Skip to content

Commit 8f39989

Browse files
jbjjbj
authored
Merge pull request #2376 from geoffw0/qhelpms2
CPP: Recommendations and examples for TlsSettingsMisconfiguration.qhelp and UseOfDeprecatedHardCodedProtocol.qhelp
2 parents a820438 + cdbe920 commit 8f39989

10 files changed

+86
-16
lines changed

‎cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.qhelp‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,17 @@
66
<p>Using the TLS or SSLv23 protocol from the boost::asio library, but not disabling deprecated protocols may expose the software to known vulnerabilities or permit weak encryption algorithms to be used. Disabling the minimum-recommended protocols is also flagged.</p>
77
</overview>
88

9+
<recommendation>
10+
<p>When using the TLS or SSLv23 protocol, set the <code>no_tlsv1</code> and <code>no_tlsv1_1</code> options, but do not set <code>no_tlsv1_2</code>. When using the SSLv23 protocol, also set the <code>no_sslv3</code> option.</p>
11+
</recommendation>
12+
13+
<example>
14+
<p>In the following example, the <code>no_tlsv1_1</code> option has not been set. Use of TLS 1.1 is not recommended.</p>
15+
<sample src="TlsSettingsMisconfigurationBad.cpp"/>
16+
<p>In the corrected example, the <code>no_tlsv1</code> and <code>no_tlsv1_1</code> options have both been set, ensuring the use of TLS 1.2 or later.</p>
17+
<sample src="TlsSettingsMisconfigurationGood.cpp"/>
18+
</example>
19+
920
<references>
1021
<li>
1122
<a href="https://www.boost.org/doc/libs/1_71_0/doc/html/boost_asio.html">Boost.Asio documentation</a>.

‎cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfigurationBad.cpp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
void useTLS_bad()
3+
{
4+
boost::asio::ssl::context ctx(boost::asio::ssl::context::tls);
5+
ctx.set_options(boost::asio::ssl::context::no_tlsv1); // BAD: missing no_tlsv1_1
6+
7+
// ...
8+
}

‎cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfigurationGood.cpp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
void useTLS_good()
3+
{
4+
boost::asio::ssl::context ctx(boost::asio::ssl::context::tls);
5+
ctx.set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1); // GOOD
6+
7+
// ...
8+
}

‎cpp/ql/src/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.qhelp‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,22 @@
44
<qhelp>
55
<overview>
66
<p>Using boost::asio library but specifying a deprecated hardcoded protocol.</p>
7-
<p>Using a deprecated hardcoded protocol instead of negotiting would lock your application to a protocol that has known vulnerabilities or weaknesses.</p>
87
</overview>
98

9+
<recommendation>
10+
<p>Only use modern protocols such as TLS 1.2 or TLS 1.3.</p>
11+
</recommendation>
12+
13+
<example>
14+
<p>In the following example, the <code>sslv2</code> protocol is specified. This protocol is out of date and its use is not recommended.</p>
15+
<sample src="UseOfDeprecatedHardcodedProtocolBad.cpp"/>
16+
<p>In the corrected example, the <code>tlsv13</code> protocol is used instead.</p>
17+
<sample src="UseOfDeprecatedHardcodedProtocolGood.cpp"/>
18+
</example>
19+
1020
<references>
1121
<li>
1222
<a href="https://www.boost.org/doc/libs/1_71_0/doc/html/boost_asio.html">Boost.Asio documentation</a>.
1323
</li>
1424
</references>
1525
</qhelp>
16-

‎cpp/ql/src/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocolBad.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
void useProtocol_bad()
3+
{
4+
boost::asio::ssl::context ctx_sslv2(boost::asio::ssl::context::sslv2); // BAD: outdated protocol
5+
6+
// ...
7+
}

‎cpp/ql/src/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocolGood.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
void useProtocol_good()
3+
{
4+
boost::asio::ssl::context cxt_tlsv13(boost::asio::ssl::context::tlsv13);
5+
6+
// ...
7+
}

‎cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* @name Conditionally uninitialized variable
3-
* @description When an initialization function is used to initialize a local variable, but the
4-
* returned status code is not checked, the variable may be left in an uninitialized
3+
* @description An initialization function is used to initialize a local variable, but the
4+
* returned status code is not checked. The variable may be left in an uninitialized
55
* state, and reading the variable may result in undefined behavior.
66
* @kind problem
77
* @problem.severity warning

