Skip to content

Commit 8b64a72

Browse files
bdrodesbdrodes
committed
Crypto: Initial sketch for refactoring MAC and signatures to account for APIs having one function to do both. Incomplete. Work in progress.
1 parent e6b363b commit 8b64a72

File tree

8 files changed

+416
-180
lines changed

8 files changed

+416
-180
lines changed

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/MACAlgorithmInstance.qll‎

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@ import cpp
22
private import experimental.quantum.Language
33
private import KnownAlgorithmConstants
44
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
5-
private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
5+
private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
66
private import experimental.quantum.OpenSSL.Operations.OpenSSLOperations
7+
private import Crypto::KeyOpAlg as KeyOpAlg
78
private import AlgToAVCFlow
89

910
class KnownOpenSslMacConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
10-
Crypto::MacAlgorithmInstance instanceof KnownOpenSslMacAlgorithmExpr
11+
Crypto::KeyOperationAlgorithmInstance instanceof KnownOpenSslMacAlgorithmExpr
1112
{
1213
OpenSslAlgorithmValueConsumer getterCall;
1314

@@ -33,17 +34,34 @@ class KnownOpenSslMacConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
3334

3435
override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
3536

36-
override string getRawMacAlgorithmName() {
37+
override string getRawAlgorithmName() {
3738
result = this.(Literal).getValue().toString()
3839
or
3940
result = this.(Call).getTarget().getName()
4041
}
4142

42-
override Crypto::MacType getMacType() {
43-
this instanceof KnownOpenSslHMacAlgorithmExpr and result = Crypto::HMAC()
44-
or
45-
this instanceof KnownOpenSslCMacAlgorithmExpr and result = Crypto::CMAC()
43+
override Crypto::KeyOpAlg::AlgorithmType getAlgorithmType() {
44+
if this instanceof KnownOpenSslHMacAlgorithmExpr
45+
then result = KeyOpAlg::TMac(KeyOpAlg::HMAC())
46+
else
47+
if this instanceof KnownOpenSslCMacAlgorithmExpr
48+
then result = KeyOpAlg::TMac(KeyOpAlg::CMAC())
49+
else result = KeyOpAlg::TMac(KeyOpAlg::OtherMacAlgorithmType())
50+
}
51+
52+
override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
53+
// TODO: trace to any key size initializer?
54+
none()
55+
}
56+
57+
override int getKeySizeFixed() {
58+
// TODO: are there known fixed key sizes to consider?
59+
none()
4660
}
61+
62+
override Crypto::ModeOfOperationAlgorithmInstance getModeOfOperationAlgorithm() { none() }
63+
64+
override Crypto::PaddingAlgorithmInstance getPaddingAlgorithm() { none() }
4765
}
4866

4967
class KnownOpenSslHMacConstantAlgorithmInstance extends Crypto::HmacAlgorithmInstance,
@@ -60,9 +78,13 @@ class KnownOpenSslHMacConstantAlgorithmInstance extends Crypto::HmacAlgorithmIns
6078
// where the current AVC traces to a HashAlgorithmIO consuming operation step.
6179
// TODO: need to consider getting reset values, tracing down to the first set for now
6280
exists(OperationStep s, AvcContextCreationStep avc |
63-
avc = this.getAvc() and
81+
avc = super.getAvc() and
6482
avc.flowsToOperationStep(s) and
6583
s.getAlgorithmValueConsumerForInput(HashAlgorithmIO()) = result
6684
)
6785
}
86+
87+
override Crypto::ModeOfOperationAlgorithmInstance getModeOfOperationAlgorithm() { none() }
88+
89+
override Crypto::PaddingAlgorithmInstance getPaddingAlgorithm() { none() }
6890
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/PaddingAlgorithmInstance.qll‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@ private import OpenSSLAlgorithmInstanceBase
44
private import experimental.quantum.OpenSSL.Operations.OpenSSLOperationBase
55
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
66
private import AlgToAVCFlow
7-
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
8-
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
7+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
98
private import codeql.quantum.experimental.Standardization::Types::KeyOpAlg as KeyOpAlg
109

1110
/**

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/CipherOperation.qll‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,26 @@ private import OpenSSLOperationBase
33
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
44
import EVPPKeyCtxInitializer
55

6+
/**
7+
* A base class for all final cipher operation steps.
8+
*/
9+
abstract class FinalCipherOperationStep extends OperationStep {
10+
override OperationStepType getStepType() { result = FinalStep() }
11+
}
12+
13+
/**
14+
* A base configuration for all EVP cipher operations.
15+
*/
16+
abstract class EvpCipherOperationFinalStep extends FinalCipherOperationStep {
17+
override DataFlow::Node getInput(IOType type) {
18+
result.asExpr() = this.getArgument(0) and type = ContextIO()
19+
}
20+
21+
override DataFlow::Node getOutput(IOType type) {
22+
result.asExpr() = this.getArgument(0) and type = ContextIO()
23+
}
24+
}
25+
626
/**
727
* A base class for all EVP cipher operations.
828
*/
@@ -155,21 +175,6 @@ class EvpCipherUpdateCall extends OperationStep {
155175
override OperationStepType getStepType() { result = UpdateStep() }
156176
}
157177

