1 | /* |
2 | * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | /*- |
11 | From: Arne Ansper |
12 | |
13 | Why BIO_f_reliable? |
14 | |
15 | I wrote function which took BIO* as argument, read data from it |
16 | and processed it. Then I wanted to store the input file in |
17 | encrypted form. OK I pushed BIO_f_cipher to the BIO stack |
18 | and everything was OK. BUT if user types wrong password |
19 | BIO_f_cipher outputs only garbage and my function crashes. Yes |
20 | I can and I should fix my function, but BIO_f_cipher is |
21 | easy way to add encryption support to many existing applications |
22 | and it's hard to debug and fix them all. |
23 | |
24 | So I wanted another BIO which would catch the incorrect passwords and |
25 | file damages which cause garbage on BIO_f_cipher's output. |
26 | |
27 | The easy way is to push the BIO_f_md and save the checksum at |
28 | the end of the file. However there are several problems with this |
29 | approach: |
30 | |
31 | 1) you must somehow separate checksum from actual data. |
32 | 2) you need lot's of memory when reading the file, because you |
33 | must read to the end of the file and verify the checksum before |
34 | letting the application to read the data. |
35 | |
36 | BIO_f_reliable tries to solve both problems, so that you can |
37 | read and write arbitrary long streams using only fixed amount |
38 | of memory. |
39 | |
40 | BIO_f_reliable splits data stream into blocks. Each block is prefixed |
41 | with its length and suffixed with its digest. So you need only |
42 | several Kbytes of memory to buffer single block before verifying |
43 | its digest. |
44 | |
45 | BIO_f_reliable goes further and adds several important capabilities: |
46 | |
47 | 1) the digest of the block is computed over the whole stream |
48 | -- so nobody can rearrange the blocks or remove or replace them. |
49 | |
50 | 2) to detect invalid passwords right at the start BIO_f_reliable |
51 | adds special prefix to the stream. In order to avoid known plain-text |
52 | attacks this prefix is generated as follows: |
53 | |
54 | *) digest is initialized with random seed instead of |
55 | standardized one. |
56 | *) same seed is written to output |
57 | *) well-known text is then hashed and the output |
58 | of the digest is also written to output. |
59 | |
60 | reader can now read the seed from stream, hash the same string |
61 | and then compare the digest output. |
62 | |
63 | Bad things: BIO_f_reliable knows what's going on in EVP_Digest. I |
64 | initially wrote and tested this code on x86 machine and wrote the |
65 | digests out in machine-dependent order :( There are people using |
66 | this code and I cannot change this easily without making existing |
67 | data files unreadable. |
68 | |
69 | */ |
70 | |
71 | #include <stdio.h> |
72 | #include <errno.h> |
73 | #include <assert.h> |
