337 lines
15 KiB
C#
337 lines
15 KiB
C#
using System;
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
|
|
namespace Unity.Pipeline.CodeReload
|
|
{
|
|
/// <summary>Outcome of opening a signed push envelope. Everything except <see cref="Ok"/> is a
|
|
/// rejection; the receiver reports them generically on the wire and specifically in its own log.</summary>
|
|
enum PushVerifyStatus
|
|
{
|
|
Ok,
|
|
/// <summary>The receiver has no baked public key — every push is rejected (strict policy).</summary>
|
|
NoKey,
|
|
/// <summary>Structurally not a v1 envelope (bad magic, truncated, absurd lengths).</summary>
|
|
Malformed,
|
|
/// <summary>Envelope parses but the RSA signature does not verify under the baked key.</summary>
|
|
BadSignature,
|
|
/// <summary>Signature is valid but was made for a different session nonce (replay across
|
|
/// sessions/devices, or the editor's nonce table is stale).</summary>
|
|
NonceMismatch,
|
|
/// <summary>Signature and nonce are valid but the counter did not increase (replay within
|
|
/// the session, or out-of-order delivery).</summary>
|
|
CounterNotIncreasing,
|
|
/// <summary>The platform's RSA implementation threw — crypto is unusable here. Surfaced by
|
|
/// the boot self-test; should never be the steady state.</summary>
|
|
CryptoUnavailable,
|
|
}
|
|
|
|
/// <summary>
|
|
/// Authenticated envelope for editor → player code-reload pushes, plus the project signing-key
|
|
/// primitives. Pure BCL (System.Security.Cryptography, no Unity API) so it compiles on both
|
|
/// sides and is unit-testable without a connection.
|
|
///
|
|
/// Wire format (little-endian):
|
|
/// [magic "UPP1" 4B][session nonce 16B][counter int64][payloadLen int32][payload][RSA signature]
|
|
/// The signature is RSA-2048 / SHA-256 / PKCS#1 v1.5 over UTF8(<see cref="DomainTag"/>) followed
|
|
/// by every envelope byte before the signature, so a signature can never be repurposed by a
|
|
/// future feature signing other content with the same project key.
|
|
///
|
|
/// Keys are serialized in a deliberately trivial private format (base64 RSAParameters fields)
|
|
/// rather than XML/PKCS#8: RSA.To/FromXmlString and ImportPkcs8PrivateKey both have per-platform
|
|
/// availability gaps across Unity scripting backends; base64ing the raw parameters has none.
|
|
/// </summary>
|
|
static class PushEnvelope
|
|
{
|
|
public const string DomainTag = "unity-pipeline/push-reload/v1";
|
|
public const int ProtocolVersion = 1;
|
|
public const int NonceSize = 16;
|
|
public const int RsaKeySizeBits = 2048;
|
|
|
|
private const string PrivatePrefix = "upp1-rsa:";
|
|
private const string PublicPrefix = "upp1-rsa-pub:";
|
|
private const int HeaderSize = 4 + NonceSize + 8 + 4; // magic + nonce + counter + payloadLen
|
|
private const int MaxPayload = 64 * 1024 * 1024; // sanity bound, far above any real push
|
|
|
|
private static readonly byte[] Magic = { (byte)'U', (byte)'P', (byte)'P', (byte)'1' };
|
|
|
|
// ---- keys ----
|
|
|
|
/// <summary>Generate a fresh RSA-2048 private key (contains the public half).</summary>
|
|
public static string CreatePrivateKey()
|
|
{
|
|
using (var rsa = RSA.Create())
|
|
{
|
|
rsa.KeySize = RsaKeySizeBits;
|
|
var p = rsa.ExportParameters(true);
|
|
return PrivatePrefix + string.Join(".",
|
|
B64(p.Modulus), B64(p.Exponent), B64(p.D), B64(p.P), B64(p.Q),
|
|
B64(p.DP), B64(p.DQ), B64(p.InverseQ));
|
|
}
|
|
}
|
|
|
|
/// <summary>Extract the shippable public half of a private key.</summary>
|
|
public static string DerivePublicKey(string privateKey)
|
|
{
|
|
var p = ParsePrivate(privateKey);
|
|
return PublicPrefix + B64(p.Modulus) + "." + B64(p.Exponent);
|
|
}
|
|
|
|
public static bool IsPublicKey(string key) =>
|
|
!string.IsNullOrEmpty(key) && key.StartsWith(PublicPrefix, StringComparison.Ordinal);
|
|
|
|
public static bool IsPrivateKey(string key) =>
|
|
!string.IsNullOrEmpty(key) && key.StartsWith(PrivatePrefix, StringComparison.Ordinal);
|
|
|
|
/// <summary>Short stable id of a keypair (SHA-256 over modulus+exponent, first 8 bytes hex).
