[thirdparty/openssl.git] / crypto / evp / bio_ok.c

/* crypto/evp/bio_ok.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

/*
	From: Arne Ansper <arne@cyber.ee>

	Why BIO_f_reliable?

	I wrote function which took BIO* as argument, read data from it
	and processed it. Then I wanted to store the input file in 
	encrypted form. OK I pushed BIO_f_cipher to the BIO stack
	and everything was OK. BUT if user types wrong password 
	BIO_f_cipher outputs only garbage and my function crashes. Yes
	I can and I should fix my function, but BIO_f_cipher is 
	easy way to add encryption support to many existing applications
	and it's hard to debug and fix them all. 

	So I wanted another BIO which would catch the incorrect passwords and
	file damages which cause garbage on BIO_f_cipher's output. 

	The easy way is to push the BIO_f_md and save the checksum at 
	the end of the file. However there are several problems with this
	approach:

	1) you must somehow separate checksum from actual data. 
	2) you need lot's of memory when reading the file, because you 
	must read to the end of the file and verify the checksum before
	letting the application to read the data. 
	
	BIO_f_reliable tries to solve both problems, so that you can 
	read and write arbitrary long streams using only fixed amount
	of memory.

	BIO_f_reliable splits data stream into blocks. Each block is prefixed
	with it's length and suffixed with it's digest. So you need only 
	several Kbytes of memory to buffer single block before verifying 
	it's digest. 

	BIO_f_reliable goes further and adds several important capabilities:

	1) the digest of the block is computed over the whole stream 
	-- so nobody can rearrange the blocks or remove or replace them.

	2) to detect invalid passwords right at the start BIO_f_reliable 
	adds special prefix to the stream. In order to avoid known plain-text
	attacks this prefix is generated as follows:

		*) digest is initialized with random seed instead of 
		standardized one.
		*) same seed is written to output
		*) well-known text is then hashed and the output 
		of the digest is also written to output.

	reader can now read the seed from stream, hash the same string
	and then compare the digest output.

	Bad things: BIO_f_reliable knows what's going on in EVP_Digest. I 
	initially wrote and tested this code on x86 machine and wrote the
	digests out in machine-dependent order :( There are people using
	this code and I cannot change this easily without making existing
	data files unreadable.

*/

#include <stdio.h>
#include <errno.h>
#include <assert.h>
#include "cryptlib.h"
#include <openssl/buffer.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/rand.h>

static int ok_write(BIO *h, const char *buf, int num);
static int ok_read(BIO *h, char *buf, int size);
static long ok_ctrl(BIO *h, int cmd, long arg1, void *arg2);
static int ok_new(BIO *h);
static int ok_free(BIO *data);
static long ok_callback_ctrl(BIO *h, int cmd, bio_info_cb *fp);

static __owur int sig_out(BIO* b);
static __owur int sig_in(BIO* b);
static __owur int block_out(BIO* b);
static __owur int block_in(BIO* b);
#define OK_BLOCK_SIZE	(1024*4)
#define OK_BLOCK_BLOCK	4
#define IOBS		(OK_BLOCK_SIZE+ OK_BLOCK_BLOCK+ 3*EVP_MAX_MD_SIZE)
#define WELLKNOWN "The quick brown fox jumped over the lazy dog's back."

typedef struct ok_struct
	{
	size_t buf_len;
	size_t buf_off;
	size_t buf_len_save;
	size_t buf_off_save;
	int cont;		/* <= 0 when finished */
	int finished;
	EVP_MD_CTX md;
	int blockout;		/* output block is ready */ 
	int sigio;		/* must process signature */
	unsigned char buf[IOBS];
	} BIO_OK_CTX;

static BIO_METHOD methods_ok=
	{
	BIO_TYPE_CIPHER,"reliable",
	ok_write,
	ok_read,
	NULL, /* ok_puts, */
	NULL, /* ok_gets, */
	ok_ctrl,
	ok_new,
	ok_free,
	ok_callback_ctrl,
	};

BIO_METHOD *BIO_f_reliable(void)
	{
	return(&methods_ok);
	}

static int ok_new(BIO *bi)
	{
	BIO_OK_CTX *ctx;

	ctx=(BIO_OK_CTX *)OPENSSL_malloc(sizeof(BIO_OK_CTX));
	if (ctx == NULL) return(0);

	ctx->buf_len=0;
	ctx->buf_off=0;
	ctx->buf_len_save=0;
	ctx->buf_off_save=0;
	ctx->cont=1;
	ctx->finished=0;
	ctx->blockout= 0;
	ctx->sigio=1;

	EVP_MD_CTX_init(&ctx->md);

	bi->init=0;
	bi->ptr=(char *)ctx;
	bi->flags=0;
	return(1);
	}

static int ok_free(BIO *a)
	{
	if (a == NULL) return(0);
	EVP_MD_CTX_cleanup(&((BIO_OK_CTX *)a->ptr)->md);
	OPENSSL_cleanse(a->ptr,sizeof(BIO_OK_CTX));
	OPENSSL_free(a->ptr);
	a->ptr=NULL;
	a->init=0;
	a->flags=0;
	return(1);
	}
	
static int ok_read(BIO *b, char *out, int outl)
	{
	int ret=0,i,n;
	BIO_OK_CTX *ctx;

	if (out == NULL) return(0);
	ctx=(BIO_OK_CTX *)b->ptr;

	if ((ctx == NULL) || (b->next_bio == NULL) || (b->init == 0)) return(0);

	while(outl > 0)
		{

		/* copy clean bytes to output buffer */
		if (ctx->blockout)
			{
			i=ctx->buf_len-ctx->buf_off;
			if (i > outl) i=outl;
			memcpy(out,&(ctx->buf[ctx->buf_off]),i);
			ret+=i;
			out+=i;
			outl-=i;
			ctx->buf_off+=i;

