diff --git a/Makefile.am b/Makefile.am index 7ac184b504..460303cb7b 100644 --- a/Makefile.am +++ b/Makefile.am @@ -63,7 +63,7 @@ cppcheck: --enable=warning,style,performance,portability,unusedFunction,missingInclude \ --inconclusive \ --template="warning: {file},{line},{severity},{id},{message}" \ - -I headers -I . -I $(top_srcdir)/others -I $(top_srcdir)/src -I $(top_srcdir)/others/mbedtls/include \ + -I headers -I . -I $(top_srcdir)/others -I $(top_srcdir)/src -I $(top_srcdir)/others/mbedtls/include -I $(top_srcdir)/others/mbedtls/tf-psa-crypto/include -I $(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/include \ --error-exitcode=1 \ -i "src/parser/seclang-parser.cc" -i "src/parser/seclang-scanner.cc" \ -i others \ @@ -99,4 +99,3 @@ pkgconfig_DATA = modsecurity.pc EXTRA_DIST = modsecurity.pc.in \ modsecurity.conf-recommended \ unicode.mapping - diff --git a/build/win32/CMakeLists.txt b/build/win32/CMakeLists.txt index fbf39f08d9..8dad8ba8ce 100644 --- a/build/win32/CMakeLists.txt +++ b/build/win32/CMakeLists.txt @@ -51,10 +51,32 @@ target_compile_definitions(libinjection PRIVATE LIBINJECTION_VERSION="${LIBINJEC project(mbedcrypto C) set(MBEDTLS_DIR ${BASE_DIR}/others/mbedtls) +set(TF_PSA_CRYPTO_DIR ${MBEDTLS_DIR}/tf-psa-crypto) + +add_library(mbedcrypto STATIC + ${TF_PSA_CRYPTO_DIR}/utilities/base64.c + ${TF_PSA_CRYPTO_DIR}/utilities/constant_time.c + ${TF_PSA_CRYPTO_DIR}/platform/platform_util.c + ${TF_PSA_CRYPTO_DIR}/extras/md.c + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src/md5.c + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src/sha1.c + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src/sha256.c + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src/sha512.c + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src/sha3.c + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src/ripemd160.c + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src/psa_util_internal.c +) -add_library(mbedcrypto STATIC ${MBEDTLS_DIR}/library/base64.c ${MBEDTLS_DIR}/library/sha1.c ${MBEDTLS_DIR}/library/md5.c ${MBEDTLS_DIR}/library/platform_util.c ${MBEDTLS_DIR}/library/constant_time.c) - -target_include_directories(mbedcrypto PRIVATE ${MBEDTLS_DIR}/include) +target_include_directories(mbedcrypto PRIVATE + ${MBEDTLS_DIR}/include + ${TF_PSA_CRYPTO_DIR}/include + ${TF_PSA_CRYPTO_DIR}/core + ${TF_PSA_CRYPTO_DIR}/extras + ${TF_PSA_CRYPTO_DIR}/library + ${TF_PSA_CRYPTO_DIR}/utilities + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/include + ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src +) # get mbedtls version with git describe execute_process( @@ -137,7 +159,7 @@ file(GLOB_RECURSE libModSecuritySources ${BASE_DIR}/src/*.cc) add_library(libModSecurity SHARED ${libModSecuritySources}) target_compile_definitions(libModSecurity PRIVATE WITH_PCRE2) -target_include_directories(libModSecurity PRIVATE ${BASE_DIR} ${BASE_DIR}/headers ${BASE_DIR}/others ${MBEDTLS_DIR}/include) +target_include_directories(libModSecurity PRIVATE ${BASE_DIR} ${BASE_DIR}/headers ${BASE_DIR}/others ${MBEDTLS_DIR}/include ${TF_PSA_CRYPTO_DIR}/include ${TF_PSA_CRYPTO_DIR}/drivers/builtin/include) target_link_libraries(libModSecurity PRIVATE pcre2::pcre2 libinjection mbedcrypto Poco::Poco Iphlpapi.lib) macro(add_package_dependency project compile_definition link_library flag) diff --git a/configure.ac b/configure.ac index 03295be063..7bdcca6bc4 100644 --- a/configure.ac +++ b/configure.ac @@ -84,7 +84,7 @@ AC_DEFUN([LIBINJECTION_VERSION], m4_esyscmd_s(cd "others/libinjection" && git de AC_SUBST([LIBINJECTION_VERSION]) # Check for Mbed TLS -if ! test -f "${srcdir}/others/mbedtls/library/base64.c"; then +if ! test -f "${srcdir}/others/mbedtls/tf-psa-crypto/utilities/base64.c"; then AC_MSG_ERROR([\ @@ -532,4 +532,3 @@ if test "$aflFuzzer" = "true"; then echo " $ export CC=afl-clang-fast " echo " " fi - diff --git a/others/Makefile.am b/others/Makefile.am index b102a0330c..8ad042cdeb 100644 --- a/others/Makefile.am +++ b/others/Makefile.am @@ -15,19 +15,24 @@ noinst_HEADERS = \ libinjection/src/libinjection_sqli.h \ libinjection/src/libinjection_sqli_data.h \ libinjection/src/libinjection_xss.h \ - mbedtls/include/mbedtls/base64.h \ - mbedtls/include/mbedtls/check_config.h \ + mbedtls/tf-psa-crypto/include/mbedtls/base64.h \ mbedtls/include/mbedtls/mbedtls_config.h \ - mbedtls/include/mbedtls/md5.h \ - mbedtls/include/mbedtls/platform.h \ - mbedtls/include/mbedtls/sha1.h + mbedtls/tf-psa-crypto/include/mbedtls/md.h \ + mbedtls/tf-psa-crypto/include/mbedtls/platform.h libmbedtls_la_SOURCES = \ - mbedtls/library/base64.c \ - mbedtls/library/md5.c \ - mbedtls/library/sha1.c \ - mbedtls/library/platform_util.c + mbedtls/tf-psa-crypto/utilities/base64.c \ + mbedtls/tf-psa-crypto/utilities/constant_time.c \ + mbedtls/tf-psa-crypto/platform/platform_util.c \ + mbedtls/tf-psa-crypto/extras/md.c \ + mbedtls/tf-psa-crypto/drivers/builtin/src/md5.c \ + mbedtls/tf-psa-crypto/drivers/builtin/src/sha1.c \ + mbedtls/tf-psa-crypto/drivers/builtin/src/sha256.c \ + mbedtls/tf-psa-crypto/drivers/builtin/src/sha512.c \ + mbedtls/tf-psa-crypto/drivers/builtin/src/sha3.c \ + mbedtls/tf-psa-crypto/drivers/builtin/src/ripemd160.c \ + mbedtls/tf-psa-crypto/drivers/builtin/src/psa_util_internal.c -libmbedtls_la_CFLAGS = -DMBEDTLS_CONFIG_FILE=\"mbedtls/mbedtls_config.h\" -I$(top_srcdir)/others/mbedtls/include +libmbedtls_la_CFLAGS = -DMBEDTLS_CONFIG_FILE=\"mbedtls/mbedtls_config.h\" -I$(top_srcdir)/others/mbedtls/include -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/include -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/core -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/extras -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/library -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/utilities -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/include -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/src libmbedtls_la_CPPFLAGS = libmbedtls_la_LIBADD = diff --git a/others/mbedtls b/others/mbedtls index 2ca6c285a0..0fe989b6b5 160000 --- a/others/mbedtls +++ b/others/mbedtls @@ -1 +1 @@ -Subproject commit 2ca6c285a0dd3f33982dd57299012dacab1ff206 +Subproject commit 0fe989b6b514192783c469039edd325fd0989806 diff --git a/src/Makefile.am b/src/Makefile.am index 14c26697b5..48515500e4 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -296,6 +296,8 @@ libmodsecurity_la_CPPFLAGS = \ -g \ -I$(top_srcdir)/others \ -I$(top_srcdir)/others/mbedtls/include \ + -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/include \ + -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/include \ -fPIC \ -O3 \ -I$(top_srcdir)/headers \ @@ -343,4 +345,3 @@ libmodsecurity_la_LIBADD = \ $(MAXMIND_LDADD) \ $(SSDEEP_LDADD) \ $(YAJL_LDADD) - diff --git a/src/utils/md5.h b/src/utils/md5.h index 68f5d748e4..85c21bf1fd 100644 --- a/src/utils/md5.h +++ b/src/utils/md5.h @@ -17,16 +17,15 @@ #define SRC_UTILS_MD5_H_ #include "src/utils/sha1.h" -#include "mbedtls/md5.h" #include namespace modsecurity::Utils { -class Md5 : public DigestImpl<&mbedtls_md5, 16> { +class Md5 : public DigestImpl { }; } // namespace modsecurity::Utils -#endif // SRC_UTILS_MD5_H_ \ No newline at end of file +#endif // SRC_UTILS_MD5_H_ diff --git a/src/utils/sha1.h b/src/utils/sha1.h index a40d7fa1c8..2bb5774c59 100644 --- a/src/utils/sha1.h +++ b/src/utils/sha1.h @@ -3,7 +3,7 @@ * Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/) * * You may not use this file except in compliance with - * the License. You may obtain a copy of the License at + * the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * @@ -16,60 +16,79 @@ #ifndef SRC_UTILS_SHA1_H_ #define SRC_UTILS_SHA1_H_ +#include +#include #include -#include +#include #include "src/utils/string.h" -#include "mbedtls/sha1.h" +#include "mbedtls/md.h" namespace modsecurity::Utils { +class DigestCalculationException : public std::exception { + public: + explicit DigestCalculationException(const char *message) noexcept + : m_message(message) { } -using DigestOp = int (*)(const unsigned char *, size_t, unsigned char []); + const char *what() const noexcept override { + return m_message; + } + private: + const char *m_message; +}; -template + +template class DigestImpl { public: - static std::string digest(const std::string& input) { - return digestHelper(input, [](const auto digest) { - return std::string(digest); - }); + const auto digestBytes = calculateDigest(input); + return std::string(digestBytes.begin(), digestBytes.end()); } static void digestReplace(std::string& value) { - digestHelper(value, [&value](const auto digest) mutable { - value = digest; - }); + const auto digestBytes = calculateDigest(value); + value.assign(digestBytes.begin(), digestBytes.end()); } - static std::string hexdigest(const std::string &input) { - return digestHelper(input, [](const auto digest) { - return utils::string::string_to_hex(digest); - }); + static std::string hexdigest(const std::string& input) { + const auto digestBytes = calculateDigest(input); + const std::string digestString(digestBytes.begin(), digestBytes.end()); + return utils::string::string_to_hex(digestString); } -private: - - template - static auto digestHelper(const std::string &input, - ConvertOp convertOp) -> auto { - char digest[DigestSize]; - - const auto ret = (*digestOp)(reinterpret_cast(input.c_str()), - input.size(), reinterpret_cast(digest)); - assert(ret == 0); - - return convertOp(std::string_view(digest, DigestSize)); + private: + static std::array calculateDigest( + std::string_view input) { + std::array digestBytes = {}; + + const mbedtls_md_info_t *mdInfo = mbedtls_md_info_from_type(DigestType); + if (mdInfo == nullptr) { + throw DigestCalculationException( + "mbedtls_md_info_from_type() returned nullptr"); + } + + const auto *inputBytes = + static_cast(static_cast(input.data())); + + if (const int ret = mbedtls_md( + mdInfo, + inputBytes, + input.size(), + digestBytes.data()); ret != 0) { + throw DigestCalculationException("mbedtls_md() failed"); + } + + return digestBytes; } }; -class Sha1 : public DigestImpl<&mbedtls_sha1, 20> { +class Sha1 : public DigestImpl { }; - } // namespace modsecurity::Utils #endif // SRC_UTILS_SHA1_H_