74 | #include "internal/cryptlib.h" |
75 | #include <openssl/buffer.h> |
76 | #include "internal/bio.h" |
77 | #include <openssl/evp.h> |
78 | #include <openssl/rand.h> |
79 | #include "crypto/evp.h" |
80 | |
81 | static int ok_write(BIO *h, const char *buf, int num); |
82 | static int ok_read(BIO *h, char *buf, int size); |
83 | static long ok_ctrl(BIO *h, int cmd, long arg1, void *arg2); |
84 | static int ok_new(BIO *h); |
85 | static int ok_free(BIO *data); |
86 | static long ok_callback_ctrl(BIO *h, int cmd, BIO_info_cb *fp); |
87 | |
88 | static __owur int sig_out(BIO *b); |
89 | static __owur int sig_in(BIO *b); |
90 | static __owur int block_out(BIO *b); |
91 | static __owur int block_in(BIO *b); |
92 | #define OK_BLOCK_SIZE (1024*4) |
93 | #define OK_BLOCK_BLOCK 4 |
94 | #define IOBS (OK_BLOCK_SIZE+ OK_BLOCK_BLOCK+ 3*EVP_MAX_MD_SIZE) |
95 | #define WELLKNOWN "The quick brown fox jumped over the lazy dog's back." |
96 | |
97 | typedef struct ok_struct { |
98 | size_t buf_len; |
99 | size_t buf_off; |
100 | size_t buf_len_save; |
101 | size_t buf_off_save; |
102 | int cont; /* <= 0 when finished */ |
103 | int finished; |
104 | EVP_MD_CTX *md; |
105 | int blockout; /* output block is ready */ |
106 | int sigio; /* must process signature */ |
107 | unsigned char buf[IOBS]; |
108 | } BIO_OK_CTX; |
109 | |
110 | static const BIO_METHOD methods_ok = { |
111 | BIO_TYPE_CIPHER, |
112 | "reliable" , |
113 | /* TODO: Convert to new style write function */ |
114 | bwrite_conv, |
115 | ok_write, |
116 | /* TODO: Convert to new style read function */ |
117 | bread_conv, |
118 | ok_read, |
119 | NULL, /* ok_puts, */ |
120 | NULL, /* ok_gets, */ |
121 | ok_ctrl, |
122 | ok_new, |
123 | ok_free, |
124 | ok_callback_ctrl, |
125 | }; |
126 | |
127 | const BIO_METHOD *BIO_f_reliable(void) |
128 | { |
129 | return &methods_ok; |
130 | } |
131 | |
132 | static int ok_new(BIO *bi) |
133 | { |
134 | BIO_OK_CTX *ctx; |
135 | |
136 | if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) { |
137 | EVPerr(EVP_F_OK_NEW, ERR_R_MALLOC_FAILURE); |
138 | return 0; |
139 | } |
140 | |
141 | ctx->cont = 1; |
142 | ctx->sigio = 1; |
143 | ctx->md = EVP_MD_CTX_new(); |
144 | if (ctx->md == NULL) { |
145 | OPENSSL_free(ctx); |
146 | return 0; |
147 | } |
148 | BIO_set_init(bi, 0); |
149 | BIO_set_data(bi, ctx); |
150 | |
151 | return 1; |
152 | } |
153 | |
154 | static int ok_free(BIO *a) |
155 | { |
156 | BIO_OK_CTX *ctx; |
157 | |
158 | if (a == NULL) |
159 | return 0; |
160 | |
161 | ctx = BIO_get_data(a); |
162 | |
163 | EVP_MD_CTX_free(ctx->md); |
164 | OPENSSL_clear_free(ctx, sizeof(BIO_OK_CTX)); |
165 | BIO_set_data(a, NULL); |
166 | BIO_set_init(a, 0); |
167 | |
168 | return 1; |
169 | } |
170 | |
171 | static int ok_read(BIO *b, char *out, int outl) |
172 | { |
173 | int ret = 0, i, n; |
174 | BIO_OK_CTX *ctx; |
175 | BIO *next; |
176 | |
177 | if (out == NULL) |
