block == nil {
180+
return errors.New("invalid key")
181+
}
182+
key, err := x509.ParsePKIXPublicKey(block.Bytes)
183+
if err != nil {
184+
return err
185+
}
186+
rsaKey := key.(*rsa.PublicKey)
187+
h := sha256.New()
188+
h.Write([]byte(input))
189+
d := h.Sum(nil)
190+
return rsa.VerifyPKCS1v15(rsaKey, crypto.SHA256, d, sign)
191+
}

‎v2/pkgs/tools.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,10 +136,16 @@ func (c *Tools) Installed(ctx context.Context) (tools.ToolCollection, error) {
136136
func (c *Tools) Install(ctx context.Context, payload *tools.ToolPayload) (*tools.Operation, error) {
137137
path := filepath.Join(payload.Packager, payload.Name, payload.Version)
138138

139-
if payload.URL != nil {
139+
//if URL is defined and is signed we verify the signature and override the name, payload, version parameters
140+
if payload.URL != nil && payload.Signature != nil && payload.Checksum != nil {
141+
err := utilities.VerifyInput(*payload.URL, *payload.Signature)
142+
if err != nil {
143+
return nil, err
144+
}
140145
return c.install(ctx, path, *payload.URL, *payload.Checksum)
141146
}
142147

148+
// otherwise we install from the loaded indexes
143149
list, err := c.Indexes.List(ctx)
144150
if err != nil {
145151
return nil, err

0 commit comments

Comments
 (0)
Please sign in to comment.