hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Crypto: Add key input support for the graph for key generation operations.

Browse Source
This commit is contained in:
REDMOND\brodes
2025-06-26 11:51:49 -04:00
parent c54e68c855
commit 505d8806c7
5 changed files with 35 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
cpp/ql/lib/experimental/quantum/OpenSSL/Operations/KeyGenOperation.qll
View File

@@ -177,6 +177,10 @@ class KeyGenOperationInstance extends Crypto::KeyGenerationOperationInstance ins
super.getOutputStepFlowingToStep(KeyIO()).getOutput(KeyIO()) = result
}
override predicate hasKeyValueConsumer() {
exists(OperationStep s | s.flowsToOperationStep(this) and s.setsValue(KeyIO()))
}
override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
super.getDominatingInitializersToStep(KeySizeIO()).getInput(KeySizeIO()) = result
}
@@ -194,7 +198,7 @@ class KeyGenOperationInstance extends Crypto::KeyGenerationOperationInstance ins
// .getKeySize()
}
override Crypto::ConsumerInputDataFlowNode getRawKeyValueConsumer() {
override Crypto::ConsumerInputDataFlowNode getKeyValueConsumer() {
super.getDominatingInitializersToStep(KeyIO()).getInput(KeyIO()) = result
}
}

4
cpp/ql/test/experimental/library-tests/quantum/node_edges.expected
View File

@@ -32,8 +32,10 @@
| openssl_basic.c:144:46:144:51 | Digest | Source | openssl_basic.c:144:46:144:51 | Digest |
| openssl_basic.c:155:22:155:41 | Key | Algorithm | openssl_basic.c:155:22:155:41 | Key |
| openssl_basic.c:155:22:155:41 | KeyGeneration | Algorithm | openssl_basic.c:155:22:155:41 | KeyGeneration |
| openssl_basic.c:155:22:155:41 | KeyGeneration | KeyInput | openssl_basic.c:155:64:155:66 | Key |
| openssl_basic.c:155:22:155:41 | KeyGeneration | Output | openssl_basic.c:155:22:155:41 | Key |
| openssl_basic.c:155:43:155:55 | MACAlgorithm | H | openssl_basic.c:160:39:160:48 | HashAlgorithm |
| openssl_basic.c:155:64:155:66 | Key | Source | openssl_basic.c:179:43:179:76 | Constant |
| openssl_basic.c:160:59:160:62 | Key | Source | openssl_basic.c:155:22:155:41 | Key |
| openssl_basic.c:163:35:163:41 | Message | Source | openssl_basic.c:181:49:181:87 | Constant |
| openssl_basic.c:167:9:167:27 | SignOperation | Algorithm | openssl_basic.c:167:9:167:27 | SignOperation |
@@ -154,7 +156,9 @@
| openssl_signature.c:548:9:548:23 | KeyGeneration | Algorithm | openssl_signature.c:543:35:543:46 | KeyOperationAlgorithm |
| openssl_signature.c:548:9:548:23 | KeyGeneration | Output | openssl_signature.c:548:34:548:37 | Key |
| openssl_signature.c:548:34:548:37 | Key | Algorithm | openssl_signature.c:543:35:543:46 | KeyOperationAlgorithm |
| openssl_signature.c:575:32:575:37 | Key | Source | openssl_signature.c:575:32:575:37 | Key |
| openssl_signature.c:578:9:578:23 | KeyGeneration | Algorithm | openssl_signature.c:565:50:565:54 | KeyOperationAlgorithm |
| openssl_signature.c:578:9:578:23 | KeyGeneration | KeyInput | openssl_signature.c:575:32:575:37 | Key |
| openssl_signature.c:578:9:578:23 | KeyGeneration | Output | openssl_signature.c:578:34:578:37 | Key |
| openssl_signature.c:578:34:578:37 | Key | Algorithm | openssl_signature.c:565:50:565:54 | KeyOperationAlgorithm |
| openssl_signature.c:702:60:702:71 | KeyOperationAlgorithm | Padding | openssl_signature.c:702:60:702:71 | KeyOperationAlgorithm |

2
cpp/ql/test/experimental/library-tests/quantum/node_properties.expected
View File

@@ -23,6 +23,7 @@
| openssl_basic.c:155:22:155:41 | Key | KeyType | Asymmetric | openssl_basic.c:155:22:155:41 | openssl_basic.c:155:22:155:41 |
| openssl_basic.c:155:43:155:55 | MACAlgorithm | Name | HMAC | openssl_basic.c:155:43:155:55 | openssl_basic.c:155:43:155:55 |
| openssl_basic.c:155:43:155:55 | MACAlgorithm | RawName | 855 | openssl_basic.c:155:43:155:55 | openssl_basic.c:155:43:155:55 |
| openssl_basic.c:155:64:155:66 | Key | KeyType | Unknown | openssl_basic.c:155:64:155:66 | openssl_basic.c:155:64:155:66 |
| openssl_basic.c:160:39:160:48 | HashAlgorithm | DigestSize | 256 | openssl_basic.c:160:39:160:48 | openssl_basic.c:160:39:160:48 |
| openssl_basic.c:160:39:160:48 | HashAlgorithm | Name | SHA2 | openssl_basic.c:160:39:160:48 | openssl_basic.c:160:39:160:48 |
| openssl_basic.c:160:39:160:48 | HashAlgorithm | RawName | EVP_sha256 | openssl_basic.c:160:39:160:48 | openssl_basic.c:160:39:160:48 |
@@ -65,6 +66,7 @@
| openssl_signature.c:565:50:565:54 | KeyOperationAlgorithm | Name | DSA | openssl_signature.c:565:50:565:54 | openssl_signature.c:565:50:565:54 |
| openssl_signature.c:565:50:565:54 | KeyOperationAlgorithm | RawName | dsa | openssl_signature.c:565:50:565:54 | openssl_signature.c:565:50:565:54 |
| openssl_signature.c:569:55:569:58 | Constant | Description | 2048 | openssl_signature.c:569:55:569:58 | openssl_signature.c:569:55:569:58 |
| openssl_signature.c:575:32:575:37 | Key | KeyType | Unknown | openssl_signature.c:575:32:575:37 | openssl_signature.c:575:32:575:37 |
| openssl_signature.c:578:34:578:37 | Key | KeyType | Asymmetric | openssl_signature.c:578:34:578:37 | openssl_signature.c:578:34:578:37 |
| openssl_signature.c:602:37:602:77 | Constant | Description | Test message for OpenSSL signature APIs | openssl_signature.c:602:37:602:77 | openssl_signature.c:602:37:602:77 |
| openssl_signature.c:684:24:684:33 | HashAlgorithm | DigestSize | 256 | openssl_signature.c:684:24:684:33 | openssl_signature.c:684:24:684:33 |

2
cpp/ql/test/experimental/library-tests/quantum/nodes.expected
View File

@@ -25,6 +25,7 @@
| openssl_basic.c:155:22:155:41 | Key |
| openssl_basic.c:155:22:155:41 | KeyGeneration |
| openssl_basic.c:155:43:155:55 | MACAlgorithm |
| openssl_basic.c:155:64:155:66 | Key |
| openssl_basic.c:160:39:160:48 | HashAlgorithm |
| openssl_basic.c:160:59:160:62 | Key |
| openssl_basic.c:163:35:163:41 | Message |
@@ -86,6 +87,7 @@
| openssl_signature.c:548:34:548:37 | Key |
| openssl_signature.c:565:50:565:54 | KeyOperationAlgorithm |
| openssl_signature.c:569:55:569:58 | Constant |
| openssl_signature.c:575:32:575:37 | Key |
| openssl_signature.c:578:9:578:23 | KeyGeneration |
| openssl_signature.c:578:34:578:37 | Key |
| openssl_signature.c:602:37:602:77 | Constant |

30
shared/quantum/codeql/quantum/experimental/Model.qll
View File

@@ -295,6 +295,8 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
(
exists(KeyCreationOperationInstance op | input = op.getKeySizeConsumer())
or
exists(KeyGenerationOperationInstance op | input = op.getKeyValueConsumer())
or
exists(KeyDerivationOperationInstance op |
input = op.getIterationCountConsumer() or
input = op.getOutputKeySizeConsumer()
@@ -539,6 +541,8 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
(
exists(KeyOperationInstance op | inputNode = op.getKeyConsumer())
or
exists(KeyGenerationOperationInstance op | inputNode = op.getKeyValueConsumer())
or
exists(MacOperationInstance op | inputNode = op.getKeyConsumer())
or
exists(KeyAgreementSecretGenerationOperationInstance op |
@@ -959,10 +963,18 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
final override string getKeyCreationTypeDescription() { result = "KeyGeneration" }
/**
* Gets a consumer of a raw value that is used to generate the key.
* Not all key generation operations require a raw value.
* Gets the consumer of a key for this key generaiton operation.
* This occurs when a key generation operaiton is based on a raw key value
* or it generates another key or key context from a previously generated key.
*/
abstract ConsumerInputDataFlowNode getRawKeyValueConsumer();
abstract ConsumerInputDataFlowNode getKeyValueConsumer();
/**
* Holds if the key generation operation has a key consumer
* i.e., an input that is explicitly used for the key value.
* This value should correspond to the value returned by `getKeyValueConsumer()`.
*/
abstract predicate hasKeyValueConsumer();
}
abstract class KeyLoadOperationInstance extends KeyCreationOperationInstance {
@@ -1708,10 +1720,8 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
node instanceof KeyCreationCandidateAlgorithmNode
}
NodeBase getARawValueSource() {
result = keyGenInstance.getRawKeyValueConsumer().getConsumer().getAGenericSourceNode()
or
result = keyGenInstance.getRawKeyValueConsumer().getConsumer().getAKnownSourceNode()
KeyArtifactNode getKeyArtifact() {
result.asElement() = keyGenInstance.getKeyValueConsumer().getConsumer()
}
override NodeBase getChild(string key) {
@@ -1720,7 +1730,11 @@ module CryptographyBase<LocationSig Location, InputSig<Location> Input> {
// [ALWAYS_KNOWN]
key = "Output" and
result = this.getOutputKeyArtifact()
//TODO: how do I output the raw key if known? If not known, it may not require/have a raw value consumer, don't output
or
// [KnOWN_OR_UNKNOWN] only if a raw key is a known input
key = "KeyInput" and
keyGenInstance.hasKeyValueConsumer() and
result = this.getKeyArtifact()
}
}