178 | return 0; |
179 | |
180 | ctx = BIO_get_data(b); |
181 | next = BIO_next(b); |
182 | |
183 | if ((ctx == NULL) || (next == NULL) || (BIO_get_init(b) == 0)) |
184 | return 0; |
185 | |
186 | while (outl > 0) { |
187 | |
188 | /* copy clean bytes to output buffer */ |
189 | if (ctx->blockout) { |
190 | i = ctx->buf_len - ctx->buf_off; |
191 | if (i > outl) |
192 | i = outl; |
193 | memcpy(out, &(ctx->buf[ctx->buf_off]), i); |
194 | ret += i; |
195 | out += i; |
196 | outl -= i; |
197 | ctx->buf_off += i; |
198 | |
199 | /* all clean bytes are out */ |
200 | if (ctx->buf_len == ctx->buf_off) { |
201 | ctx->buf_off = 0; |
202 | |
203 | /* |
204 | * copy start of the next block into proper place |
205 | */ |
206 | if (ctx->buf_len_save - ctx->buf_off_save > 0) { |
207 | ctx->buf_len = ctx->buf_len_save - ctx->buf_off_save; |
208 | memmove(ctx->buf, &(ctx->buf[ctx->buf_off_save]), |
209 | ctx->buf_len); |
210 | } else { |
211 | ctx->buf_len = 0; |
212 | } |
213 | ctx->blockout = 0; |
214 | } |
215 | } |
216 | |
217 | /* output buffer full -- cancel */ |
218 | if (outl == 0) |
219 | break; |
220 | |
221 | /* no clean bytes in buffer -- fill it */ |
222 | n = IOBS - ctx->buf_len; |
223 | i = BIO_read(next, &(ctx->buf[ctx->buf_len]), n); |
224 | |
225 | if (i <= 0) |
226 | break; /* nothing new */ |
227 | |
228 | ctx->buf_len += i; |
229 | |
230 | /* no signature yet -- check if we got one */ |
231 | if (ctx->sigio == 1) { |
232 | if (!sig_in(b)) { |
233 | BIO_clear_retry_flags(b); |
234 | return 0; |
235 | } |
236 | } |
237 | |
238 | /* signature ok -- check if we got block */ |
239 | if (ctx->sigio == 0) { |
240 | if (!block_in(b)) { |
241 | BIO_clear_retry_flags(b); |
242 | return 0; |
243 | } |
244 | } |
245 | |
246 | /* invalid block -- cancel */ |
247 | if (ctx->cont <= 0) |
248 | break; |
249 | |
250 | } |
251 | |
252 | BIO_clear_retry_flags(b); |
253 | BIO_copy_next_retry(b); |
254 | return ret; |
255 | } |
256 | |
257 | static int ok_write(BIO *b, const char *in, int inl) |
258 | { |
259 | int ret = 0, n, i; |
260 | BIO_OK_CTX *ctx; |
261 | BIO *next; |
262 | |
263 | if (inl <= 0) |
264 | return inl; |
265 | |
266 | ctx = BIO_get_data(b); |
267 | next = BIO_next(b); |
268 | ret = inl; |
269 | |
270 | if ((ctx == NULL) || (next == NULL) || (BIO_get_init(b) == 0)) |
271 | return 0; |
272 | |
273 | if (ctx->sigio && !sig_out(b)) |
274 | return 0; |
275 | |
276 | do { |
277 | BIO_clear_retry_flags(b); |
278 | n = ctx->buf_len - ctx->buf_off; |
279 | while (ctx->blockout && n > 0) { |
280 | i = BIO_write(next, &(ctx->buf[ctx->buf_off]), n); |
281 | if (i <= 0) { |
282 | BIO_copy_next_retry(b); |
283 | if (!BIO_should_retry(b)) |
284 | ctx->cont = 0; |
285 | return i; |
286 | } |
287 | ctx->buf_off += i; |
288 | n -= i; |
289 | } |
290 | |
291 | /* at this point all pending data has been written */ |
292 | ctx->blockout = 0; |
293 | if (ctx->buf_len == ctx->buf_off) { |
294 | ctx->buf_len = OK_BLOCK_BLOCK; |
295 | ctx->buf_off = 0; |
296 | } |
297 | |
298 | if ((in == NULL) || (inl <= 0)) |
299 | return 0; |
300 | |
301 | n = (inl + ctx->buf_len > OK_BLOCK_SIZE + OK_BLOCK_BLOCK) ? |
302 | (int)(OK_BLOCK_SIZE + OK_BLOCK_BLOCK - ctx->buf_len) : inl; |
303 | |
304 | memcpy(&ctx->buf[ctx->buf_len], in, n); |
305 | ctx->buf_len += n; |
306 | inl -= n; |
307 | in += n; |
308 | |
309 | if (ctx->buf_len >= OK_BLOCK_SIZE + OK_BLOCK_BLOCK) { |
310 | if (!block_out(b)) { |
311 | BIO_clear_retry_flags(b); |
312 | return 0; |
313 | } |
314 | } |
315 | } while (inl > 0); |
316 | |
317 | BIO_clear_retry_flags(b); |
318 | BIO_copy_next_retry(b); |
319 | return ret; |
320 | } |
321 | |
322 | static long ok_ctrl(BIO *b, int cmd, long num, void *ptr) |
323 | { |
324 | BIO_OK_CTX *ctx; |
325 | EVP_MD *md; |
326 | const EVP_MD **ppmd; |
327 | long ret = 1; |
328 | int i; |
329 | BIO *next; |
330 | |
331 | ctx = BIO_get_data(b); |
332 | next = BIO_next(b); |
333 | |
334 | switch (cmd) { |
335 | case BIO_CTRL_RESET: |
336 | ctx->buf_len = 0; |
337 | ctx->buf_off = 0; |
338 | ctx->buf_len_save = 0; |
339 | ctx->buf_off_save = 0; |
340 | ctx->cont = 1; |
341 | ctx->finished = 0; |
342 | ctx->blockout = 0; |
343 | ctx->sigio = 1; |
344 | ret = BIO_ctrl(next, cmd, num, ptr); |
345 | break; |
346 | case BIO_CTRL_EOF: /* More to read */ |
347 | if (ctx->cont <= 0) |
348 | ret = 1; |
349 | else |
350 | ret = BIO_ctrl(next, cmd, num, ptr); |
351 | break; |
352 | case BIO_CTRL_PENDING: /* More to read in buffer */ |
353 | case BIO_CTRL_WPENDING: /* More to read in buffer */ |
354 | ret = ctx->blockout ? ctx->buf_len - ctx->buf_off : 0; |
355 | if (ret <= 0) |
356 | ret = BIO_ctrl(next, cmd, num, ptr); |
357 | break; |
358 | case BIO_CTRL_FLUSH: |
359 | /* do a final write */ |
360 | if (ctx->blockout == 0) |
361 | if (!block_out(b)) |
362 | return 0; |
363 | |
364 | while (ctx->blockout) { |
365 | i = ok_write(b, NULL, 0); |
366 | if (i < 0) { |
367 | ret = i; |
368 | break; |
369 | } |
370 | } |
371 | |
372 | ctx->finished = 1; |
373 | ctx->buf_off = ctx->buf_len = 0; |
374 | ctx->cont = (int)ret; |
375 | |
376 | /* Finally flush the underlying BIO */ |
377 | ret = BIO_ctrl(next, cmd, num, ptr); |
378 | break; |
379 | case BIO_C_DO_STATE_MACHINE: |
380 | BIO_clear_retry_flags(b); |
381 | ret = BIO_ctrl(next, cmd, num, ptr); |
382 | BIO_copy_next_retry(b); |
383 | break; |
384 | case BIO_CTRL_INFO: |
385 | ret = (long)ctx->cont; |
386 | break; |
387 | case BIO_C_SET_MD: |
388 | md = ptr; |
389 | if (!EVP_DigestInit_ex(ctx->md, md, NULL)) |
390 | return 0; |
391 | BIO_set_init(b, 1); |
392 | break; |
393 | case BIO_C_GET_MD: |
394 | if (BIO_get_init(b)) { |
395 | ppmd = ptr; |
396 | *ppmd = EVP_MD_CTX_md(ctx->md); |
397 | } else |
398 | ret = 0; |
399 | break; |
400 | default: |
