Use SHA512 instead of SHA1.
#3992
Sean Hall committed
Mar 2, 2021 at 15:05 UTC
7f128f4639b6a14217780d69a0615b44d36f2f1b
9 files changed
+17
-15
src/Cpp.Build.props
+1
-1
@@ -25,7 +25,7 @@
25
<DisableSpecificWarnings>$(DisableSpecificCompilerWarnings)</DisableSpecificWarnings>
26
<WarningLevel>Level4</WarningLevel>
27
<AdditionalIncludeDirectories>$(ProjectDir)inc;$(MSBuildProjectDirectory);$(IntDir);$(SqlCESdkIncludePath);$(ProjectAdditionalIncludeDirectories);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
28
- <PreprocessorDefinitions>WIN32;_WINDOWS;_WIN32_MSI=500;_WIN32_WINNT=0x0501;$(ArmPreprocessorDefinitions);$(UnicodePreprocessorDefinitions);_CRT_STDIO_LEGACY_WIDE_SPECIFIERS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
28
+ <PreprocessorDefinitions>WIN32;_WINDOWS;_WIN32_MSI=500;_WIN32_WINNT=0x0600;$(ArmPreprocessorDefinitions);$(UnicodePreprocessorDefinitions);_CRT_STDIO_LEGACY_WIDE_SPECIFIERS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
29
<PrecompiledHeader>Use</PrecompiledHeader>
30
<PrecompiledHeaderFile>precomp.h</PrecompiledHeaderFile>
31
<CallingConvention Condition="'$(Platform)'=='Win32'">StdCall</CallingConvention>
src/WixToolset.BootstrapperCore.Native/inc/BootstrapperEngine.h
+1
-1
@@ -82,7 +82,7 @@ enum BOOTSTRAPPER_LOG_LEVEL
82
enum BOOTSTRAPPER_UPDATE_HASH_TYPE
83
{
84
BOOTSTRAPPER_UPDATE_HASH_TYPE_NONE,
85
- BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA1,
85
+ BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA512,
86
};
87
88
enum BOOTSTRAPPER_ENGINE_MESSAGE
src/engine/cache.cpp
+6
-6
@@ -273,7 +273,7 @@ extern "C" HRESULT CacheCalculatePayloadWorkingPath(
273
ExitOnFailure(hr, "Failed to get working folder for payload.");
274
275
hr = StrAllocConcat(psczWorkingPath, pPayload->sczKey, 0);
276
- ExitOnFailure(hr, "Failed to append SHA1 hash as payload unverified path.");
276
+ ExitOnFailure(hr, "Failed to append Id as payload unverified path.");
277
278
LExit:
279
return hr;
@@ -291,7 +291,7 @@ extern "C" HRESULT CacheCalculateContainerWorkingPath(
291
ExitOnFailure(hr, "Failed to get working folder for container.");
292
293
hr = StrAllocConcat(psczWorkingPath, pContainer->sczHash, 0);
294
- ExitOnFailure(hr, "Failed to append SHA1 hash as container unverified path.");
294
+ ExitOnFailure(hr, "Failed to append hash as container unverified path.");
295
296
LExit:
297
return hr;
@@ -1750,23 +1750,23 @@ static HRESULT VerifyHash(
1750
UNREFERENCED_PARAMETER(wzUnverifiedPayloadPath);
1751
1752
HRESULT hr = S_OK;
1753
- BYTE rgbActualHash[SHA1_HASH_LEN] = { };
1753
+ BYTE rgbActualHash[SHA512_HASH_LEN] = { };
1754
DWORD64 qwHashedBytes;
1755
LPWSTR pszExpected = NULL;
1756
LPWSTR pszActual = NULL;
1757
1758
// TODO: create a cryp hash file that sends progress.
1759
- hr = CrypHashFileHandle(hFile, PROV_RSA_FULL, CALG_SHA1, rgbActualHash, sizeof(rgbActualHash), &qwHashedBytes);
1759
+ hr = CrypHashFileHandle(hFile, PROV_RSA_AES, CALG_SHA_512, rgbActualHash, sizeof(rgbActualHash), &qwHashedBytes);
1760
ExitOnFailure(hr, "Failed to calculate hash for path: %ls", wzUnverifiedPayloadPath);
1761
1762
// Compare hashes.
1763
- if (cbHash != sizeof(rgbActualHash) || 0 != memcmp(pbHash, rgbActualHash, SHA1_HASH_LEN))
1763
+ if (cbHash != sizeof(rgbActualHash) || 0 != memcmp(pbHash, rgbActualHash, SHA512_HASH_LEN))
1764
{
1765
hr = CRYPT_E_HASH_VALUE;
1766
1767
// Best effort to log the expected and actual hash value strings.