|
|
/// Accepts the public or the private serialization and gives the same answer.</summary>
|
|
public static string Fingerprint(string key)
|
|
{
|
|
RSAParameters p = IsPublicKey(key) ? ParsePublic(key) : ParsePrivate(key);
|
|
using (var sha = SHA256.Create())
|
|
{
|
|
var data = new byte[p.Modulus.Length + p.Exponent.Length];
|
|
Buffer.BlockCopy(p.Modulus, 0, data, 0, p.Modulus.Length);
|
|
Buffer.BlockCopy(p.Exponent, 0, data, p.Modulus.Length, p.Exponent.Length);
|
|
var hash = sha.ComputeHash(data);
|
|
var sb = new StringBuilder(16);
|
|
for (int i = 0; i < 8; i++) sb.Append(hash[i].ToString("x2"));
|
|
return sb.ToString();
|
|
}
|
|
}
|
|
|
|
/// <summary>Cryptographically random session nonce.</summary>
|
|
public static byte[] CreateNonce()
|
|
{
|
|
var nonce = new byte[NonceSize];
|
|
using (var rng = RandomNumberGenerator.Create())
|
|
rng.GetBytes(nonce);
|
|
return nonce;
|
|
}
|
|
|
|
// ---- signing (editor side) ----
|
|
|
|
public static byte[] Sign(string privateKey, byte[] sessionNonce, long counter, byte[] payload) =>
|
|
Sign(privateKey, sessionNonce, counter, payload, DomainTag);
|
|
|
|
/// <summary>Domain-tag overload: exists so tests can prove a signature made under a different
|
|
/// tag is rejected. Production code always signs with <see cref="DomainTag"/>.</summary>
|
|
public static byte[] Sign(string privateKey, byte[] sessionNonce, long counter, byte[] payload, string domainTag)
|
|
{
|
|
if (sessionNonce == null || sessionNonce.Length != NonceSize)
|
|
throw new ArgumentException($"session nonce must be {NonceSize} bytes", nameof(sessionNonce));
|
|
payload = payload ?? Array.Empty<byte>();
|
|
|
|
var preamble = new byte[HeaderSize + payload.Length];
|
|
Buffer.BlockCopy(Magic, 0, preamble, 0, 4);
|
|
Buffer.BlockCopy(sessionNonce, 0, preamble, 4, NonceSize);
|
|
WriteInt64(preamble, 4 + NonceSize, counter);
|
|
WriteInt32(preamble, 4 + NonceSize + 8, payload.Length);
|
|
Buffer.BlockCopy(payload, 0, preamble, HeaderSize, payload.Length);
|
|
|
|
byte[] sig;
|
|
using (var rsa = RSA.Create())
|
|
{
|
|
rsa.ImportParameters(ParsePrivate(privateKey));
|
|
sig = rsa.SignData(Tagged(domainTag, preamble), HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
|
|
}
|
|
|
|
var envelope = new byte[preamble.Length + sig.Length];
|
|
Buffer.BlockCopy(preamble, 0, envelope, 0, preamble.Length);
|
|
Buffer.BlockCopy(sig, 0, envelope, preamble.Length, sig.Length);
|
|
return envelope;
|
|
}
|
|
|
|
// ---- opening (player side) ----
|
|
|
|
/// <summary>Cheap structural check: does this look like a v1 envelope (as opposed to a
|
|
/// legacy raw payload from a pre-signing editor)?</summary>
|
|
public static bool LooksLikeEnvelope(byte[] data) =>
|
|
data != null && data.Length >= HeaderSize &&
|
|
data[0] == Magic[0] && data[1] == Magic[1] && data[2] == Magic[2] && data[3] == Magic[3];
|
|
|
|
/// <summary>Parse without any crypto. Editor-play-mode strip only — never a security gate.</summary>
|
|
public static bool TryParse(byte[] envelope, out byte[] nonce, out long counter, out byte[] payload)
|
|
{
|
|
nonce = null; counter = 0; payload = null;
|
|
if (!LooksLikeEnvelope(envelope)) return false;
|
|
|
|
nonce = new byte[NonceSize];
|
|
Buffer.BlockCopy(envelope, 4, nonce, 0, NonceSize);
|
|
counter = ReadInt64(envelope, 4 + NonceSize);
|
|
int payloadLen = ReadInt32(envelope, 4 + NonceSize + 8);
|
|
if (payloadLen < 0 || payloadLen > MaxPayload || HeaderSize + payloadLen > envelope.Length)
|
|
return false;
|
|
|
|
payload = new byte[payloadLen];
|
|
Buffer.BlockCopy(envelope, HeaderSize, payload, 0, payloadLen);
|
|
return true;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Full verification: structure, signature under <paramref name="publicKey"/>, session nonce
|
|
/// equality, strictly increasing counter. On <see cref="PushVerifyStatus.Ok"/>,
|
|
/// <paramref name="payload"/> and <paramref name="counter"/> are set. Stateless — callers own
|
|
/// the last-counter bookkeeping (see <see cref="PushVerifier"/>).
|
|
/// </summary>
|
|
public static PushVerifyStatus TryOpen(string publicKey, byte[] envelope, byte[] expectedNonce,
|
|
long lastCounter, out long counter, out byte[] payload)
|
|
{
|
|
counter = 0; payload = null;
|
|
if (string.IsNullOrEmpty(publicKey)) return PushVerifyStatus.NoKey;
|
|
if (!LooksLikeEnvelope(envelope)) return PushVerifyStatus.Malformed;
|
|
|
|
int payloadLen = ReadInt32(envelope, 4 + NonceSize + 8);
|
|
if (payloadLen < 0 || payloadLen > MaxPayload) return PushVerifyStatus.Malformed;
|
|
int preambleLen = HeaderSize + payloadLen;
|
|
if (preambleLen >= envelope.Length) return PushVerifyStatus.Malformed; // signature must be non-empty
|
|
|
|
// Signature first: nothing later is meaningful on unauthenticated bytes.
|
|
try
|
|
{
|
|
var preamble = new byte[preambleLen];
|
|
Buffer.BlockCopy(envelope, 0, preamble, 0, preambleLen);
|
|
var sig = new byte[envelope.Length - preambleLen];
|
|
Buffer.BlockCopy(envelope, preambleLen, sig, 0, sig.Length);
|
|
|
|
using (var rsa = RSA.Create())
|
|
{
|
|
rsa.ImportParameters(ParsePublic(publicKey));
|
|
if (!rsa.VerifyData(Tagged(DomainTag, preamble), sig, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1))
|
|
return PushVerifyStatus.BadSignature;
|
|
}
|
|
}
|
|
catch (FormatException) { return PushVerifyStatus.Malformed; } // corrupt key string
|
|
catch (Exception) { return PushVerifyStatus.CryptoUnavailable; }
|
|
|
|
if (expectedNonce == null || expectedNonce.Length != NonceSize)
|
|
return PushVerifyStatus.NonceMismatch;
|
|
// Constant-time not required (the nonce is not secret; it is a liveness binding), but
|
|
// the full compare is trivial anyway.
|
|
int diff = 0;
|
|
for (int i = 0; i < NonceSize; i++) diff |= envelope[4 + i] ^ expectedNonce[i];
|
|
if (diff != 0) return PushVerifyStatus.NonceMismatch;
|
|
|
|
long c = ReadInt64(envelope, 4 + NonceSize);
|
|
if (c <= lastCounter) return PushVerifyStatus.CounterNotIncreasing;
|
|
|
|
counter = c;
|
|
payload = new byte[payloadLen];
|
|
Buffer.BlockCopy(envelope, HeaderSize, payload, 0, payloadLen);
|
|
return PushVerifyStatus.Ok;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Boot-time probe that the platform can run the verify path at all (RSA import + VerifyData
|
|
/// on a garbage signature must return false, not throw). Catches an IL2CPP/platform crypto
|
|
/// gap on day one instead of as mysterious per-push rejects.
