mirror of
https://github.com/github/codeql.git
synced 2026-04-12 10:34:02 +02:00
275 lines
12 KiB
Plaintext
275 lines
12 KiB
Plaintext
import cpp
|
|
import semmle.code.cpp.dataflow.new.DataFlow
|
|
|
|
module OpenSSLModel {
|
|
import experimental.Quantum.Language
|
|
import experimental.Quantum.OpenSSL.AlgorithmInstances.Instances
|
|
import experimental.Quantum.OpenSSL.AlgorithmValueConsumers.AlgorithmValueConsumers
|
|
import experimental.Quantum.OpenSSL.Operations.Operations
|
|
// import experimental.Quantum.OpenSSL.EVPCipherOperation
|
|
// import experimental.Quantum.OpenSSL.EVPHashOperation
|
|
// import experimental.Quantum.OpenSSL.EVPCipherAlgorithmSource
|
|
// import experimental.Quantum.OpenSSL.EVPHashAlgorithmSource
|
|
// import experimental.Quantum.OpenSSL.Random
|
|
// // Imports the additional algorithm flow step for OpenSSL
|
|
// import experimental.Quantum.OpenSSL.OpenSSLAlgorithmGetter
|
|
// // TODO: trace CTX from init variants to the context arg of EVP update calls
|
|
// //https://docs.openssl.org/master/man3/EVP_EncryptInit/#synopsis
|
|
// abstract class EVP_Cipher_Init_Call extends Call {
|
|
// Expr getContextArg() { result = this.getArgument(0) }
|
|
// abstract Expr getKeyArg();
|
|
// abstract Expr getIVArg();
|
|
// abstract Crypto::CipherOperationSubtype getCipherOperationSubtype();
|
|
// }
|
|
// abstract class EVP_Cipher_EX_Init_Call extends EVP_Cipher_Init_Call {
|
|
// override Expr getKeyArg() { result = this.getArgument(3) }
|
|
// override Expr getIVArg() { result = this.getArgument(4) }
|
|
// }
|
|
// abstract class EVP_Cipher_EX2_Init_Call extends EVP_Cipher_Init_Call {
|
|
// override Expr getKeyArg() { result = this.getArgument(2) }
|
|
// override Expr getIVArg() { result = this.getArgument(3) }
|
|
// }
|
|
// abstract class EVP_Cipher_Operation_Call extends Crypto::CipherOperationInstance instanceof Call {
|
|
// Expr getContextArg() { result = this.(Call).getArgument(0) }
|
|
// abstract Expr getInputArg();
|
|
// Expr getOutputArg() { result = this.(Call).getArgument(1) }
|
|
// abstract Expr getInitCall();
|
|
// }
|
|
// abstract class EVP_Update_Call extends EVP_Cipher_Operation_Call {
|
|
// override Expr getInputArg() { result = this.(Call).getArgument(3) }
|
|
// }
|
|
// abstract class EVP_Final_Call extends EVP_Cipher_Operation_Call{
|
|
// override Expr getInputArg() { none() }
|
|
// }
|
|
// class EVP_Cipher_Call extends EVP_Cipher_Operation_Call{
|
|
// // TODO/QUESTION: what is the better way to do this?
|
|
// EVP_Cipher_Call() { this.(Call).getTarget().getName() = "EVP_Cipher" }
|
|
// override Expr getInputArg() { result = this.(Call).getArgument(2) }
|
|
// override Expr getOutputArg() { result = this.(Call).getArgument(1) }
|
|
// override Crypto::CipherOperationSubtype getCipherOperationSubtype(){
|
|
// result instanceof Crypto::EncryptionSubtype
|
|
// }
|
|
// override Expr getInitCall(){
|
|
// //TODO:
|
|
// none()
|
|
// }
|
|
// override Crypto::NonceArtifactConsumer getNonceConsumer(){
|
|
// none()
|
|
// }
|
|
// override Crypto::CipherInputConsumer getInputConsumer(){
|
|
// none()
|
|
// }
|
|
// override Crypto::CipherOutputArtifactInstance getOutputArtifact(){
|
|
// none()
|
|
// }
|
|
// override Crypto::AlgorithmConsumer getAlgorithmConsumer(){
|
|
// none()
|
|
// }
|
|
// }
|
|
//TODO: what about EVP_CIpher
|
|
// class EVP_EncryptUpdateCall extends Crypto::CipherOperationInstance instanceof Call {
|
|
// // NICK QUESTION: is there a better way to tie this to openssl?