1768
if (SUCCEEDED(StrAllocHexEncode(pbHash, cbHash, &pszExpected)) &&
1769
- SUCCEEDED(StrAllocHexEncode(rgbActualHash, SHA1_HASH_LEN, &pszActual)))
1769
+ SUCCEEDED(StrAllocHexEncode(rgbActualHash, (SIZE_T)qwHashedBytes, &pszActual)))
1770
{
1771
ExitOnFailure(hr, "Hash mismatch for path: %ls, expected: %ls, actual: %ls", wzUnverifiedPayloadPath, pszExpected, pszActual);
1772
}
src/engine/cache.h
+1
-1
@@ -16,7 +16,7 @@ HRESULT CacheInitialize(
16
__in_z_opt LPCWSTR wzSourceProcessPath
17
);
18
HRESULT CacheEnsureWorkingFolder(
19
- __in_z LPCWSTR wzBundleId,
19
+ __in_z_opt LPCWSTR wzBundleId,
20
__deref_out_z_opt LPWSTR* psczWorkingFolder
21
);
22
HRESULT CacheCalculateBundleWorkingPath(
src/engine/externalengine.cpp
+1
-1
@@ -288,7 +288,7 @@ HRESULT ExternalEngineSetUpdate(
288
{
289
hr = E_INVALIDARG;
290
}
291
- else if (BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA1 == hashType && (SHA1_HASH_LEN != cbHash || !rgbHash))
291
+ else if (BOOTSTRAPPER_UPDATE_HASH_TYPE_SHA512 == hashType && (SHA512_HASH_LEN != cbHash || !rgbHash))
292
{
293
hr = E_INVALIDARG;
294
}
src/engine/userexperience.cpp
+1
-1
@@ -111,7 +111,7 @@ extern "C" HRESULT UserExperienceLoad(
111
args.pCommand = pCommand;
112
args.pfnBootstrapperEngineProc = EngineForApplicationProc;
113
args.pvBootstrapperEngineProcContext = pEngineContext;
114
- args.qwEngineAPIVersion = MAKEQWORDVERSION(2021, 2, 24, 0);
114
+ args.qwEngineAPIVersion = MAKEQWORDVERSION(2021, 3, 2, 0);
115
116
results.cbSize = sizeof(BOOTSTRAPPER_CREATE_RESULTS);
117
src/test/BurnUnitTest/BurnUnitTest.vcxproj
+1
@@ -69,6 +69,7 @@
69
<ResourceCompile Include="BurnUnitTest.rc" />
70
</ItemGroup>
71
<ItemGroup>
72
+ <None Include="TestData\CacheTest\CacheSignatureTest.File" CopyToOutputDirectory="PreserveNewest" />
73
<None Include="TestData\PlanTest\BasicFunctionality_BundleA_manifest.xml" CopyToOutputDirectory="PreserveNewest" />
74
<None Include="TestData\PlanTest\MsiTransaction_BundleAv1_manifest.xml" CopyToOutputDirectory="PreserveNewest" />
75
<None Include="TestData\PlanTest\Slipstream_BundleA_manifest.xml" CopyToOutputDirectory="PreserveNewest" />
src/test/BurnUnitTest/CacheTest.cpp
+4
-4
@@ -24,7 +24,7 @@ namespace Bootstrapper
24
{
25
}
26
27
- [Fact(Skip = "Currently fails")]
27
+ [Fact]
28
void CacheSignatureTest()
29
{
30
HRESULT hr = S_OK;
@@ -36,12 +36,12 @@ namespace Bootstrapper
36
37
try
38
{
39
- pin_ptr<const wchar_t> dataDirectory = PtrToStringChars(this->TestContext->DataDirectory);
40
- hr = PathConcat(dataDirectory, L"BurnTestPayloads\\Products\\TestExe\\TestExe.exe", &sczPayloadPath);
39
+ pin_ptr<const wchar_t> dataDirectory = PtrToStringChars(this->TestContext->TestDirectory);
40
+ hr = PathConcat(dataDirectory, L"TestData\\CacheTest\\CacheSignatureTest.File", &sczPayloadPath);
41
Assert::True(S_OK == hr, "Failed to get path to test file.");
42
Assert::True(FileExistsEx(sczPayloadPath, NULL), "Test file does not exist.");
43
44
- hr = StrAllocHexDecode(L"232BD16B78C1926F95D637731E1EE5379A3C4222", &pb, &cb);
44
+ hr = StrAllocHexDecode(L"25e61cd83485062b70713aebddd3fe4992826cb121466fddc8de3eacb1e42f39d4bdd8455d95eec8c9529ced4c0296ab861931fe2c86df2f2b4e8d259a6d9223", &pb, &cb);
45
Assert::Equal(S_OK, hr);
46
47
package.fPerMachine = FALSE;
src/test/BurnUnitTest/TestData/CacheTest/CacheSignatureTest.File
new
+1
@@ -0,0 +1 @@
1
+This file has a known hash.
\ No newline at end of file