start on openssl signature tests

Author: GrosQuildu

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPSignatureOperation.qll

@@ -7,30 +7,25 @@ private import OpenSSLOperationBase
 private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
 
 // TODO: verification functions
-
-
 class EVP_Signature_Initializer extends EVPInitialize {
   boolean isAlgorithmSpecifiedByKey;
   boolean isAlgorithmSpecifiedByCtx;
 
   EVP_Signature_Initializer() {
     this.(Call).getTarget().getName() in [
-      "EVP_DigestSignInit", "EVP_DigestSignInit_ex", "EVP_SignInit", "EVP_SignInit_ex",
-      "EVP_PKEY_sign_init", "EVP_PKEY_sign_init_ex", "EVP_PKEY_sign_init_ex2",
-      "EVP_PKEY_sign_message_init"
-    ] and
+        "EVP_DigestSignInit", "EVP_DigestSignInit_ex", "EVP_SignInit", "EVP_SignInit_ex",
+        "EVP_PKEY_sign_init", "EVP_PKEY_sign_init_ex", "EVP_PKEY_sign_init_ex2",
+        "EVP_PKEY_sign_message_init"
+      ] and
     (
-    if this.(Call).getTarget().getName().matches("EVP_PKEY_%") then
-      isAlgorithmSpecifiedByKey = false
-    else
-      isAlgorithmSpecifiedByKey = true
-    )
-    and
+      if this.(Call).getTarget().getName().matches("EVP_PKEY_%")
+      then isAlgorithmSpecifiedByKey = false
+      else isAlgorithmSpecifiedByKey = true
+    ) and
     (
-    if this.(Call).getTarget().getName() in ["EVP_PKEY_sign_init", "EVP_PKEY_sign_init_ex"] then
-      isAlgorithmSpecifiedByCtx = true
-    else
-      isAlgorithmSpecifiedByCtx = false
+      if this.(Call).getTarget().getName() in ["EVP_PKEY_sign_init", "EVP_PKEY_sign_init_ex"]
+      then isAlgorithmSpecifiedByCtx = true
+      else isAlgorithmSpecifiedByCtx = false
     )
   }
 
@@ -39,8 +34,8 @@ class EVP_Signature_Initializer extends EVPInitialize {
    * Note that the key may be not provided in the initialization call.
    */
   override Expr getAlgorithmArg() {
-    if isAlgorithmSpecifiedByKey = true or isAlgorithmSpecifiedByCtx = true then
-      none()
+    if isAlgorithmSpecifiedByKey = true or isAlgorithmSpecifiedByCtx = true
+    then none()
     else (
       this.(Call).getTarget().getName() in ["EVP_PKEY_sign_init_ex2", "EVP_PKEY_sign_message_init"] and
       result = this.(Call).getArgument(1)
@@ -85,11 +80,29 @@ class EVP_Signature_Update_Call extends EVPUpdate {
   override Expr getInputArg() { result = this.(Call).getArgument(1) }
 }
 
+/**
+ * We model output explicit output arguments as predicate to use it in constructors.
+ * The predicate must cover all EVP_Signature_Operation subclasses.
+ */
+private Expr signatureOperationOutputArg(Call call) {
+  if call.getTarget().getName() = "EVP_SignFinal_ex"
+  then result = call.getArgument(2)
+  else result = call.getArgument(1)
+}
+
 /**
  * Base configuration for all EVP signature operations.
  */
 abstract class EVP_Signature_Operation extends EVPOperation, Crypto::KeyOperationInstance {
-  EVP_Signature_Operation() { this.(Call).getTarget().getName().matches("EVP_%") }
+  EVP_Signature_Operation() {
+    this.(Call).getTarget().getName().matches("EVP_%") and
+    // NULL output argument means the call is to get the size of the signature
+    (
+      not exists(signatureOperationOutputArg(this).getValue())
+      or
+      signatureOperationOutputArg(this).getValue() != "0"
+    )
+  }
 
   /**
    * Signing, verification or unknown.
@@ -129,7 +142,7 @@ class EVP_Signature_Call extends EVPOperation, EVP_Signature_Operation {
   /**
    * Output is the signature.
    */
-  override Expr getOutputArg() { result = this.(Call).getArgument(1) }
+  override Expr getOutputArg() { result = signatureOperationOutputArg(this) }
 
   /**
    * Input is the message to sign.
@@ -147,10 +160,5 @@ class EVP_Signature_Final_Call extends EVPFinal, EVP_Signature_Operation {
   /**
    * Output is the signature.
    */
-  override Expr getOutputArg() {
-    if this.(Call).getTarget().getName() = "EVP_SignFinal_ex" then
-      result = this.(Call).getArgument(2)
-    else
-      result = this.(Call).getArgument(1)
-  }
+  override Expr getOutputArg() { result = signatureOperationOutputArg(this) }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperations.qll

@@ -2,3 +2,4 @@ import OpenSSLOperationBase
 import EVPCipherOperation
 import EVPHashOperation
 import ECKeyGenOperation
+import EVPSignatureOperation

cpp/ql/test/experimental/library-tests/quantum/openssl/includes/alg_macro_stubs.h