|
|
// EVP_EncryptUpdateCall() { this.getTarget().getName() = "EVP_EncryptUpdate" }
|
|
// Expr getContextArg() { result = super.getArgument(0) }
|
|
// Expr getInputArg() { result = super.getArgument(3) }
|
|
// Expr getOutputArg() { result = super.getArgument(1) }
|
|
// override Crypto::CipherOperationSubtype getCipherOperationSubtype(){
|
|
// result instanceof Crypto::EncryptionSubtype
|
|
// }
|
|
// override Crypto::NonceArtifactConsumer getNonceConsumer(){
|
|
// none()
|
|
// }
|
|
// override Crypto::CipherInputConsumer getInputConsumer(){
|
|
// none()
|
|
// }
|
|
// override Crypto::CipherOutputArtifactInstance getOutputArtifact(){
|
|
// none()
|
|
// }
|
|
// override Crypto::AlgorithmConsumer getAlgorithmConsumer(){
|
|
// none()
|
|
// }
|
|
// }
|
|
//EVP_EncryptUpdate
|
|
// /**
|
|
// * Hash function references in OpenSSL.
|
|
// */
|
|
// predicate hash_ref_type_mapping_known(string name, Crypto::THashType algo) {
|
|
// // `ma` name has an LN_ or SN_ prefix, which we want to ignore
|
|
// // capture any name after the _ prefix using regex matching
|
|
// name = ["sha1", "sha160"] and algo instanceof Crypto::SHA1
|
|
// or
|
|
// name = ["sha224", "sha256", "sha384", "sha512"] and algo instanceof Crypto::SHA2
|
|
// or
|
|
// name = ["sha3-224", "sha3-256", "sha3-384", "sha3-512"] and algo instanceof Crypto::SHA3
|
|
// or
|
|
// name = "md2" and algo instanceof Crypto::MD2
|
|
// or
|
|
// name = "md4" and algo instanceof Crypto::MD4
|
|
// or
|
|
// name = "md5" and algo instanceof Crypto::MD5
|
|
// or
|
|
// name = "ripemd160" and algo instanceof Crypto::RIPEMD160
|
|
// or
|
|
// name = "whirlpool" and algo instanceof Crypto::WHIRLPOOL
|
|
// }
|
|
// predicate hash_ref_type_mapping(FunctionCallOrMacroAccess ref, string name, Crypto::THashType algo) {
|
|
// name = ref.getTargetName().regexpCapture("(?:SN_|LN_|EVP_)([a-z0-9]+)", 1) and
|
|
// hash_ref_type_mapping_known(name, algo)
|
|
// }
|
|
// class FunctionCallOrMacroAccess extends Element {
|
|
// FunctionCallOrMacroAccess() { this instanceof FunctionCall or this instanceof MacroAccess }
|
|
// string getTargetName() {
|
|
// result = this.(FunctionCall).getTarget().getName()
|
|
// or
|
|
// result = this.(MacroAccess).getMacroName()
|
|
// }
|
|
// }
|
|
// class HashAlgorithmCallOrMacro extends Crypto::HashAlgorithmInstance instanceof FunctionCallOrMacroAccess
|
|
// {
|
|
// HashAlgorithmCallOrMacro() { hash_ref_type_mapping(this, _, _) }
|
|
// string getTargetName() { result = this.(FunctionCallOrMacroAccess).getTargetName() }
|
|
// }
|
|
// class HashAlgorithm extends Crypto::HashAlgorithm {
|
|
// HashAlgorithmCallOrMacro instance;
|
|
// HashAlgorithm() { this = Crypto::THashAlgorithm(instance) }
|
|
// override string getSHA2OrSHA3DigestSize(Location location) {
|
|
// (
|
|
// this.getHashType() instanceof Crypto::SHA2 or
|
|
// this.getHashType() instanceof Crypto::SHA3
|
|
// ) and
|
|
// exists(string name |
|
|
// hash_ref_type_mapping(instance, name, this.getHashType()) and
|
|
// result = name.regexpFind("\\d{3}", 0, _) and
|
|
// location = instance.getLocation()
|
|
// )
|
|
// }
|
|
// override string getRawAlgorithmName() { result = instance.getTargetName() }
|
|
// override Crypto::THashType getHashType() { hash_ref_type_mapping(instance, _, result) }
|
|
// Element getInstance() { result = instance }
|
|
// override Location getLocation() { result = instance.getLocation() }
|
|
// }
|
|
// /**
|
|
// * Data-flow configuration for key derivation algorithm flow to EVP_KDF_derive.