401 | ret = BIO_ctrl(next, cmd, num, ptr); |
402 | break; |
403 | } |
404 | return ret; |
405 | } |
406 | |
407 | static long ok_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp) |
408 | { |
409 | long ret = 1; |
410 | BIO *next; |
411 | |
412 | next = BIO_next(b); |
413 | |
414 | if (next == NULL) |
415 | return 0; |
416 | |
417 | switch (cmd) { |
418 | default: |
419 | ret = BIO_callback_ctrl(next, cmd, fp); |
420 | break; |
421 | } |
422 | |
423 | return ret; |
424 | } |
425 | |
426 | static void longswap(void *_ptr, size_t len) |
427 | { |
428 | const union { |
429 | long one; |
430 | char little; |
431 | } is_endian = { |
432 | 1 |
433 | }; |
434 | |
435 | if (is_endian.little) { |
436 | size_t i; |
437 | unsigned char *p = _ptr, c; |
438 | |
439 | for (i = 0; i < len; i += 4) { |
440 | c = p[0], p[0] = p[3], p[3] = c; |
441 | c = p[1], p[1] = p[2], p[2] = c; |
442 | } |
443 | } |
444 | } |
445 | |
446 | static int sig_out(BIO *b) |
447 | { |
448 | BIO_OK_CTX *ctx; |
449 | EVP_MD_CTX *md; |
450 | const EVP_MD *digest; |
451 | int md_size; |
452 | void *md_data; |
453 | |
454 | ctx = BIO_get_data(b); |
455 | md = ctx->md; |
456 | digest = EVP_MD_CTX_md(md); |
457 | md_size = EVP_MD_size(digest); |
458 | md_data = EVP_MD_CTX_md_data(md); |
459 | |
460 | if (ctx->buf_len + 2 * md_size > OK_BLOCK_SIZE) |
461 | return 1; |
462 | |
463 | if (!EVP_DigestInit_ex(md, digest, NULL)) |
464 | goto berr; |
465 | /* |
466 | * FIXME: there's absolutely no guarantee this makes any sense at all, |
467 | * particularly now EVP_MD_CTX has been restructured. |
468 | */ |
469 | if (RAND_bytes(md_data, md_size) <= 0) |
470 | goto berr; |
471 | memcpy(&(ctx->buf[ctx->buf_len]), md_data, md_size); |
472 | longswap(&(ctx->buf[ctx->buf_len]), md_size); |
473 | ctx->buf_len += md_size; |
474 | |
475 | if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN))) |
476 | goto berr; |
477 | if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL)) |
478 | goto berr; |
479 | ctx->buf_len += md_size; |
480 | ctx->blockout = 1; |
481 | ctx->sigio = 0; |
482 | return 1; |
483 | berr: |
484 | BIO_clear_retry_flags(b); |
485 | return 0; |
486 | } |
487 | |
488 | static int sig_in(BIO *b) |
489 | { |
490 | BIO_OK_CTX *ctx; |
491 | EVP_MD_CTX *md; |
492 | unsigned char tmp[EVP_MAX_MD_SIZE]; |
493 | int ret = 0; |
494 | const EVP_MD *digest; |
495 | int md_size; |
496 | void *md_data; |
497 | |
498 | ctx = BIO_get_data(b); |
499 | md = ctx->md; |
500 | digest = EVP_MD_CTX_md(md); |
501 | md_size = EVP_MD_size(digest); |
502 | md_data = EVP_MD_CTX_md_data(md); |
503 | |
504 | if ((int)(ctx->buf_len - ctx->buf_off) < 2 * md_size) |
505 | return 1; |
506 | |
507 | if (!EVP_DigestInit_ex(md, digest, NULL)) |
508 | goto berr; |
509 | memcpy(md_data, &(ctx->buf[ctx->buf_off]), md_size); |
510 | longswap(md_data, md_size); |
511 | ctx->buf_off += md_size; |
512 | |