158-
/**
159-
* A base configuration for all EVP cipher operations.
160-
*/
161-
abstract class EvpCipherOperationFinalStep extends OperationStep {
162-
override DataFlow::Node getInput(IOType type) {
163-
result.asExpr() = this.getArgument(0) and type = ContextIO()
164-
}
165-
166-
override DataFlow::Node getOutput(IOType type) {
167-
result.asExpr() = this.getArgument(0) and type = ContextIO()
168-
}
169-
170-
override OperationStepType getStepType() { result = FinalStep() }
171-
}
172-
173178
/**
174179
* A Call to EVP_Cipher.
175180
*/
@@ -259,7 +264,7 @@ class EvpPKeyCipherOperation extends EvpCipherOperationFinalStep {
259264
* An EVP cipher operation instance.
260265
* Any operation step that is a final operation step for EVP cipher operation steps.
261266
*/
262-
class EvpCipherOperationInstance extends Crypto::KeyOperationInstance instanceof EvpCipherOperationFinalStep
267+
class OpenSslCipherOperationInstance extends Crypto::KeyOperationInstance instanceof FinalCipherOperationStep
263268
{
264269
override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
265270
super.getPrimaryAlgorithmValueConsumer() = result

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/HashOperation.qll‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,13 @@ private import experimental.quantum.Language
66
private import OpenSSLOperationBase
77
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
88

9+
/**
10+
* A base class for final digest operations.
11+
*/
12+
abstract class FinalDigestOperation extends OperationStep {
13+
override OperationStepType getStepType() { result = FinalStep() }
14+
}
15+
916
/**
1017
* A call to and EVP digest initializer, such as:
1118
* - `EVP_DigestInit`
@@ -51,18 +58,11 @@ class EvpDigestUpdateCall extends OperationStep instanceof Call {
5158
override OperationStepType getStepType() { result = UpdateStep() }
5259
}
5360

54-
/**
55-
* A base class for final digest operations.
56-
*/
57-
abstract class EvpFinalDigestOperationStep extends OperationStep {
58-
override OperationStepType getStepType() { result = FinalStep() }
59-
}
60-
6161
/**
6262
* A call to `EVP_Q_digest`
6363
* https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
6464
*/
65-
class EvpQDigestOperation extends EvpFinalDigestOperationStep instanceof Call {
65+
class EvpQDigestOperation extends FinalDigestOperation instanceof Call {
6666
EvpQDigestOperation() { this.getTarget().getName() = "EVP_Q_digest" }
6767

6868
override DataFlow::Node getInput(IOType type) {
@@ -81,7 +81,7 @@ class EvpQDigestOperation extends EvpFinalDigestOperationStep instanceof Call {
8181
}
8282
}
8383

84-
class EvpDigestOperation extends EvpFinalDigestOperationStep instanceof Call {
84+
class EvpDigestOperation extends FinalDigestOperation instanceof Call {
8585
EvpDigestOperation() { this.getTarget().getName() = "EVP_Digest" }
8686

8787
override DataFlow::Node getInput(IOType type) {
@@ -98,7 +98,7 @@ class EvpDigestOperation extends EvpFinalDigestOperationStep instanceof Call {
9898
/**
9999
* A call to EVP_DigestFinal variants
100100
*/
101-
class EvpDigestFinalCall extends EvpFinalDigestOperationStep instanceof Call {
101+
class EvpDigestFinalCall extends FinalDigestOperation instanceof Call {
102102
EvpDigestFinalCall() {
103103
this.getTarget().getName() in ["EVP_DigestFinal", "EVP_DigestFinal_ex", "EVP_DigestFinalXOF"]
104104
}
@@ -118,7 +118,7 @@ class EvpDigestFinalCall extends EvpFinalDigestOperationStep instanceof Call {
118118
/**
119119
* An openssl digest final hash operation instance
120120
*/
121-
class EvpDigestFinalOperationInstance extends Crypto::HashOperationInstance instanceof EvpFinalDigestOperationStep
121+
class OpenSslDigestFinalOperationInstance extends Crypto::HashOperationInstance instanceof FinalDigestOperation
122122
{
123123
override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
124124
super.getPrimaryAlgorithmValueConsumer() = result

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/KeyGenOperation.qll‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ class EvpKeyGenInitialize extends OperationStep {
4343
override OperationStepType getStepType() { result = InitializerStep() }
4444
}
4545

46+
/**
47+
* A base class for final key generation operation steps.
48+
*/
4649
abstract class KeyGenFinalOperationStep extends OperationStep {
4750
override OperationStepType getStepType() { result = FinalStep() }
4851
}
@@ -165,7 +168,7 @@ class EvpNewMacKey extends KeyGenFinalOperationStep {
165168
/**
166169
* An `KeyGenerationOperationInstance` for the for all key gen final operation steps.
167170
*/
168-
class KeyGenOperationInstance extends Crypto::KeyGenerationOperationInstance instanceof KeyGenFinalOperationStep
171+
class OpenSslKeyGenOperationInstance extends Crypto::KeyGenerationOperationInstance instanceof KeyGenFinalOperationStep
169172
{
170173
override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
171174
super.getPrimaryAlgorithmValueConsumer() = result

0 commit comments

Comments
 (0)