|
|
// */
|
|
// module AlgorithmToEVPKeyDeriveConfig implements DataFlow::ConfigSig {
|
|
// predicate isSource(DataFlow::Node source) {
|
|
// source.asExpr() = any(KeyDerivationAlgorithm a).getInstance()
|
|
// }
|
|
// predicate isSink(DataFlow::Node sink) {
|
|
// exists(EVP_KDF_derive kdo |
|
|
// sink.asExpr() = kdo.getCall().getAlgorithmArg()
|
|
// or
|
|
// sink.asExpr() = kdo.getCall().getContextArg() // via `EVP_KDF_CTX_set_params`
|
|
// )
|
|
// }
|
|
// predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
|
|
// none() // TODO
|
|
// }
|
|
// }
|
|
// module AlgorithmToEVPKeyDeriveFlow = DataFlow::Global<AlgorithmToEVPKeyDeriveConfig>;
|
|
// predicate algorithm_to_EVP_KDF_derive(KeyDerivationAlgorithm algo, EVP_KDF_derive derive) {
|
|
// none()
|
|
// }
|
|
// /**
|
|
// * Key derivation operation (e.g., `EVP_KDF_derive`)
|
|
// */
|
|
// class EVP_KDF_derive_FunctionCall extends Crypto::KeyDerivationOperationInstance instanceof FunctionCall
|
|
// {
|
|
// EVP_KDF_derive_FunctionCall() { this.getTarget().getName() = "EVP_KDF_derive" }
|
|
// Expr getAlgorithmArg() { result = super.getArgument(3) }
|
|
// Expr getContextArg() { result = super.getArgument(0) }
|
|
// }
|
|
// class EVP_KDF_derive extends Crypto::KeyDerivationOperation {
|
|
// EVP_KDF_derive_FunctionCall instance;
|
|
// EVP_KDF_derive() { this = Crypto::TKeyDerivationOperation(instance) }
|
|
// override Crypto::Algorithm getAlgorithm() { algorithm_to_EVP_KDF_derive(result, this) }
|
|
// EVP_KDF_derive_FunctionCall getCall() { result = instance }
|
|
// }
|
|
// /**
|
|
// * Key derivation algorithm nodes
|
|
// */
|
|
// abstract class KeyDerivationAlgorithm extends Crypto::KeyDerivationAlgorithm {
|
|
// abstract Expr getInstance();
|
|
// }
|
|
// /**
|
|
// * `EVP_KDF_fetch` returns a key derivation algorithm.