			/* all clean bytes are out */
			if (ctx->buf_len == ctx->buf_off)
				{
				ctx->buf_off=0;

				/* copy start of the next block into proper place */
				if(ctx->buf_len_save- ctx->buf_off_save > 0)
					{
					ctx->buf_len= ctx->buf_len_save- ctx->buf_off_save;
					memmove(ctx->buf, &(ctx->buf[ctx->buf_off_save]),
							ctx->buf_len);
					}
				else
					{
					ctx->buf_len=0;
					}
				ctx->blockout= 0;
				}
			}
	
		/* output buffer full -- cancel */
		if (outl == 0) break;

		/* no clean bytes in buffer -- fill it */
		n=IOBS- ctx->buf_len;
		i=BIO_read(b->next_bio,&(ctx->buf[ctx->buf_len]),n);

		if (i <= 0) break;	/* nothing new */

		ctx->buf_len+= i;

		/* no signature yet -- check if we got one */
		if (ctx->sigio == 1)
			{
			if (!sig_in(b))
				{
				BIO_clear_retry_flags(b);
				return 0;
				}
			}

		/* signature ok -- check if we got block */
		if (ctx->sigio == 0)
			{
			if (!block_in(b))
				{
				BIO_clear_retry_flags(b);
				return 0;
				}
			}

		/* invalid block -- cancel */
		if (ctx->cont <= 0) break;

		}

	BIO_clear_retry_flags(b);
	BIO_copy_next_retry(b);
	return(ret);
	}

static int ok_write(BIO *b, const char *in, int inl)
	{
	int ret=0,n,i;
	BIO_OK_CTX *ctx;

	if (inl <= 0) return inl;

	ctx=(BIO_OK_CTX *)b->ptr;
	ret=inl;

	if ((ctx == NULL) || (b->next_bio == NULL) || (b->init == 0)) return(0);

	if(ctx->sigio && !sig_out(b))
		return 0;

	do{
		BIO_clear_retry_flags(b);
		n=ctx->buf_len-ctx->buf_off;
		while (ctx->blockout && n > 0)
			{
			i=BIO_write(b->next_bio,&(ctx->buf[ctx->buf_off]),n);
			if (i <= 0)
				{
				BIO_copy_next_retry(b);
				if(!BIO_should_retry(b))
					ctx->cont= 0;
				return(i);
				}
			ctx->buf_off+=i;
			n-=i;
			}

		/* at this point all pending data has been written */
		ctx->blockout= 0;
		if (ctx->buf_len == ctx->buf_off)
			{
			ctx->buf_len=OK_BLOCK_BLOCK;
			ctx->buf_off=0;
			}
	
		if ((in == NULL) || (inl <= 0)) return(0);

		n= (inl+ ctx->buf_len > OK_BLOCK_SIZE+ OK_BLOCK_BLOCK) ? 
			(int)(OK_BLOCK_SIZE+OK_BLOCK_BLOCK-ctx->buf_len) : inl;

		memcpy((unsigned char *)(&(ctx->buf[ctx->buf_len])),(unsigned char *)in,n);
		ctx->buf_len+= n;
		inl-=n;
		in+=n;

		if(ctx->buf_len >= OK_BLOCK_SIZE+ OK_BLOCK_BLOCK)
			{
			if (!block_out(b))
				{
				BIO_clear_retry_flags(b);
				return 0;
				}
			}
	}while(inl > 0);

	BIO_clear_retry_flags(b);
	BIO_copy_next_retry(b);
	return(ret);
	}

static long ok_ctrl(BIO *b, int cmd, long num, void *ptr)
	{
	BIO_OK_CTX *ctx;
	EVP_MD *md;
	const EVP_MD **ppmd;
	long ret=1;
	int i;

	ctx=b->ptr;

	switch (cmd)
		{
	case BIO_CTRL_RESET:
		ctx->buf_len=0;
		ctx->buf_off=0;
		ctx->buf_len_save=0;
		ctx->buf_off_save=0;
		ctx->cont=1;
		ctx->finished=0;
		ctx->blockout= 0;
		ctx->sigio=1;
		ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		break;
	case BIO_CTRL_EOF:	/* More to read */
		if (ctx->cont <= 0)
			ret=1;
		else
			ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		break;
	case BIO_CTRL_PENDING: /* More to read in buffer */
	case BIO_CTRL_WPENDING: /* More to read in buffer */
		ret=ctx->blockout ? ctx->buf_len-ctx->buf_off : 0;
		if (ret <= 0)
			ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		break;
	case BIO_CTRL_FLUSH:
		/* do a final write */
		if(ctx->blockout == 0)
			if (!block_out(b))
				return 0;

		while (ctx->blockout)
			{
			i=ok_write(b,NULL,0);
			if (i < 0)
				{
				ret=i;
				break;
				}
			}

		ctx->finished=1;
		ctx->buf_off=ctx->buf_len=0;
		ctx->cont=(int)ret;
		
