Content-Length: 1199624 | pFad | http://github.com/github/codeql/commit/a5b57d3694ad0dfcb6def764c958f3022246c61e

4E Merge branch 'main' into generic_constant_filtering · github/codeql@a5b57d3 · GitHub
Skip to content

Commit a5b57d3

Browse files
bdrodesbdrodes
committed
Merge branch 'main' into generic_constant_filtering
# Conflicts: # cpp/ql/lib/experimental/quantum/Language.qll # cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll # cpp/ql/lib/experimental/quantum/OpenSSL/OpenSSL.qll
2 parents 09170e5 + 663c83d commit a5b57d3

File tree

81 files changed

+1769
-771
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

81 files changed

+1769
-771
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,7 @@ node_modules/
7272

7373
# cargo build directory
7474
/target
75+
76+
# some upgrade/downgrade checks create these files
77+
**/upgrades/*/*.dbscheme.stats
78+
**/downgrades/*/*.dbscheme.stats

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/AlgToAVCFlow.qll

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ private import experimental.quantum.Language
33
private import semmle.code.cpp.dataflow.new.DataFlow
44
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
55
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
6+
private import PaddingAlgorithmInstance
67

78
/**
89
* Traces 'known algorithms' to AVCs, specifically
@@ -19,6 +20,9 @@ module KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::
1920
predicate isSink(DataFlow::Node sink) {
2021
exists(OpenSSLAlgorithmValueConsumer c |
2122
c.getInputNode() = sink and
23+
// exclude padding algorithm consumers, since
24+
// these consumers take in different constant values
25+
// not in the typical "known algorithm" set
2226
not c instanceof PaddingAlgorithmValueConsumer
2327
)
2428
}
@@ -43,9 +47,7 @@ module KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow =
4347
DataFlow::Global<KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig>;
4448

4549
module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
46-
predicate isSource(DataFlow::Node source) {
47-
source.asExpr() instanceof KnownOpenSSLAlgorithmConstant
48-
}
50+
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof OpenSSLPaddingLiteral }
4951

5052
predicate isSink(DataFlow::Node sink) {
5153
exists(PaddingAlgorithmValueConsumer c | c.getInputNode() = sink)

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/BlockAlgorithmInstance.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ private import AlgToAVCFlow
88

99
/**
1010
* Given a `KnownOpenSSLBlockModeAlgorithmConstant`, converts this to a block family type.
11-
* Does not bind if there is know mapping (no mapping to 'unknown' or 'other').
11+
* Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
1212
*/
1313
predicate knownOpenSSLConstantToBlockModeFamilyType(
1414
KnownOpenSSLBlockModeAlgorithmConstant e, Crypto::TBlockCipherModeOfOperationType type

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ private import BlockAlgorithmInstance
1111

1212
/**
1313
* Given a `KnownOpenSSLCipherAlgorithmConstant`, converts this to a cipher family type.
14-
* Does not bind if there is know mapping (no mapping to 'unknown' or 'other').
14+
* Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
1515
*/
1616
predicate knownOpenSSLConstantToCipherFamilyType(
1717
KnownOpenSSLCipherAlgorithmConstant e, Crypto::KeyOpAlg::TAlgorithm type

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ class KnownOpenSSLCipherAlgorithmConstant extends KnownOpenSSLAlgorithmConstant
2020

2121
KnownOpenSSLCipherAlgorithmConstant() {
2222
resolveAlgorithmFromExpr(this, _, algType) and
23-
algType.toLowerCase().matches("%encryption")
23+
algType.matches("%ENCRYPTION")
2424
}
2525

2626
int getExplicitKeySize() {
@@ -37,7 +37,7 @@ class KnownOpenSSLPaddingAlgorithmConstant extends KnownOpenSSLAlgorithmConstant
3737

3838
KnownOpenSSLPaddingAlgorithmConstant() {
3939
resolveAlgorithmFromExpr(this, _, algType) and
40-
algType.toLowerCase().matches("%padding")
40+
algType.matches("%PADDING")
4141
}
4242
}
4343

@@ -46,7 +46,7 @@ class KnownOpenSSLBlockModeAlgorithmConstant extends KnownOpenSSLAlgorithmConsta
4646

4747
KnownOpenSSLBlockModeAlgorithmConstant() {
4848
resolveAlgorithmFromExpr(this, _, algType) and
49-
algType.toLowerCase().matches("%block_mode")
49+
algType.matches("%BLOCK_MODE")
5050
}
5151
}
5252

@@ -55,7 +55,7 @@ class KnownOpenSSLHashAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
5555

5656
KnownOpenSSLHashAlgorithmConstant() {
5757
resolveAlgorithmFromExpr(this, _, algType) and
58-
algType.toLowerCase().matches("%hash")
58+
algType.matches("%HASH")
5959
}
6060