|
|
// */
|
|
// class EVP_KDF_fetch_Call extends FunctionCall {
|
|
// EVP_KDF_fetch_Call() { this.getTarget().getName() = "EVP_KDF_fetch" }
|
|
// Expr getAlgorithmArg() { result = this.getArgument(1) }
|
|
// }
|
|
// class EVP_KDF_fetch_AlgorithmArg extends Crypto::KeyDerivationAlgorithmInstance instanceof Expr {
|
|
// EVP_KDF_fetch_AlgorithmArg() { exists(EVP_KDF_fetch_Call call | this = call.getAlgorithmArg()) }
|
|
// }
|
|
// predicate kdf_names(string algo) { algo = ["HKDF", "PKCS12KDF", "PBKDF2"] }
|
|
// class KDFAlgorithmStringLiteral extends StringLiteral {
|
|
// KDFAlgorithmStringLiteral() { kdf_names(this.getValue().toUpperCase()) }
|
|
// }
|
|
// private module AlgorithmStringToFetchConfig implements DataFlow::ConfigSig {
|
|
// predicate isSource(DataFlow::Node src) { src.asExpr() instanceof KDFAlgorithmStringLiteral }
|
|
// predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof EVP_KDF_fetch_AlgorithmArg }
|
|
// }
|
|
// module AlgorithmStringToFetchFlow = DataFlow::Global<AlgorithmStringToFetchConfig>;
|
|
// predicate algorithmStringToKDFFetchArgFlow(
|
|
// string name, KDFAlgorithmStringLiteral origin, EVP_KDF_fetch_AlgorithmArg arg
|
|
// ) {
|
|
// origin.getValue().toUpperCase() = name and
|
|
// AlgorithmStringToFetchFlow::flow(DataFlow::exprNode(origin), DataFlow::exprNode(arg))
|
|
// }
|
|
// /**
|
|
// * HKDF key derivation algorithm.
|
|
// */
|
|
// class HKDF extends KeyDerivationAlgorithm, Crypto::HKDF {
|
|
// KDFAlgorithmStringLiteral origin;
|
|
// EVP_KDF_fetch_AlgorithmArg instance;
|
|
// HKDF() {
|
|
// this = Crypto::TKeyDerivationAlgorithm(instance) and
|
|
// algorithmStringToKDFFetchArgFlow("HKDF", origin, instance)
|
|
// }
|
|
// override string getRawAlgorithmName() { result = origin.getValue() }
|
|
// override Crypto::HashAlgorithm getHashAlgorithm() { none() }
|
|
// override Crypto::LocatableElement getOrigin(string name) {
|
|
// result = origin and name = origin.toString()
|
|
// }
|
|
// override Expr getInstance() { result = origin }
|
|
// }
|
|
// /**
|
|
// * PBKDF2 key derivation algorithm.
|
|
// */
|
|
// class PBKDF2 extends KeyDerivationAlgorithm, Crypto::PBKDF2 {
|
|
// KDFAlgorithmStringLiteral origin;
|
|
// EVP_KDF_fetch_AlgorithmArg instance;
|
|
// PBKDF2() {
|
|
// this = Crypto::TKeyDerivationAlgorithm(instance) and
|
|
// algorithmStringToKDFFetchArgFlow("PBKDF2", origin, instance)
|
|
// }
|
|
// override string getRawAlgorithmName() { result = origin.getValue() }
|
|
// override string getIterationCount(Location location) { none() } // TODO
|
|
// override string getKeyLength(Location location) { none() } // TODO
|
|
// override Crypto::HashAlgorithm getHashAlgorithm() { none() } // TODO
|
|
// override Crypto::LocatableElement getOrigin(string name) {
|
|
// result = origin and name = origin.toString()
|
|
// }
|
|
// override Expr getInstance() { result = instance }
|
|
// }
|
|
// /**
|
|
// * PKCS12KDF key derivation algorithm.
|
|
// */
|
|
// class PKCS12KDF extends KeyDerivationAlgorithm, Crypto::PKCS12KDF {
|
|
// KDFAlgorithmStringLiteral origin;
|
|
// EVP_KDF_fetch_AlgorithmArg instance;
|
|
// PKCS12KDF() {
|
|
// this = Crypto::TKeyDerivationAlgorithm(instance) and
|
|
// algorithmStringToKDFFetchArgFlow("PKCS12KDF", origin, instance)
|
|
// }
|
|
// override string getRawAlgorithmName() { result = origin.getValue() }
|
|
// override string getIterationCount(Location location) { none() } // TODO
|
|
// override string getIDByte(Location location) { none() } // TODO
|
|
// override Crypto::HashAlgorithm getHashAlgorithm() { none() } // TODO
|
|
// override Crypto::LocatableElement getOrigin(string name) {
|
|
// result = origin and name = origin.toString()
|
|
// }
|
|
// override Expr getInstance() { result = instance }
|
|
// }
|
|
}
|