		/* Finally flush the underlying BIO */
		ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		break;
	case BIO_C_DO_STATE_MACHINE:
		BIO_clear_retry_flags(b);
		ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		BIO_copy_next_retry(b);
		break;
	case BIO_CTRL_INFO:
		ret=(long)ctx->cont;
		break;
	case BIO_C_SET_MD:
		md=ptr;
		if (!EVP_DigestInit_ex(&ctx->md, md, NULL))
			return 0;
		b->init=1;
		break;
	case BIO_C_GET_MD:
		if (b->init)
			{
			ppmd=ptr;
			*ppmd=ctx->md.digest;
			}
		else
			ret=0;
		break;
	default:
		ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		break;
		}
	return(ret);
	}

static long ok_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp)
	{
	long ret=1;

	if (b->next_bio == NULL) return(0);
	switch (cmd)
		{
	default:
		ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
		break;
		}
	return(ret);
	}

static void longswap(void *_ptr, size_t len)
{	const union { long one; char little; } is_endian = {1};

	if (is_endian.little) {
		size_t i;
		unsigned char *p=_ptr,c;

		for(i= 0;i < len;i+= 4) {
			c=p[0],p[0]=p[3],p[3]=c;
			c=p[1],p[1]=p[2],p[2]=c;
		}
	}
}

static int sig_out(BIO* b)
	{
	BIO_OK_CTX *ctx;
	EVP_MD_CTX *md;

	ctx=b->ptr;
	md=&ctx->md;

	if(ctx->buf_len+ 2* md->digest->md_size > OK_BLOCK_SIZE) return 1;

	if (!EVP_DigestInit_ex(md, md->digest, NULL))
		goto berr;
	/* FIXME: there's absolutely no guarantee this makes any sense at all,
	 * particularly now EVP_MD_CTX has been restructured.
	 */
	RAND_pseudo_bytes(md->md_data, md->digest->md_size);
	memcpy(&(ctx->buf[ctx->buf_len]), md->md_data, md->digest->md_size);
	longswap(&(ctx->buf[ctx->buf_len]), md->digest->md_size);
	ctx->buf_len+= md->digest->md_size;

	if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN)))
		goto berr;
	if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL))
		goto berr;
	ctx->buf_len+= md->digest->md_size;
	ctx->blockout= 1;
	ctx->sigio= 0;
	return 1;
	berr:
	BIO_clear_retry_flags(b);
	return 0;
	}

static int sig_in(BIO* b)
	{
	BIO_OK_CTX *ctx;
	EVP_MD_CTX *md;
	unsigned char tmp[EVP_MAX_MD_SIZE];
	int ret= 0;

	ctx=b->ptr;
	md=&ctx->md;

	if((int)(ctx->buf_len-ctx->buf_off) < 2*md->digest->md_size) return 1;

	if (!EVP_DigestInit_ex(md, md->digest, NULL))
		goto berr;
	memcpy(md->md_data, &(ctx->buf[ctx->buf_off]), md->digest->md_size);
	longswap(md->md_data, md->digest->md_size);
	ctx->buf_off+= md->digest->md_size;

	if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN)))
		goto berr;
	if (!EVP_DigestFinal_ex(md, tmp, NULL))
		goto berr;
	ret= memcmp(&(ctx->buf[ctx->buf_off]), tmp, md->digest->md_size) == 0;
	ctx->buf_off+= md->digest->md_size;
	if(ret == 1)
		{
		ctx->sigio= 0;
		if(ctx->buf_len != ctx->buf_off)
			{
			memmove(ctx->buf, &(ctx->buf[ctx->buf_off]), ctx->buf_len- ctx->buf_off);
			}
		ctx->buf_len-= ctx->buf_off;
		ctx->buf_off= 0;
		}
	else
		{
		ctx->cont= 0;
		}
	return 1;
	berr:
	BIO_clear_retry_flags(b);
	return 0;
	}

static int block_out(BIO* b)
	{
	BIO_OK_CTX *ctx;
	EVP_MD_CTX *md;
	unsigned long tl;

	ctx=b->ptr;
	md=&ctx->md;

	tl= ctx->buf_len- OK_BLOCK_BLOCK;
	ctx->buf[0]=(unsigned char)(tl>>24);
	ctx->buf[1]=(unsigned char)(tl>>16);
	ctx->buf[2]=(unsigned char)(tl>>8);
	ctx->buf[3]=(unsigned char)(tl);
	if (!EVP_DigestUpdate(md,
		(unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl))
		goto berr;
	if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL))
		goto berr;
	ctx->buf_len+= md->digest->md_size;
	ctx->blockout= 1;
	return 1;
	berr:
	BIO_clear_retry_flags(b);
	return 0;
	}

static int block_in(BIO* b)
	{
	BIO_OK_CTX *ctx;
	EVP_MD_CTX *md;
	unsigned long tl= 0;
	unsigned char tmp[EVP_MAX_MD_SIZE];

	ctx=b->ptr;
	md=&ctx->md;

	assert(sizeof(tl)>=OK_BLOCK_BLOCK);	/* always true */
	tl =ctx->buf[0]; tl<<=8;
	tl|=ctx->buf[1]; tl<<=8;
	tl|=ctx->buf[2]; tl<<=8;
	tl|=ctx->buf[3];