6161
int getExplicitDigestLength() {
@@ -71,7 +71,7 @@ class KnownOpenSSLEllipticCurveAlgorithmConstant extends KnownOpenSSLAlgorithmCo
7171
KnownOpenSSLEllipticCurveAlgorithmConstant() {
7272
exists(string algType |
7373
resolveAlgorithmFromExpr(this, _, algType) and
74-
algType.toLowerCase().matches("elliptic_curve")
74+
algType.matches("ELLIPTIC_CURVE")
7575
)
7676
}
7777
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/PaddingAlgorithmInstance.qll

Lines changed: 35 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,26 @@ private import AlgToAVCFlow
66
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
77
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
88

9+
/**
10+
* A class to define padding specific integer values.
11+
* from rsa.h in openssl:
12+
* # define RSA_PKCS1_PADDING 1
13+
* # define RSA_NO_PADDING 3
14+
* # define RSA_PKCS1_OAEP_PADDING 4
15+
* # define RSA_X931_PADDING 5
16+
* # define RSA_PKCS1_PSS_PADDING 6
17+
* # define RSA_PKCS1_WITH_TLS_PADDING 7
18+
* # define RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING 8
19+
*/
20+
class OpenSSLPaddingLiteral extends Literal {
21+
// TODO: we can be more specific about where the literal is in a larger expression
22+
// to avoid literals that are clealy not representing an algorithm, e.g., array indices.
23+
OpenSSLPaddingLiteral() { this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8] }
24+
}
25+
926
/**
1027
* Given a `KnownOpenSSLPaddingAlgorithmConstant`, converts this to a padding family type.
11-
* Does not bind if there is know mapping (no mapping to 'unknown' or 'other').
28+
* Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
1229
*/
1330
predicate knownOpenSSLConstantToPaddingFamilyType(
1431
KnownOpenSSLPaddingAlgorithmConstant e, Crypto::TPaddingType type
@@ -60,19 +77,8 @@ class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInsta
6077
this instanceof KnownOpenSSLPaddingAlgorithmConstant and
6178
isPaddingSpecificConsumer = false
6279
or
63-
// Possibility 3:
64-
// from rsa.h in openssl:
65-
// # define RSA_PKCS1_PADDING 1
66-
// # define RSA_NO_PADDING 3
67-
// # define RSA_PKCS1_OAEP_PADDING 4
68-
// # define RSA_X931_PADDING 5
69-
// /* EVP_PKEY_ only */
70-
// # define RSA_PKCS1_PSS_PADDING 6
71-
// # define RSA_PKCS1_WITH_TLS_PADDING 7
72-
// /* internal RSA_ only */
73-
// # define RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING 8
74-
this instanceof Literal and
75-
this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8] and
80+
// Possibility 3: padding-specific literal
81+
this instanceof OpenSSLPaddingLiteral and
7682
exists(DataFlow::Node src, DataFlow::Node sink |
7783
// Sink is an argument to a CipherGetterCall
7884
sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
@@ -88,24 +94,24 @@ class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInsta
8894

8995
override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
9096

97+
Crypto::TPaddingType getKnownPaddingType() {
98+
this.(Literal).getValue().toInt() in [1, 7, 8] and result = Crypto::PKCS1_v1_5()
99+
or
100+
this.(Literal).getValue().toInt() = 3 and result = Crypto::NoPadding()
101+
or
102+
this.(Literal).getValue().toInt() = 4 and result = Crypto::OAEP()
103+
or
104+
this.(Literal).getValue().toInt() = 5 and result = Crypto::ANSI_X9_23()
105+
or
106+
this.(Literal).getValue().toInt() = 6 and result = Crypto::PSS()
107+
}
108+
91109
override Crypto::TPaddingType getPaddingType() {
92110
isPaddingSpecificConsumer = true and
93111
(
94-
if this.(Literal).getValue().toInt() in [1, 7, 8]
95-
then result = Crypto::PKCS1_v1_5()
96-
else
97-
if this.(Literal).getValue().toInt() = 3
98-
then result = Crypto::NoPadding()
99-
else
100-
if this.(Literal).getValue().toInt() = 4
101-
then result = Crypto::OAEP()
102-
else
103-
if this.(Literal).getValue().toInt() = 5
104-
then result = Crypto::ANSI_X9_23()
105-
else
106-
if this.(Literal).getValue().toInt() = 6
107-
then result = Crypto::PSS()
108-
else result = Crypto::OtherPadding()
112+
result = this.getKnownPaddingType()
113+
or
114+
not exists(this.getKnownPaddingType()) and result = Crypto::OtherPadding()
109115
)
110116
or
111117
isPaddingSpecificConsumer = false and

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/CipherAlgorithmValueConsumer.qll

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
import cpp
22
private import experimental.quantum.Language
3-
private import experimental.quantum.OpenSSL.LibraryDetector
43
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
54
private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
65
private import OpenSSLAlgorithmValueConsumerBase
@@ -14,7 +13,6 @@ class EVPCipherAlgorithmValueConsumer extends CipherAlgorithmValueConsumer {
1413