|
|
/// </summary>
|
|
public static bool VerifySelfTest(string publicKey, out string error)
|
|
{
|
|
error = null;
|
|
try
|
|
{
|
|
using (var rsa = RSA.Create())
|
|
{
|
|
rsa.ImportParameters(ParsePublic(publicKey));
|
|
var garbageSig = new byte[RsaKeySizeBits / 8];
|
|
if (rsa.VerifyData(new byte[] { 1, 2, 3 }, garbageSig, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1))
|
|
{
|
|
error = "garbage signature verified — RSA implementation is broken here";
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
error = ex.GetType().Name + ": " + ex.Message;
|
|
return false;
|
|
}
|
|
}
|
|
|
|
// ---- internals ----
|
|
|
|
private static byte[] Tagged(string domainTag, byte[] preamble)
|
|
{
|
|
var tag = Encoding.UTF8.GetBytes(domainTag ?? "");
|
|
var signed = new byte[tag.Length + preamble.Length];
|
|
Buffer.BlockCopy(tag, 0, signed, 0, tag.Length);
|
|
Buffer.BlockCopy(preamble, 0, signed, tag.Length, preamble.Length);
|
|
return signed;
|
|
}
|
|
|
|
private static RSAParameters ParsePrivate(string key)
|
|
{
|
|
if (!IsPrivateKey(key)) throw new FormatException("not a " + PrivatePrefix + " private key");
|
|
var f = key.Substring(PrivatePrefix.Length).Split('.');
|
|
if (f.Length != 8) throw new FormatException("private key must have 8 fields");
|
|
return new RSAParameters
|
|
{
|
|
Modulus = D64(f[0]), Exponent = D64(f[1]), D = D64(f[2]), P = D64(f[3]),
|
|
Q = D64(f[4]), DP = D64(f[5]), DQ = D64(f[6]), InverseQ = D64(f[7]),
|
|
};
|
|
}
|
|
|
|
private static RSAParameters ParsePublic(string key)
|
|
{
|
|
if (!IsPublicKey(key)) throw new FormatException("not a " + PublicPrefix + " public key");
|
|
var f = key.Substring(PublicPrefix.Length).Split('.');
|
|
if (f.Length != 2) throw new FormatException("public key must have 2 fields");
|
|
return new RSAParameters { Modulus = D64(f[0]), Exponent = D64(f[1]) };
|
|
}
|
|
|
|
private static string B64(byte[] b) => Convert.ToBase64String(b ?? Array.Empty<byte>());
|
|
private static byte[] D64(string s) => Convert.FromBase64String(s);
|
|
|
|
private static void WriteInt32(byte[] buf, int off, int v)
|
|
{
|
|
buf[off] = (byte)v; buf[off + 1] = (byte)(v >> 8);
|
|
buf[off + 2] = (byte)(v >> 16); buf[off + 3] = (byte)(v >> 24);
|
|
}
|
|
|
|
private static void WriteInt64(byte[] buf, int off, long v)
|
|
{
|
|
for (int i = 0; i < 8; i++) buf[off + i] = (byte)(v >> (8 * i));
|
|
}
|
|
|
|
private static int ReadInt32(byte[] buf, int off) =>
|
|
buf[off] | (buf[off + 1] << 8) | (buf[off + 2] << 16) | (buf[off + 3] << 24);
|
|
|
|
private static long ReadInt64(byte[] buf, int off)
|
|
{
|
|
long v = 0;
|
|
for (int i = 0; i < 8; i++) v |= (long)buf[off + i] << (8 * i);
|
|
return v;
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// The player-side gate: one per receiver session. Owns the session nonce and the last-accepted
|
|
/// counter, so <see cref="Verify"/> is the single call the receiver makes per push.
|
|
/// </summary>
|
|
sealed class PushVerifier
|
|
{
|
|
private readonly string m_PublicKey;
|
|
private readonly byte[] m_SessionNonce;
|
|
private long m_LastCounter;
|
|
|
|
public PushVerifier(string publicKey, byte[] sessionNonce)
|
|
{
|
|
m_PublicKey = publicKey;
|
|
m_SessionNonce = sessionNonce;
|
|
}
|
|
|
|
public byte[] SessionNonce => m_SessionNonce;
|
|
|
|
public PushVerifyStatus Verify(byte[] envelope, out byte[] payload)
|
|
{
|
|
var status = PushEnvelope.TryOpen(m_PublicKey, envelope, m_SessionNonce, m_LastCounter,
|
|
out var counter, out payload);
|
|
if (status == PushVerifyStatus.Ok)
|
|
m_LastCounter = counter;
|
|
return status;
|
|
}
|
|
}
|
|
}
|