	if (ctx->buf_len < tl+ OK_BLOCK_BLOCK+ md->digest->md_size) return 1;
 
	if (!EVP_DigestUpdate(md,
			(unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl))
		goto berr;
	if (!EVP_DigestFinal_ex(md, tmp, NULL))
		goto berr;
	if(memcmp(&(ctx->buf[tl+ OK_BLOCK_BLOCK]), tmp, md->digest->md_size) == 0)
		{
		/* there might be parts from next block lurking around ! */
		ctx->buf_off_save= tl+ OK_BLOCK_BLOCK+ md->digest->md_size;
		ctx->buf_len_save= ctx->buf_len;
		ctx->buf_off= OK_BLOCK_BLOCK;
		ctx->buf_len= tl+ OK_BLOCK_BLOCK;
		ctx->blockout= 1;
		}
	else
		{
		ctx->cont= 0;
		}
	return 1;
	berr:
	BIO_clear_retry_flags(b);
	return 0;
	}
Commit	Line	Data
1745a3fb BL	1	/* crypto/evp/bio_ok.c */
	2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
	3	* All rights reserved.
	4	*
	5	* This package is an SSL implementation written
	6	* by Eric Young (eay@cryptsoft.com).
	7	* The implementation was written so as to conform with Netscapes SSL.
	8	*
	9	* This library is free for commercial and non-commercial use as long as
	10	* the following conditions are aheared to. The following conditions
	11	* apply to all code found in this distribution, be it the RC4, RSA,
	12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
	13	* included with this distribution is covered by the same copyright terms
	14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
	15	*
	16	* Copyright remains Eric Young's, and as such any Copyright notices in
	17	* the code are not to be removed.
	18	* If this package is used in a product, Eric Young should be given attribution
	19	* as the author of the parts of the library used.
	20	* This can be in the form of a textual message at program startup or
	21	* in documentation (online or textual) provided with the package.
	22	*
	23	* Redistribution and use in source and binary forms, with or without
	24	* modification, are permitted provided that the following conditions
	25	* are met:
	26	* 1. Redistributions of source code must retain the copyright
	27	* notice, this list of conditions and the following disclaimer.
	28	* 2. Redistributions in binary form must reproduce the above copyright
	29	* notice, this list of conditions and the following disclaimer in the
	30	* documentation and/or other materials provided with the distribution.
	31	* 3. All advertising materials mentioning features or use of this software
	32	* must display the following acknowledgement:
	33	* "This product includes cryptographic software written by
	34	* Eric Young (eay@cryptsoft.com)"
	35	* The word 'cryptographic' can be left out if the rouines from the library
	36	* being used are not cryptographic related :-).
	37	* 4. If you include any Windows specific code (or a derivative thereof) from
	38	* the apps directory (application code) you must include an acknowledgement:
	39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
	40	*
	41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
	42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	51	* SUCH DAMAGE.
	52	*
	53	* The licence and distribution terms for any publically available version or
	54	* derivative of this code cannot be changed. i.e. this code cannot simply be
	55	* copied and put under another distribution licence
	56	* [including the GNU Public Licence.]
	57	*/
	58
	59	/*
	60	From: Arne Ansper <arne@cyber.ee>
	61
	62	Why BIO_f_reliable?
	63
	64	I wrote function which took BIO* as argument, read data from it
65	and processed it. Then I wanted to store the input file in
66	encrypted form. OK I pushed BIO_f_cipher to the BIO stack
67	and everything was OK. BUT if user types wrong password
68	BIO_f_cipher outputs only garbage and my function crashes. Yes
69	I can and I should fix my function, but BIO_f_cipher is
657e60fa	70	easy way to add encryption support to many existing applications
1745a3fb BL	71	and it's hard to debug and fix them all.
	72