1514
EVPCipherAlgorithmValueConsumer() {
1615
resultNode.asExpr() = this and
17-
isPossibleOpenSSLFunction(this.(Call).getTarget()) and
1816
(
1917
this.(Call).getTarget().getName() in [
2018
"EVP_get_cipherbyname", "EVP_get_cipherbyobj", "EVP_get_cipherbynid"

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/DirectAlgorithmValueConsumer.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ private import experimental.quantum.Language
33
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
44
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
55

6-
// TODO: can self referential to itself, which is also an algorithm (Known algorithm)
76
/**
87
* Cases like EVP_MD5(),
98
* there is no input, rather it directly gets an algorithm

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/EllipticCurveAlgorithmValueConsumer.qll

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
import cpp
22
private import experimental.quantum.Language
3-
private import experimental.quantum.OpenSSL.LibraryDetector
43
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
54
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
65
private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
@@ -14,7 +13,6 @@ class EVPEllipticCurveAlgorithmConsumer extends EllipticCurveValueConsumer {
1413

1514
EVPEllipticCurveAlgorithmConsumer() {
1615
resultNode.asExpr() = this.(Call) and // in all cases the result is the return
17-
isPossibleOpenSSLFunction(this.(Call).getTarget()) and
1816
(
1917
this.(Call).getTarget().getName() in ["EVP_EC_gen", "EC_KEY_new_by_curve_name"] and
2018
valueArgNode.asExpr() = this.(Call).getArgument(0)

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/HashAlgorithmValueConsumer.qll

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,34 @@ class EVP_Q_Digest_Algorithm_Consumer extends OpenSSLAlgorithmValueConsumer {
3030
none()
3131
}
3232
}
33+
34+
/**
35+
* The EVP digest algorithm getters
36+
* https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
37+
*/
38+
class EVPDigestAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer {
39+
DataFlow::Node valueArgNode;
40+
DataFlow::Node resultNode;
41+
42+
EVPDigestAlgorithmValueConsumer() {
43+
resultNode.asExpr() = this and
44+
isPossibleOpenSSLFunction(this.(Call).getTarget()) and
45+
(
46+
this.(Call).getTarget().getName() in [
47+
"EVP_get_digestbyname", "EVP_get_digestbynid", "EVP_get_digestbyobj"
48+
] and
49+
valueArgNode.asExpr() = this.(Call).getArgument(0)
50+
or
51+
this.(Call).getTarget().getName() = "EVP_MD_fetch" and
52+
valueArgNode.asExpr() = this.(Call).getArgument(1)
53+
)
54+
}
55+
56+
override DataFlow::Node getResultNode() { result = resultNode }
57+
58+
override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
59+
60+
override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
61+
exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
62+
}
63+
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/OpenSSLAlgorithmValueConsumerBase.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
private import experimental.quantum.Language
2-
private import semmle.code.cpp.dataflow.new.DataFlow
32

43
abstract class OpenSSLAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer instanceof Call {
54
/**

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/PKeyAlgorithmValueConsumer.qll

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
import cpp
22
private import experimental.quantum.Language
3-
private import experimental.quantum.OpenSSL.LibraryDetector
43
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
54
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
65
private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
@@ -13,7 +12,6 @@ class EVPPKeyAlgorithmConsumer extends PKeyValueConsumer {
1312

1413
EVPPKeyAlgorithmConsumer() {
1514
resultNode.asExpr() = this.(Call) and // in all cases the result is the return
16-
isPossibleOpenSSLFunction(this.(Call).getTarget()) and
1715
(
1816
// NOTE: some of these consumers are themselves key gen operations,
1917
// in these cases, the operation will be created separately for the same function.

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/PaddingAlgorithmValueConsumer.qll

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
import cpp
22
private import experimental.quantum.Language
3-
private import experimental.quantum.OpenSSL.LibraryDetector
43
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
54
private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
65
private import OpenSSLAlgorithmValueConsumerBase
@@ -16,11 +15,8 @@ class EVP_PKEY_CTX_set_rsa_padding_AlgorithmValueConsumer extends PaddingAlgorit
1615

1716
EVP_PKEY_CTX_set_rsa_padding_AlgorithmValueConsumer() {
1817
resultNode.asExpr() = this and
19-
isPossibleOpenSSLFunction(this.(Call).getTarget()) and
20-
(
21-
this.(Call).getTarget().getName() in ["EVP_PKEY_CTX_set_rsa_padding"] and
22-
valueArgNode.asExpr() = this.(Call).getArgument(1)
23-
)
18+
this.(Call).getTarget().getName() = "EVP_PKEY_CTX_set_rsa_padding" and
19+
valueArgNode.asExpr() = this.(Call).getArgument(1)
2420
}
2521

2622
override DataFlow::Node getResultNode() { result = resultNode }

0 commit comments

Comments
 (0)








ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: http://github.com/github/codeql/commit/a5b57d3694ad0dfcb6def764c958f3022246c61e

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy