Skip to content

Commit 7d47994

Browse files
bdrodesbdrodes
committed
Crypto: Nop out signature operations for now until complete. Minor model update. Remove setting RSA bits as an RSA algorithm. Fix bug in hash algorithm. Add missing PKey encryption to cipher ops. Consolidate ctx initializers. Add unit tests, and alter unit test directory structure to allow for application to other APIs. Update expected files for unit tests (not all updated yet, a work in progress).
1 parent 729467c commit 7d47994

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+198
-59
lines changed

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/HashAlgorithmInstance.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ predicate knownOpenSSLConstantToHashFamilyType(
2929
or
3030
name.matches(["SHA", "SHA1"]) and type instanceof Crypto::SHA1
3131
or
32-
name.matches("SHA+%") and not name.matches(["SHA1", "SHA3-"]) and type instanceof Crypto::SHA2
32+
name.matches("SHA_%") and not name.matches(["SHA1", "SHA3-"]) and type instanceof Crypto::SHA2
3333
or
3434
name.matches("SHA3-%") and type instanceof Crypto::SHA3
3535
or

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,7 @@ class KnownOpenSSLKeyAgreementAlgorithmExpr extends Expr instanceof KnownOpenSSL
147147
}
148148

149149
predicate knownOpenSSLAlgorithmOperationCall(Call c, string normalized, string algType) {
150-
c.getTarget().getName() in [
151-
"EVP_RSA_gen", "RSA_generate_key_ex", "RSA_generate_key", "EVP_PKEY_CTX_set_rsa_keygen_bits"
152-
] and
150+
c.getTarget().getName() in ["EVP_RSA_gen", "RSA_generate_key_ex", "RSA_generate_key", "RSA_new"] and
153151
normalized = "RSA" and
154152
algType = "ASYMMETRIC_ENCRYPTION"
155153
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPCipherOperation.qll‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,3 +183,21 @@ class EVP_Cipher_Final_Call extends EVPFinal, EVP_Cipher_Operation {
183183

184184
override CtxPointerSource getContextArg() { result = this.(Call).getArgument(0) }
185185
}
186+
187+
/**
188+
* https://docs.openssl.org/3.2/man3/EVP_PKEY_decrypt/
189+
* https://docs.openssl.org/3.2/man3/EVP_PKEY_encrypt
190+
*/
191+
class Evp_PKey_Cipher_Operation extends EVP_Cipher_Operation {
192+
Evp_PKey_Cipher_Operation() {
193+
this.(Call).getTarget().getName() in ["EVP_PKEY_encrypt", "EVP_PKEY_decrypt"]
194+
}
195+
196+
override Expr getInputArg() { result = this.(Call).getArgument(3) }
197+
198+
override CtxPointerSource getContextArg() { result = this.(Call).getArgument(0) }
199+
200+
override Expr getAlgorithmArg() {
201+
result = this.getInitCall().(EvpAlgorithmInitializer).getAlgorithmArg()
202+
}
203+
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPKeyGenOperation.qll‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -20,36 +20,6 @@ class EVPKeyGenInitialize extends EvpAlgorithmInitializer {
2020
override CtxPointerSource getContextArg() { result = this.(Call).getArgument(0) }
2121
}
2222

23-
/**
24-
* A call to `EVP_PKEY_CTX_new` or `EVP_PKEY_CTX_new_from_pkey`.
25-
* These calls initialize the context from a prior key.
26-
* The key may be generated previously, or merely had it's
27-
* parameters set (e.g., `EVP_PKEY_paramgen`).
28-
* NOTE: for the case of `EVP_PKEY_paramgen`, these calls
29-
* are encoded as context passthroughs, and any operation
30-
* will get all associated initializers for teh paramgen
31-
* at the final keygen operation automatically.
32-
*/
33-
class EVPNewKeyCtx extends EvpKeyInitializer {
34-
Expr keyArg;
35-
36-
EVPNewKeyCtx() {
37-
this.(Call).getTarget().getName() = "EVP_PKEY_CTX_new" and
38-
keyArg = this.(Call).getArgument(0)
39-
or
40-
this.(Call).getTarget().getName() = "EVP_PKEY_CTX_new_from_pkey" and
41-
keyArg = this.(Call).getArgument(1)
42-
}
43-
44-
/**
45-
* Context is returned
46-
*/
47-
override CtxPointerSource getContextArg() { result = this }
48-
49-
override Expr getKeyArg() { result = keyArg }
50-
//TODO: do we specify the algorithm from the key as well?
51-
}
52-
5323
class EVPKeyGenOperation extends EVPFinal, Crypto::KeyGenerationOperationInstance {
5424
DataFlow::Node keyResultNode;
5525

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPPKeyCtxInitializer.qll‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,42 @@
11
/**
2-
* Initializers from https://docs.openssl.org/3.0/man3/EVP_PKEY_CTX_ctrl/
2+
* Initializers for EVP PKey
3+
* including https://docs.openssl.org/3.0/man3/EVP_PKEY_CTX_ctrl/
34
*/
45

56
import cpp
67
private import experimental.quantum.OpenSSL.CtxFlow
78
private import OpenSSLOperationBase
89

10+
/**
11+
* A call to `EVP_PKEY_CTX_new` or `EVP_PKEY_CTX_new_from_pkey`.
12+
* These calls initialize the context from a prior key.
13+
* The key may be generated previously, or merely had it's
14+
* parameters set (e.g., `EVP_PKEY_paramgen`).
15+
* NOTE: for the case of `EVP_PKEY_paramgen`, these calls
16+
* are encoded as context passthroughs, and any operation
17+
* will get all associated initializers for teh paramgen
18+
* at the final keygen operation automatically.
19+
*/
20+
class EVPNewKeyCtx extends EvpKeyInitializer {
21+
Expr keyArg;
22+
23+
EVPNewKeyCtx() {
24+
this.(Call).getTarget().getName() = "EVP_PKEY_CTX_new" and
25+
keyArg = this.(Call).getArgument(0)
26+
or
27+
this.(Call).getTarget().getName() = "EVP_PKEY_CTX_new_from_pkey" and
28+
keyArg = this.(Call).getArgument(1)
29+
}
30+
31+
/**
32+
* Context is returned
33+
*/
34+
override CtxPointerSource getContextArg() { result = this }
35+
36+
override Expr getKeyArg() { result = keyArg }
37+
//TODO: do we specify the algorithm from the key as well?
38+
}
39+
940
class EvpCtxSetAlgorithmInitializer extends EvpAlgorithmInitializer {
1041
EvpCtxSetAlgorithmInitializer() {
1142
this.(Call).getTarget().getName() in [

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperations.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@ import OpenSSLOperationBase
22
import EVPCipherOperation
33
import EVPHashOperation
44
import ECKeyGenOperation
5-
import EVPSignatureOperation
5+
//import EVPSignatureOperation
66
import EVPKeyGenOperation
77
import EVPPKeyCtxInitializer

‎cpp/ql/test/experimental/library-tests/quantum/algorithm_names.expected‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
| openssl_basic.c:23:37:23:51 | KeyOperationAlgorithm | AES |
2+
| openssl_basic.c:23:37:23:51 | ModeOfOperation | GCM |
3+
| openssl_basic.c:69:33:69:47 | KeyOperationAlgorithm | AES |
4+
| openssl_basic.c:69:33:69:47 | ModeOfOperation | GCM |
5+
| openssl_basic.c:116:38:116:47 | HashAlgorithm | SHA2 |
6+
| openssl_basic.c:144:67:144:73 | HashAlgorithm | MD5 |
7+
| openssl_basic.c:160:39:160:48 | HashAlgorithm | SHA2 |
8+
| openssl_pkey.c:21:10:21:28 | KeyOperationAlgorithm | RSA |
9+
| openssl_pkey.c:50:31:50:42 | KeyOperationAlgorithm | RSA |
10+
| openssl_signature.c:521:46:521:66 | PaddingAlgorithm | PSS |
11+
| openssl_signature.c:543:35:543:46 | KeyOperationAlgorithm | RSA |
12+
| openssl_signature.c:565:50:565:54 | KeyOperationAlgorithm | DSA |
13+
| openssl_signature.c:684:24:684:33 | HashAlgorithm | SHA2 |
14+
| openssl_signature.c:702:60:702:71 | HashAlgorithm | SHA2 |
15+
| openssl_signature.c:702:60:702:71 | KeyOperationAlgorithm | RSA |
16+
| openssl_signature.c:740:24:740:33 | HashAlgorithm | SHA2 |
17+
| openssl_signature.c:758:60:758:64 | KeyOperationAlgorithm | DSA |

‎cpp/ql/test/experimental/library-tests/quantum/algorithm_names.ql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import cpp
2+
import experimental.quantum.Language
3+
4+
from Crypto::AlgorithmNode n
5+
select n, n.getAlgorithmName()

‎cpp/ql/test/experimental/library-tests/quantum/algorithms.expected‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
| openssl_basic.c:23:37:23:51 | KeyOperationAlgorithm |
2+
| openssl_basic.c:23:37:23:51 | ModeOfOperation |
3+
| openssl_basic.c:69:33:69:47 | KeyOperationAlgorithm |
4+
| openssl_basic.c:69:33:69:47 | ModeOfOperation |
5+
| openssl_basic.c:116:38:116:47 | HashAlgorithm |
6+
| openssl_basic.c:144:67:144:73 | HashAlgorithm |
7+
| openssl_basic.c:160:39:160:48 | HashAlgorithm |
8+
| openssl_pkey.c:21:10:21:28 | KeyOperationAlgorithm |
9+
| openssl_pkey.c:50:31:50:42 | KeyOperationAlgorithm |
10+
| openssl_signature.c:521:46:521:66 | PaddingAlgorithm |
11+
| openssl_signature.c:543:35:543:46 | KeyOperationAlgorithm |
12+
| openssl_signature.c:565:50:565:54 | KeyOperationAlgorithm |
13+
| openssl_signature.c:684:24:684:33 | HashAlgorithm |
14+
| openssl_signature.c:702:60:702:71 | HashAlgorithm |
15+
| openssl_signature.c:702:60:702:71 | KeyOperationAlgorithm |
16+
| openssl_signature.c:740:24:740:33 | HashAlgorithm |
17+
| openssl_signature.c:758:60:758:64 | KeyOperationAlgorithm |

‎cpp/ql/test/experimental/library-tests/quantum/algorithms.ql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import cpp
2+
import experimental.quantum.Language
3+
4+
from Crypto::AlgorithmNode n
5+
select n

0 commit comments

Comments
 (0)