	73	So I wanted another BIO which would catch the incorrect passwords and
	74	file damages which cause garbage on BIO_f_cipher's output.
	75
	76	The easy way is to push the BIO_f_md and save the checksum at
	77	the end of the file. However there are several problems with this
	78	approach:
	79
	80	1) you must somehow separate checksum from actual data.
	81	2) you need lot's of memory when reading the file, because you
	82	must read to the end of the file and verify the checksum before
657e60fa	83	letting the application to read the data.
1745a3fb BL	84
1745a3fb BL	85	BIO_f_reliable tries to solve both problems, so that you can
657e60fa	86	read and write arbitrary long streams using only fixed amount
1745a3fb BL	87	of memory.
	88
	89	BIO_f_reliable splits data stream into blocks. Each block is prefixed
	90	with it's length and suffixed with it's digest. So you need only
	91	several Kbytes of memory to buffer single block before verifying
	92	it's digest.
	93
657e60fa	94	BIO_f_reliable goes further and adds several important capabilities:
1745a3fb BL	95
	96	1) the digest of the block is computed over the whole stream
	97	-- so nobody can rearrange the blocks or remove or replace them.
	98
	99	2) to detect invalid passwords right at the start BIO_f_reliable
	100	adds special prefix to the stream. In order to avoid known plain-text
	101	attacks this prefix is generated as follows:
	102
	103	*) digest is initialized with random seed instead of
	104	standardized one.
11234103	105	*) same seed is written to output
1745a3fb BL	106	*) well-known text is then hashed and the output
	107	of the digest is also written to output.
	108
	109	reader can now read the seed from stream, hash the same string
	110	and then compare the digest output.
	111
	112	Bad things: BIO_f_reliable knows what's going on in EVP_Digest. I
657e60fa	113	initially wrote and tested this code on x86 machine and wrote the
1745a3fb BL	114	digests out in machine-dependent order :( There are people using
	115	this code and I cannot change this easily without making existing
	116	data files unreadable.
	117
	118	*/
	119
	120	#include <stdio.h>
	121	#include <errno.h>
3205db2b	122	#include <assert.h>
1745a3fb	123	#include "cryptlib.h"
ec577822 BM	124	#include <openssl/buffer.h>
	125	#include <openssl/bio.h>
	126	#include <openssl/evp.h>
	127	#include <openssl/rand.h>
1745a3fb	128
0e1c0612 UM	129	static int ok_write(BIO h, const char buf, int num);
	130	static int ok_read(BIO h, char buf, int size);
	131	static long ok_ctrl(BIO h, int cmd, long arg1, void arg2);
1745a3fb BL	132	static int ok_new(BIO *h);
1745a3fb BL	133	static int ok_free(BIO *data);
13083215	134	static long ok_callback_ctrl(BIO h, int cmd, bio_info_cb fp);
d3442bc7	135
b6dcdbfc DSH	136	static __owur int sig_out(BIO* b);
	137	static __owur int sig_in(BIO* b);
	138	static __owur int block_out(BIO* b);
	139	static __owur int block_in(BIO* b);
1745a3fb BL	140	#define OK_BLOCK_SIZE (1024*4)
	141	#define OK_BLOCK_BLOCK 4
	142	#define IOBS (OK_BLOCK_SIZE+ OK_BLOCK_BLOCK+ 3*EVP_MAX_MD_SIZE)
	143	#define WELLKNOWN "The quick brown fox jumped over the lazy dog's back."
	144
1745a3fb BL	145	typedef struct ok_struct
1745a3fb BL	146	{
0f71b77d AP	147	size_t buf_len;
	148	size_t buf_off;
	149	size_t buf_len_save;
	150	size_t buf_off_save;
1745a3fb BL	151	int cont; /* <= 0 when finished */
	152	int finished;
	153	EVP_MD_CTX md;
	154	int blockout; /* output block is ready */
	155	int sigio; /* must process signature */
323f289c	156	unsigned char buf[IOBS];
1745a3fb BL	157	} BIO_OK_CTX;
	158
	159	static BIO_METHOD methods_ok=
	160	{
	161	BIO_TYPE_CIPHER,"reliable",
	162	ok_write,
	163	ok_read,
	164	NULL, /* ok_puts, */
	165	NULL, /* ok_gets, */
	166	ok_ctrl,
	167	ok_new,
	168	ok_free,
d3442bc7	169	ok_callback_ctrl,
1745a3fb BL	170	};
1745a3fb BL	171
6b691a5c	172	BIO_METHOD *BIO_f_reliable(void)
1745a3fb BL	173	{
	174	return(&methods_ok);
	175	}
	176