513 | if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN))) |
514 | goto berr; |
515 | if (!EVP_DigestFinal_ex(md, tmp, NULL)) |
516 | goto berr; |
517 | ret = memcmp(&(ctx->buf[ctx->buf_off]), tmp, md_size) == 0; |
518 | ctx->buf_off += md_size; |
519 | if (ret == 1) { |
520 | ctx->sigio = 0; |
521 | if (ctx->buf_len != ctx->buf_off) { |
522 | memmove(ctx->buf, &(ctx->buf[ctx->buf_off]), |
523 | ctx->buf_len - ctx->buf_off); |
524 | } |
525 | ctx->buf_len -= ctx->buf_off; |
526 | ctx->buf_off = 0; |
527 | } else { |
528 | ctx->cont = 0; |
529 | } |
530 | return 1; |
531 | berr: |
532 | BIO_clear_retry_flags(b); |
533 | return 0; |
534 | } |
535 | |
536 | static int block_out(BIO *b) |
537 | { |
538 | BIO_OK_CTX *ctx; |
539 | EVP_MD_CTX *md; |
540 | unsigned long tl; |
541 | const EVP_MD *digest; |
542 | int md_size; |
543 | |
544 | ctx = BIO_get_data(b); |
545 | md = ctx->md; |
546 | digest = EVP_MD_CTX_md(md); |
547 | md_size = EVP_MD_size(digest); |
548 | |
549 | tl = ctx->buf_len - OK_BLOCK_BLOCK; |
550 | ctx->buf[0] = (unsigned char)(tl >> 24); |
551 | ctx->buf[1] = (unsigned char)(tl >> 16); |
552 | ctx->buf[2] = (unsigned char)(tl >> 8); |
553 | ctx->buf[3] = (unsigned char)(tl); |
554 | if (!EVP_DigestUpdate(md, |
555 | (unsigned char *)&(ctx->buf[OK_BLOCK_BLOCK]), tl)) |
556 | goto berr; |
557 | if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL)) |
558 | goto berr; |
559 | ctx->buf_len += md_size; |
560 | ctx->blockout = 1; |
561 | return 1; |
562 | berr: |
563 | BIO_clear_retry_flags(b); |
564 | return 0; |
565 | } |
566 | |
567 | static int block_in(BIO *b) |
568 | { |
569 | BIO_OK_CTX *ctx; |
570 | EVP_MD_CTX *md; |
571 | unsigned long tl = 0; |
572 | unsigned char tmp[EVP_MAX_MD_SIZE]; |
573 | int md_size; |
574 | |
575 | ctx = BIO_get_data(b); |
576 | md = ctx->md; |
577 | md_size = EVP_MD_size(EVP_MD_CTX_md(md)); |
578 | |
579 | assert(sizeof(tl) >= OK_BLOCK_BLOCK); /* always true */ |
580 | tl = ctx->buf[0]; |
581 | tl <<= 8; |
582 | tl |= ctx->buf[1]; |
583 | tl <<= 8; |
584 | tl |= ctx->buf[2]; |
585 | tl <<= 8; |
586 | tl |= ctx->buf[3]; |
587 | |
588 | if (ctx->buf_len < tl + OK_BLOCK_BLOCK + md_size) |
589 | return 1; |
590 | |
591 | if (!EVP_DigestUpdate(md, |
592 | (unsigned char *)&(ctx->buf[OK_BLOCK_BLOCK]), tl)) |
593 | goto berr; |
594 | if (!EVP_DigestFinal_ex(md, tmp, NULL)) |
595 | goto berr; |
596 | if (memcmp(&(ctx->buf[tl + OK_BLOCK_BLOCK]), tmp, md_size) == 0) { |
597 | /* there might be parts from next block lurking around ! */ |
598 | ctx->buf_off_save = tl + OK_BLOCK_BLOCK + md_size; |
599 | ctx->buf_len_save = ctx->buf_len; |
600 | ctx->buf_off = OK_BLOCK_BLOCK; |
601 | ctx->buf_len = tl + OK_BLOCK_BLOCK; |
602 | ctx->blockout = 1; |
603 | } else { |
604 | ctx->cont = 0; |
605 | } |
606 | return 1; |
607 | berr: |
608 | BIO_clear_retry_flags(b); |
609 | return 0; |
610 | } |
611 | |