Crypto: Add OpenSSL elliptic curve algorithm instances and consumers #19528
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| import cpp | ||
| private import experimental.quantum.Language | ||
| private import KnownAlgorithmConstants | ||
| private import OpenSSLAlgorithmInstanceBase | ||
| private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase | ||
| private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer | ||
| private import AlgToAVCFlow | ||
|
|
||
| class KnownOpenSSLEllipticCurveConstantAlgorithmInstance extends OpenSSLAlgorithmInstance, | ||
| Crypto::EllipticCurveInstance instanceof KnownOpenSSLEllipticCurveAlgorithmConstant | ||
Check warningCode scanning / CodeQL Acronyms should be PascalCase/camelCase. Warning |
||
| { | ||
| OpenSSLAlgorithmValueConsumer getterCall; | ||
|
|
||
| KnownOpenSSLEllipticCurveConstantAlgorithmInstance() { | ||
| // Two possibilities: | ||
| // 1) The source is a literal and flows to a getter, then we know we have an instance | ||
| // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that | ||
| // Possibility 1: | ||
| this instanceof Literal and | ||
| exists(DataFlow::Node src, DataFlow::Node sink | | ||
| // Sink is an argument to a CipherGetterCall | ||
| sink = getterCall.getInputNode() and | ||
| // Source is `this` | ||
| src.asExpr() = this and | ||
| // This traces to a getter | ||
| KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink) | ||
| ) | ||
| or | ||
| // Possibility 2: | ||
| this instanceof DirectAlgorithmValueConsumer and getterCall = this | ||
| } | ||
|
|
||
| override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall } | ||
Check warningCode scanning / CodeQL Acronyms should be PascalCase/camelCase. Warning |
||
|
|
||
| override string getRawEllipticCurveName() { result = this.(Literal).getValue().toString() } | ||
|
|
||
| override Crypto::TEllipticCurveType getEllipticCurveType() { | ||
| Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSSLEllipticCurveAlgorithmConstant) | ||
| .getNormalizedName(), _, result) | ||
| } | ||
|
|
||
| override int getKeySize() { | ||
| Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSSLEllipticCurveAlgorithmConstant) | ||
| .getNormalizedName(), result, _) | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,36 @@ | ||||||||||||||||||||||||||
| import cpp | ||||||||||||||||||||||||||
| private import experimental.quantum.Language | ||||||||||||||||||||||||||
| private import experimental.quantum.OpenSSL.LibraryDetector | ||||||||||||||||||||||||||
| private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants | ||||||||||||||||||||||||||
| private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase | ||||||||||||||||||||||||||
| private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
|
There was a problem hiding this comment. [nitpick] Add a doc comment explaining the purpose and usage of
Suggested change
|
||||||||||||||||||||||||||
| abstract class EllipticCurveValueConsumer extends OpenSSLAlgorithmValueConsumer { } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| //https://docs.openssl.org/3.0/man3/EC_KEY_new/#name | ||||||||||||||||||||||||||
| class EVPEllipticCurveAlgorithmConsumer extends EllipticCurveValueConsumer { | ||||||||||||||||||||||||||
Check warningCode scanning / CodeQL Acronyms should be PascalCase/camelCase. Warning |
||||||||||||||||||||||||||
| DataFlow::Node valueArgNode; | ||||||||||||||||||||||||||
| DataFlow::Node resultNode; | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| EVPEllipticCurveAlgorithmConsumer() { | ||||||||||||||||||||||||||
| resultNode.asExpr() = this.(Call) and // in all cases the result is the return | ||||||||||||||||||||||||||
| isPossibleOpenSSLFunction(this.(Call).getTarget()) and | ||||||||||||||||||||||||||
| ( | ||||||||||||||||||||||||||
| this.(Call).getTarget().getName() in ["EVP_EC_gen", "EC_KEY_new_by_curve_name"] and | ||||||||||||||||||||||||||
| valueArgNode.asExpr() = this.(Call).getArgument(0) | ||||||||||||||||||||||||||
| or | ||||||||||||||||||||||||||
| this.(Call).getTarget().getName() in [ | ||||||||||||||||||||||||||
| "EC_KEY_new_by_curve_name_ex", "EVP_PKEY_CTX_set_ec_paramgen_curve_nid" | ||||||||||||||||||||||||||
| ] and | ||||||||||||||||||||||||||
| valueArgNode.asExpr() = this.(Call).getArgument(2) | ||||||||||||||||||||||||||
| ) | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| override Crypto::AlgorithmInstance getAKnownAlgorithmSource() { | ||||||||||||||||||||||||||
| exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i) | ||||||||||||||||||||||||||
|
Contributor
There was a problem hiding this comment. Why is there a generic algorithm class here, and why does the algorithm itself bind itself to the AVC as opposed to what is actually using/related to the algorithm consumed?
Contributor
There was a problem hiding this comment. Am I correct in my reasoning below? "An algorithm instance exists if and only if it is a string literal that flows to a consumer. Consequently, the definition of an algorithm instance is inherently constrained by the consumer to which it flows, establishing a dependent relationship between the instance and its consuming context."
Contributor
Author
There was a problem hiding this comment. basically a literal must flow to something that consumes it, if not, we aren't calling it an algorithm. There is a flip side, the direct algorithms (functions like AES()), these... well we could say are algorithms in their own right, but I didn't model it that way. So if these don't flow to something, they also don't exist as an algorithm. We may need to re-address that.
Contributor
There was a problem hiding this comment. Those are indeed algorithms -- the instance where you define them would be be modeled by extending an algorithm, operation, and AVC (assuming AES() also performs some sort of operation using AES). |
||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| override DataFlow::Node getResultNode() { result = resultNode } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode } | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check warning
Code scanning / CodeQL
Redundant import Warning