‎cpp/ql/test/query-tests/Likely Bugs/Protocols/TlsSettingsMisconfiguration.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
| test2.cpp:52:32:52:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:52:32:52:65 | call to context | boost::asio::ssl::context::context | test2.cpp:52:32:52:64 | sslv23 | sslv23 | test2.cpp:52:32:52:65 | call to context | no_sslv3 has not been set |
1010
| test2.cpp:52:32:52:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:52:32:52:65 | call to context | boost::asio::ssl::context::context | test2.cpp:52:32:52:64 | sslv23 | sslv23 | test2.cpp:52:32:52:65 | call to context | no_tlsv1 has not been set |
1111
| test2.cpp:52:32:52:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test2.cpp:52:32:52:65 | call to context | boost::asio::ssl::context::context | test2.cpp:52:32:52:64 | sslv23 | sslv23 | test2.cpp:52:32:52:65 | call to context | no_tlsv1_1 has not been set |
12+
| test3.cpp:7:32:7:62 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test3.cpp:7:32:7:62 | call to context | boost::asio::ssl::context::context | test3.cpp:7:32:7:61 | tls | tls | test3.cpp:7:32:7:62 | call to context | no_tlsv1_1 has not been set |
1213
| test.cpp:25:32:25:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test.cpp:25:32:25:65 | call to context | boost::asio::ssl::context::context | test.cpp:25:32:25:64 | sslv23 | sslv23 | test.cpp:25:32:25:65 | call to context | no_sslv3 has not been set |
1314
| test.cpp:31:32:31:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test.cpp:31:32:31:65 | call to context | boost::asio::ssl::context::context | test.cpp:31:32:31:64 | sslv23 | sslv23 | test.cpp:31:32:31:65 | call to context | no_sslv3 has not been set |
1415
| test.cpp:31:32:31:65 | call to context | Usage of $@ with protocol $@ is not configured correctly: The option $@. | test.cpp:31:32:31:65 | call to context | boost::asio::ssl::context::context | test.cpp:31:32:31:64 | sslv23 | sslv23 | test.cpp:31:32:31:65 | call to context | no_tlsv1 has not been set |

‎cpp/ql/test/query-tests/Likely Bugs/Protocols/test.cpp‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,13 @@ void TestHardcodedProtocols()
6565

6666
////////////////////// Hardcoded algorithms
6767

68-
boost::asio::ssl::context cxt_tlsv12(boost::asio::ssl::context::tlsv12); // BUG
69-
boost::asio::ssl::context cxt_tlsv12c(boost::asio::ssl::context::tlsv12_client); // BUG
70-
boost::asio::ssl::context cxt_tlsv12s(boost::asio::ssl::context::tlsv12_server); // BUG
68+
boost::asio::ssl::context cxt_tlsv12(boost::asio::ssl::context::tlsv12);
69+
boost::asio::ssl::context cxt_tlsv12c(boost::asio::ssl::context::tlsv12_client);
70+
boost::asio::ssl::context cxt_tlsv12s(boost::asio::ssl::context::tlsv12_server);
7171

72-
boost::asio::ssl::context cxt_tlsv13(boost::asio::ssl::context::tlsv13); // BUG
73-
boost::asio::ssl::context cxt_tlsv13c(boost::asio::ssl::context::tlsv13_client); // BUG
74-
boost::asio::ssl::context cxt_tlsv13s(boost::asio::ssl::context::tlsv13_server); // BUG
72+
boost::asio::ssl::context cxt_tlsv13(boost::asio::ssl::context::tlsv13);
73+
boost::asio::ssl::context cxt_tlsv13c(boost::asio::ssl::context::tlsv13_client);
74+
boost::asio::ssl::context cxt_tlsv13s(boost::asio::ssl::context::tlsv13_server);
7575
}
7676

7777
void InterProceduralTest(boost::asio::ssl::context::method m)
@@ -100,11 +100,11 @@ void TestHardcodedProtocols_inter()
100100

101101
////////////////////// Hardcoded algorithms
102102

103-
InterProceduralTest(boost::asio::ssl::context::tlsv12); // BUG
104-
InterProceduralTest(boost::asio::ssl::context::tlsv12_client); // BUG
105-
InterProceduralTest(boost::asio::ssl::context::tlsv12_server); // BUG
103+
InterProceduralTest(boost::asio::ssl::context::tlsv12);
104+
InterProceduralTest(boost::asio::ssl::context::tlsv12_client);
105+
InterProceduralTest(boost::asio::ssl::context::tlsv12_server);
106106

107-
InterProceduralTest(boost::asio::ssl::context::tlsv13); // BUG
108-
InterProceduralTest(boost::asio::ssl::context::tlsv13_client); // BUG
109-
InterProceduralTest(boost::asio::ssl::context::tlsv13_server); // BUG
107+
InterProceduralTest(boost::asio::ssl::context::tlsv13);
108+
InterProceduralTest(boost::asio::ssl::context::tlsv13_client);
109+
InterProceduralTest(boost::asio::ssl::context::tlsv13_server);
110110
}

‎cpp/ql/test/query-tests/Likely Bugs/Protocols/test3.cpp‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#include "asio/boost_simulation.hpp"
2+
3+
// examples from the qhelp...
4+
5+
void useTLS_bad()
6+
{
7+
boost::asio::ssl::context ctx(boost::asio::ssl::context::tls);
8+
ctx.set_options(boost::asio::ssl::context::no_tlsv1); // BAD: missing no_tlsv1_1
9+
10+
// ...
11+
}
12+
13+
void useTLS_good()
14+
{
15+
boost::asio::ssl::context ctx(boost::asio::ssl::context::tls);
16+
ctx.set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1); // GOOD
17+
18+
// ...
19+
}

0 commit comments

Comments
 (0)