@@ -1,3 +1,6 @@
+# define RSA_PKCS1_PSS_PADDING           6
+# define NID_sha256                      672
+
 # define EVP_PKEY_NONE   NID_undef
 # define EVP_PKEY_RSA    NID_rsaEncryption
 # define EVP_PKEY_RSA2   NID_rsa
@@ -3739,3 +3742,6 @@
 #define SN_itu_t "ITU-T"
 #define LN_undef "undefined"
 #define SN_undef "UNDEF"
+
+#define RSA_PKCS1_PSS_PADDING 6
+# define EVP_MAX_MD_SIZE 64

cpp/ql/test/experimental/library-tests/quantum/openssl/includes/evp_stubs.h

@@ -28,13 +28,26 @@
 # define         EVP_CTRL_CCM_SET_IV_FIXED       EVP_CTRL_AEAD_SET_IV_FIXED
 # define         EVP_CTRL_CCM_SET_L              0x14
 # define         EVP_CTRL_CCM_SET_MSGLEN         0x15
+# define         EVP_MAX_MD_SIZE                 64
 
 typedef unsigned long size_t;
 
 typedef unsigned char uint8_t;
 typedef unsigned int uint32_t;
 typedef unsigned long long uint64_t;
 
+// Forward declarations for opaque structs
+struct rsa_st;
+struct dsa_st;
+struct dh_st;
+struct ec_key_st;
+struct DSA_SIG_st;
+typedef struct rsa_st RSA;
+typedef struct dsa_st DSA;
+typedef struct dh_st DH;
+typedef struct ec_key_st EC_KEY;
+typedef struct DSA_SIG_st DSA_SIG;;
+
 // Type aliases.
 typedef int OSSL_PROVIDER;
 
@@ -4983,4 +4996,138 @@ EVP_SKEY * EVP_SKEY_to_provider(EVP_SKEY * skey, OSSL_LIB_CTX * libctx, OSSL_PRO
     return NULL;
 }
 
+int ERR_get_error() {
+    return 0;
+}
+
+void ERR_error_string_n(int error, char* buf, int len) {
+    return;
+}
+
+int EVP_SignInit(EVP_MD_CTX *ctx, const EVP_MD *type) {
+    return 0;
+}
+
+int EVP_SignUpdate(EVP_MD_CTX *ctx, const unsigned char *data, size_t len) {
+    return 0;
+}
+
+void* OPENSSL_malloc(size_t size) {
+    return NULL;
+}
+
+void OPENSSL_free(void *ptr) {
+    return;
+}
+
+int EVP_PKEY_CTX_set_rsa_keygen_bits(EVP_PKEY_CTX *ctx, int bits) {
+    return 0;
+}
+
+int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int saltlen) {
+    return 0;
+}
+
+int RSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig, DSA *dsa) {
+    return 1;
+}
+
+int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig, DSA *dsa) {
+    return 1;
+}
+
+int RSA_free(RSA *rsa) {
+    return 1;
+}
+
+int DSA_free(DSA *dsa) {
+    return 1;
+}
+
+int EVP_PKEY_size(const EVP_PKEY * pkey) {
+    return 0;
+}
+
+int EVP_VerifyInit(EVP_MD_CTX * ctx, const EVP_MD * type) {
+    return 0;
+}
+
+int EVP_VerifyUpdate(EVP_MD_CTX * ctx, const void * data, size_t dsize) {
+    return 0;
+}
+
+int printf(const char*, ...) {
+    return NULL;
+}
+
+int strlen(const char *s) {
+    return NULL;
+}
+
+void* memset(void *s, int c, size_t n) {
+    return NULL;
+}
+
+int RSA_size(const RSA * rsa) {
+    return 0;
+}
+
+int RSA_sign(int type, const unsigned char * m, unsigned int m_length, unsigned char * sigret, unsigned int * siglen, RSA * rsa) {
+    return 0;
+}
+
+int RSA_verify(int type, const unsigned char * m, unsigned int m_length, const unsigned char * sigbuf, unsigned int siglen, RSA * rsa) {
+    return 0;
+}
+
+int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX * ctx, int padding) {
+    return 0;
+}
+
+int EVP_PKEY_CTX_set_dsa_paramgen_bits(EVP_PKEY_CTX * ctx, int bits) {
+    return 0;
+}
+
+int DSA_size(const DSA * dsa) {
+    return 0;
+}
+
+DSA_SIG * DSA_SIG_new(void) {
+    return NULL;
+}
+
+void DSA_SIG_free(DSA_SIG * sig) ;
+
+DSA_SIG * DSA_do_sign(const unsigned char * dgst, int dgst_len, DSA * dsa) {
+    return NULL;
+}
+
+void DSA_SIG_get0(const DSA_SIG * sig, const BIGNUM ** pr, const BIGNUM ** ps) ;
+
+int DSA_SIG_set0(DSA_SIG * sig, BIGNUM * r, BIGNUM * s) {
+    return 0;
+}
+
+int BN_num_bytes(const BIGNUM * a) {
+    return 0;
+}
+
+int BN_bn2bin(const BIGNUM * a, unsigned char * to) {
+    return 0;
+}
+
+BIGNUM * BN_new(void) {
+    return NULL;
+}
+
+void BN_free(BIGNUM * a) ;
+
+BIGNUM * BN_bin2bn(const unsigned char * s, int len, BIGNUM * ret) {
+    return NULL;
+}
+
+void OpenSSL_add_all_algorithms(void) ;
+
+void ERR_load_crypto_strings(void) ;
+
 #endif /* OSSL_EVP_H */