6b691a5c	177	static int ok_new(BIO *bi)
1745a3fb BL	178	{
	179	BIO_OK_CTX *ctx;
	180
26a3a48d	181	ctx=(BIO_OK_CTX *)OPENSSL_malloc(sizeof(BIO_OK_CTX));
1745a3fb BL	182	if (ctx == NULL) return(0);
	183
	184	ctx->buf_len=0;
	185	ctx->buf_off=0;
	186	ctx->buf_len_save=0;
	187	ctx->buf_off_save=0;
	188	ctx->cont=1;
	189	ctx->finished=0;
	190	ctx->blockout= 0;
	191	ctx->sigio=1;
	192
dbad1690 BL	193	EVP_MD_CTX_init(&ctx->md);
dbad1690 BL	194
1745a3fb BL	195	bi->init=0;
	196	bi->ptr=(char *)ctx;
	197	bi->flags=0;
	198	return(1);
	199	}
	200
6b691a5c	201	static int ok_free(BIO *a)
1745a3fb BL	202	{
1745a3fb BL	203	if (a == NULL) return(0);
dbad1690	204	EVP_MD_CTX_cleanup(&((BIO_OK_CTX *)a->ptr)->md);
4579924b	205	OPENSSL_cleanse(a->ptr,sizeof(BIO_OK_CTX));
26a3a48d	206	OPENSSL_free(a->ptr);
1745a3fb BL	207	a->ptr=NULL;
	208	a->init=0;
	209	a->flags=0;
	210	return(1);
	211	}
	212
6b691a5c	213	static int ok_read(BIO b, char out, int outl)
1745a3fb BL	214	{
	215	int ret=0,i,n;
	216	BIO_OK_CTX *ctx;
	217
	218	if (out == NULL) return(0);
	219	ctx=(BIO_OK_CTX *)b->ptr;
	220
	221	if ((ctx == NULL) \|\| (b->next_bio == NULL) \|\| (b->init == 0)) return(0);
	222
	223	while(outl > 0)
	224	{
	225
	226	/* copy clean bytes to output buffer */
	227	if (ctx->blockout)
	228	{
	229	i=ctx->buf_len-ctx->buf_off;
	230	if (i > outl) i=outl;
	231	memcpy(out,&(ctx->buf[ctx->buf_off]),i);
	232	ret+=i;
	233	out+=i;
	234	outl-=i;
	235	ctx->buf_off+=i;
	236
	237	/* all clean bytes are out */
	238	if (ctx->buf_len == ctx->buf_off)
	239	{
	240	ctx->buf_off=0;
	241
	242	/* copy start of the next block into proper place */
	243	if(ctx->buf_len_save- ctx->buf_off_save > 0)
	244	{
	245	ctx->buf_len= ctx->buf_len_save- ctx->buf_off_save;
	246	memmove(ctx->buf, &(ctx->buf[ctx->buf_off_save]),
	247	ctx->buf_len);
	248	}
	249	else
	250	{
	251	ctx->buf_len=0;
	252	}
	253	ctx->blockout= 0;
	254	}
	255	}
	256
	257	/* output buffer full -- cancel */
	258	if (outl == 0) break;
	259
	260	/* no clean bytes in buffer -- fill it */
	261	n=IOBS- ctx->buf_len;
	262	i=BIO_read(b->next_bio,&(ctx->buf[ctx->buf_len]),n);
	263
	264	if (i <= 0) break; /* nothing new */
	265
	266	ctx->buf_len+= i;
	267
	268	/* no signature yet -- check if we got one */
b6dcdbfc DSH	269	if (ctx->sigio == 1)
	270	{
	271	if (!sig_in(b))
	272	{
	273	BIO_clear_retry_flags(b);
	274	return 0;
	275	}
	276	}
1745a3fb BL	277
1745a3fb BL	278	/* signature ok -- check if we got block */
b6dcdbfc DSH	279	if (ctx->sigio == 0)
	280	{
	281	if (!block_in(b))
	282	{
	283	BIO_clear_retry_flags(b);
	284	return 0;
	285	}
	286	}
1745a3fb BL	287
	288	/* invalid block -- cancel */
	289	if (ctx->cont <= 0) break;
	290
	291	}
	292
	293	BIO_clear_retry_flags(b);
	294	BIO_copy_next_retry(b);
	295	return(ret);
	296	}
	297
0e1c0612	298	static int ok_write(BIO b, const char in, int inl)
1745a3fb BL	299	{
	300	int ret=0,n,i;
	301	BIO_OK_CTX *ctx;
	302
746fc252 AP	303	if (inl <= 0) return inl;
746fc252 AP	304
1745a3fb BL	305	ctx=(BIO_OK_CTX *)b->ptr;
	306	ret=inl;
	307
	308	if ((ctx == NULL) \|\| (b->next_bio == NULL) \|\| (b->init == 0)) return(0);
	309
b6dcdbfc DSH	310	if(ctx->sigio && !sig_out(b))
b6dcdbfc DSH	311	return 0;
1745a3fb BL	312
	313	do{
	314	BIO_clear_retry_flags(b);
	315	n=ctx->buf_len-ctx->buf_off;
	316	while (ctx->blockout && n > 0)
	317	{
	318	i=BIO_write(b->next_bio,&(ctx->buf[ctx->buf_off]),n);
	319	if (i <= 0)
	320	{
	321	BIO_copy_next_retry(b);
	322	if(!BIO_should_retry(b))
	323	ctx->cont= 0;
	324	return(i);
	325	}
	326	ctx->buf_off+=i;
	327	n-=i;
	328	}
	329
	330	/* at this point all pending data has been written */
	331	ctx->blockout= 0;
	332	if (ctx->buf_len == ctx->buf_off)
	333	{
	334	ctx->buf_len=OK_BLOCK_BLOCK;
	335	ctx->buf_off=0;
	336	}
	337
	338	if ((in == NULL) \|\| (inl <= 0)) return(0);
	339
	340	n= (inl+ ctx->buf_len > OK_BLOCK_SIZE+ OK_BLOCK_BLOCK) ?
746fc252	341	(int)(OK_BLOCK_SIZE+OK_BLOCK_BLOCK-ctx->buf_len) : inl;
1745a3fb BL	342
	343	memcpy((unsigned char )(&(ctx->buf[ctx->buf_len])),(unsigned char )in,n);
	344	ctx->buf_len+= n;
	345	inl-=n;
	346	in+=n;
	347
	348	if(ctx->buf_len >= OK_BLOCK_SIZE+ OK_BLOCK_BLOCK)
	349	{
b6dcdbfc DSH	350	if (!block_out(b))
	351	{
	352	BIO_clear_retry_flags(b);
	353	return 0;
	354	}
1745a3fb BL	355	}
	356	}while(inl > 0);
	357
	358	BIO_clear_retry_flags(b);
	359	BIO_copy_next_retry(b);
	360	return(ret);
	361	}
	362
0e1c0612	363	static long ok_ctrl(BIO b, int cmd, long num, void ptr)
1745a3fb BL	364	{
	365	BIO_OK_CTX *ctx;
	366	EVP_MD *md;
e778802f	367	const EVP_MD **ppmd;
1745a3fb BL	368	long ret=1;
	369	int i;
	370
dbad1690	371	ctx=b->ptr;
1745a3fb BL	372
	373	switch (cmd)
	374	{
	375	case BIO_CTRL_RESET:
	376	ctx->buf_len=0;
	377	ctx->buf_off=0;
	378	ctx->buf_len_save=0;
	379	ctx->buf_off_save=0;
	380	ctx->cont=1;
	381	ctx->finished=0;
	382	ctx->blockout= 0;
	383	ctx->sigio=1;
	384	ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
	385	break;
	386	case BIO_CTRL_EOF: /* More to read */
	387	if (ctx->cont <= 0)
	388	ret=1;
	389	else
	390	ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
	391	break;
	392	case BIO_CTRL_PENDING: /* More to read in buffer */
	393	case BIO_CTRL_WPENDING: /* More to read in buffer */
	394	ret=ctx->blockout ? ctx->buf_len-ctx->buf_off : 0;
	395	if (ret <= 0)
	396	ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
	397	break;
	398	case BIO_CTRL_FLUSH:
	399	/* do a final write */
	400	if(ctx->blockout == 0)
b6dcdbfc DSH	401	if (!block_out(b))
b6dcdbfc DSH	402	return 0;
1745a3fb BL	403
	404	while (ctx->blockout)
	405	{
	406	i=ok_write(b,NULL,0);
	407	if (i < 0)
	408	{
	409	ret=i;
	410	break;
	411	}
	412	}
	413
	414	ctx->finished=1;
	415	ctx->buf_off=ctx->buf_len=0;
	416	ctx->cont=(int)ret;
	417
	418	/* Finally flush the underlying BIO */
	419	ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
	420	break;
	421	case BIO_C_DO_STATE_MACHINE:
	422	BIO_clear_retry_flags(b);
	423	ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
	424	BIO_copy_next_retry(b);
	425	break;
	426	case BIO_CTRL_INFO:
	427	ret=(long)ctx->cont;
	428	break;
	429	case BIO_C_SET_MD:
dbad1690	430	md=ptr;
b6dcdbfc DSH	431	if (!EVP_DigestInit_ex(&ctx->md, md, NULL))
b6dcdbfc DSH	432	return 0;
1745a3fb BL	433	b->init=1;
	434	break;
	435	case BIO_C_GET_MD:
	436	if (b->init)
	437	{
dbad1690	438	ppmd=ptr;
1745a3fb BL	439	*ppmd=ctx->md.digest;
	440	}
	441	else
	442	ret=0;
	443	break;
	444	default:
	445	ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
	446	break;
	447	}
	448	return(ret);
	449	}
	450
13083215	451	static long ok_callback_ctrl(BIO b, int cmd, bio_info_cb fp)
d3442bc7 RL	452	{
	453	long ret=1;
	454
	455	if (b->next_bio == NULL) return(0);
	456	switch (cmd)
	457	{
	458	default:
	459	ret=BIO_callback_ctrl(b->next_bio,cmd,fp);
	460	break;
	461	}
	462	return(ret);
	463	}
	464
3205db2b AP	465	static void longswap(void *_ptr, size_t len)
	466	{ const union { long one; char little; } is_endian = {1};
	467
	468	if (is_endian.little) {
	469	size_t i;
	470	unsigned char *p=_ptr,c;
1745a3fb	471
3205db2b AP	472	for(i= 0;i < len;i+= 4) {
	473	c=p[0],p[0]=p[3],p[3]=c;
	474	c=p[1],p[1]=p[2],p[2]=c;
	475	}
1745a3fb	476	}
1745a3fb BL	477	}
1745a3fb BL	478
b6dcdbfc	479	static int sig_out(BIO* b)
1745a3fb BL	480	{
	481	BIO_OK_CTX *ctx;
	482	EVP_MD_CTX *md;
	483
dbad1690 BL	484	ctx=b->ptr;
dbad1690 BL	485	md=&ctx->md;
1745a3fb	486
b6dcdbfc	487	if(ctx->buf_len+ 2* md->digest->md_size > OK_BLOCK_SIZE) return 1;
1745a3fb	488
b6dcdbfc DSH	489	if (!EVP_DigestInit_ex(md, md->digest, NULL))
b6dcdbfc DSH	490	goto berr;
dbad1690 BL	491	/* FIXME: there's absolutely no guarantee this makes any sense at all,
	492	* particularly now EVP_MD_CTX has been restructured.
	493	*/
	494	RAND_pseudo_bytes(md->md_data, md->digest->md_size);
	495	memcpy(&(ctx->buf[ctx->buf_len]), md->md_data, md->digest->md_size);
1745a3fb BL	496	longswap(&(ctx->buf[ctx->buf_len]), md->digest->md_size);
	497	ctx->buf_len+= md->digest->md_size;
	498
b6dcdbfc DSH	499	if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN)))
	500	goto berr;
	501	if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL))
	502	goto berr;
1745a3fb BL	503	ctx->buf_len+= md->digest->md_size;
	504	ctx->blockout= 1;
	505	ctx->sigio= 0;
b6dcdbfc DSH	506	return 1;
	507	berr:
	508	BIO_clear_retry_flags(b);
	509	return 0;
1745a3fb BL	510	}
1745a3fb BL	511
b6dcdbfc	512	static int sig_in(BIO* b)
1745a3fb BL	513	{
	514	BIO_OK_CTX *ctx;
	515	EVP_MD_CTX *md;
	516	unsigned char tmp[EVP_MAX_MD_SIZE];
	517	int ret= 0;
	518
dbad1690 BL	519	ctx=b->ptr;
dbad1690 BL	520	md=&ctx->md;
1745a3fb	521
b6dcdbfc	522	if((int)(ctx->buf_len-ctx->buf_off) < 2*md->digest->md_size) return 1;
1745a3fb	523
b6dcdbfc DSH	524	if (!EVP_DigestInit_ex(md, md->digest, NULL))
b6dcdbfc DSH	525	goto berr;
dbad1690 BL	526	memcpy(md->md_data, &(ctx->buf[ctx->buf_off]), md->digest->md_size);
dbad1690 BL	527	longswap(md->md_data, md->digest->md_size);
1745a3fb BL	528	ctx->buf_off+= md->digest->md_size;
1745a3fb BL	529
b6dcdbfc DSH	530	if (!EVP_DigestUpdate(md, WELLKNOWN, strlen(WELLKNOWN)))
	531	goto berr;
	532	if (!EVP_DigestFinal_ex(md, tmp, NULL))
	533	goto berr;
1745a3fb BL	534	ret= memcmp(&(ctx->buf[ctx->buf_off]), tmp, md->digest->md_size) == 0;
	535	ctx->buf_off+= md->digest->md_size;
	536	if(ret == 1)
	537	{
	538	ctx->sigio= 0;
	539	if(ctx->buf_len != ctx->buf_off)
	540	{
	541	memmove(ctx->buf, &(ctx->buf[ctx->buf_off]), ctx->buf_len- ctx->buf_off);
	542	}
	543	ctx->buf_len-= ctx->buf_off;
	544	ctx->buf_off= 0;
	545	}
	546	else
	547	{
	548	ctx->cont= 0;
	549	}
b6dcdbfc DSH	550	return 1;
	551	berr:
	552	BIO_clear_retry_flags(b);
	553	return 0;
1745a3fb BL	554	}
1745a3fb BL	555
b6dcdbfc	556	static int block_out(BIO* b)
1745a3fb BL	557	{
	558	BIO_OK_CTX *ctx;
	559	EVP_MD_CTX *md;
	560	unsigned long tl;
	561
dbad1690 BL	562	ctx=b->ptr;
dbad1690 BL	563	md=&ctx->md;
1745a3fb BL	564
1745a3fb BL	565	tl= ctx->buf_len- OK_BLOCK_BLOCK;
3205db2b AP	566	ctx->buf[0]=(unsigned char)(tl>>24);
	567	ctx->buf[1]=(unsigned char)(tl>>16);
	568	ctx->buf[2]=(unsigned char)(tl>>8);
	569	ctx->buf[3]=(unsigned char)(tl);
b6dcdbfc DSH	570	if (!EVP_DigestUpdate(md,
	571	(unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl))
	572	goto berr;
	573	if (!EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL))
	574	goto berr;
1745a3fb BL	575	ctx->buf_len+= md->digest->md_size;
1745a3fb BL	576	ctx->blockout= 1;
b6dcdbfc DSH	577	return 1;
	578	berr:
	579	BIO_clear_retry_flags(b);
	580	return 0;
1745a3fb BL	581	}
1745a3fb BL	582
b6dcdbfc	583	static int block_in(BIO* b)
1745a3fb BL	584	{
	585	BIO_OK_CTX *ctx;
	586	EVP_MD_CTX *md;
3205db2b	587	unsigned long tl= 0;
1745a3fb BL	588	unsigned char tmp[EVP_MAX_MD_SIZE];
1745a3fb BL	589
dbad1690 BL	590	ctx=b->ptr;
dbad1690 BL	591	md=&ctx->md;
1745a3fb	592
3205db2b AP	593	assert(sizeof(tl)>=OK_BLOCK_BLOCK); /* always true */
	594	tl =ctx->buf[0]; tl<<=8;
	595	tl\|=ctx->buf[1]; tl<<=8;
	596	tl\|=ctx->buf[2]; tl<<=8;
	597	tl\|=ctx->buf[3];
	598
b6dcdbfc	599	if (ctx->buf_len < tl+ OK_BLOCK_BLOCK+ md->digest->md_size) return 1;
1745a3fb	600
b6dcdbfc DSH	601	if (!EVP_DigestUpdate(md,
	602	(unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl))
	603	goto berr;
	604	if (!EVP_DigestFinal_ex(md, tmp, NULL))
	605	goto berr;
1745a3fb BL	606	if(memcmp(&(ctx->buf[tl+ OK_BLOCK_BLOCK]), tmp, md->digest->md_size) == 0)
	607	{
	608	/* there might be parts from next block lurking around ! */
	609	ctx->buf_off_save= tl+ OK_BLOCK_BLOCK+ md->digest->md_size;
	610	ctx->buf_len_save= ctx->buf_len;
	611	ctx->buf_off= OK_BLOCK_BLOCK;
	612	ctx->buf_len= tl+ OK_BLOCK_BLOCK;
	613	ctx->blockout= 1;
	614	}
	615	else
	616	{
	617	ctx->cont= 0;
	618	}
b6dcdbfc DSH	619	return 1;
	620	berr:
	621	BIO_clear_retry_flags(b);
	622	return 0;
1745a3fb BL	623	}
1745a3fb BL	624