Convert sha2 & sha3 xlats to new async API

diff --git a/src/lib/server/xlat_func.c b/src/lib/server/xlat_func.c
index 577617defb6453e92322f3235d174f63f0bbacca..17026c5b590e0448106679da24ca490702965ce5 100644 (file)
--- a/src/lib/server/xlat_func.c
+++ b/src/lib/server/xlat_func.c
@@ -1275,45 +1275,47 @@ static xlat_action_t sha1_xlat(TALLOC_CTX *ctx, fr_cursor_t *out,
  * Example: "%{sha256:foo}" == "0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33"
  */
 #ifdef HAVE_OPENSSL_EVP_H
-static ssize_t evp_md_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen,
-                          UNUSED void const *mod_inst, UNUSED void const *xlat_inst,
-                          REQUEST *request, char const *fmt, EVP_MD const *md)
+static xlat_action_t evp_md_xlat(TALLOC_CTX *ctx, fr_cursor_t *out,
+                                REQUEST *request, UNUSED void const *xlat_inst, UNUSED void *xlat_thread_inst,
+                                fr_value_box_t **in, EVP_MD const *md)
 {
        uint8_t         digest[EVP_MAX_MD_SIZE];
-       unsigned int    digestlen, i, len;
-       size_t          inlen;
-       uint8_t         *p;
+       unsigned int    digestlen;
        EVP_MD_CTX      *md_ctx;
-       TALLOC_CTX      *tmp_ctx = NULL;
+       fr_value_box_t  *vb;
 
-       VALUE_FROM_FMT(tmp_ctx, p, inlen, request, fmt);
+       /*
+        * Concatenate all input if there is some
+        */
+       if (*in && fr_value_box_list_concat(ctx, *in, in, FR_TYPE_OCTETS, true) < 0) {
+               RPEDEBUG("Failed concatenating input");
+               return XLAT_ACTION_FAIL;
+       }
 
        md_ctx = EVP_MD_CTX_create();
        EVP_DigestInit_ex(md_ctx, md, NULL);
-       EVP_DigestUpdate(md_ctx, p, inlen);
+       if (*in) {
+               EVP_DigestUpdate(md_ctx, (*in)->vb_octets, (*in)->vb_length);
+       } else {
+               EVP_DigestUpdate(md_ctx, NULL, 0);
+       }
        EVP_DigestFinal_ex(md_ctx, digest, &digestlen);
        EVP_MD_CTX_destroy(md_ctx);
 
-       /*
-        *      Each digest octet takes two hex digits, plus one for
-        *      the terminating NUL.
-        */
-       len = (outlen / 2) - 1;
-       if (len > digestlen) len = digestlen;
-
-       for (i = 0; i < len; i++) snprintf((*out) + (i * 2), 3, "%02x", digest[i]);
+       MEM(vb = fr_value_box_alloc_null(ctx));
+       fr_value_box_memdup(vb, vb, NULL, digest, digestlen, false);
 
-       talloc_free(tmp_ctx);
+       fr_cursor_append(out, vb);
 
-       return strlen(*out);
+       return XLAT_ACTION_DONE;
 }
 
 #  define EVP_MD_XLAT(_md) \
-static ssize_t _md##_xlat(TALLOC_CTX *ctx, char **out, size_t outlen,\
-                         void const *mod_inst, void const *xlat_inst,\
-                         REQUEST *request, char const *fmt)\
+static xlat_action_t _md##_xlat(TALLOC_CTX *ctx, fr_cursor_t *out,\
+                                REQUEST *request, void const *xlat_inst, void *xlat_thread_inst,\
+                                fr_value_box_t **in)\
 {\
-       return evp_md_xlat(ctx, out, outlen, mod_inst, xlat_inst, request, fmt, EVP_##_md());\
+       return evp_md_xlat(ctx, out, request, xlat_inst, xlat_thread_inst, in, EVP_##_md());\
 }
 
 EVP_MD_XLAT(sha224)
@@ -2621,19 +2623,6 @@ int xlat_init(void)
        XLAT_REGISTER(module);
        XLAT_REGISTER(debug_attr);
 
-#ifdef HAVE_OPENSSL_EVP_H
-       xlat_register(NULL, "sha224", sha224_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-       xlat_register(NULL, "sha256", sha256_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-       xlat_register(NULL, "sha384", sha384_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-       xlat_register(NULL, "sha512", sha512_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-
-#  ifdef HAVE_EVP_SHA3_512
-       xlat_register(NULL, "sha3_224", sha3_224_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-       xlat_register(NULL, "sha3_256", sha3_256_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-       xlat_register(NULL, "sha3_384", sha3_384_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-       xlat_register(NULL, "sha3_512", sha3_512_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
-#  endif
-#endif
        xlat_register(NULL, "hmacmd5", hmac_md5_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
        xlat_register(NULL, "hmacsha1", hmac_sha1_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
        xlat_register(NULL, "pairs", pairs_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true);
@@ -2664,6 +2653,21 @@ int xlat_init(void)
        xlat_async_register(NULL, "regex", regex_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
 #endif
        xlat_async_register(NULL, "sha1", sha1_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+
+#ifdef HAVE_OPENSSL_EVP_H
+       xlat_async_register(NULL, "sha224", sha224_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+       xlat_async_register(NULL, "sha256", sha256_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+       xlat_async_register(NULL, "sha384", sha384_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+       xlat_async_register(NULL, "sha512", sha512_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+
+#  ifdef HAVE_EVP_SHA3_512
+       xlat_async_register(NULL, "sha3_224", sha3_224_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+       xlat_async_register(NULL, "sha3_256", sha3_256_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+       xlat_async_register(NULL, "sha3_384", sha3_384_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+       xlat_async_register(NULL, "sha3_512", sha3_512_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
+#  endif
+#endif
+
        xlat_async_register(NULL, "urlquote", urlquote_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
        xlat_async_register(NULL, "urlunquote", urlunquote_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
        xlat_async_register(NULL, "tolower", tolower_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL);

diff --git a/src/tests/keywords/pap-ssha2 b/src/tests/keywords/pap-ssha2
index ab3db4e854c0c5f40c82acf44507c5e000b808ef..e577417146e128b42b593bdf1faaf7a2daceaa3f 100644 (file)
--- a/src/tests/keywords/pap-ssha2
+++ b/src/tests/keywords/pap-ssha2
@@ -21,7 +21,7 @@ update {
 #  Hex encoded SSHA2-512 password
 #
 update {
-       control:Password-With-Header += "{ssha512}%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:%{&request:Tmp-String-0}}"
+       control:Password-With-Header += "{ssha512}%{hex:%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}}%{hex:%{&request:Tmp-String-0}}"
 }
 
 pap.authorize
@@ -40,7 +40,7 @@ update {
 #  Base64 encoded SSHA2-512 password
 #
 update {
-       control:Tmp-String-1 := "%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:%{&request:Tmp-String-0}}"
+       control:Tmp-String-1 := "%{hex:%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}}%{hex:%{&request:Tmp-String-0}}"
 }
 
 # To Binary
@@ -73,7 +73,7 @@ update {
 #  Base64 of Base64 encoded SSHA2-512 password
 #
 update {
-       control:Tmp-String-1 := "%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:%{&request:Tmp-String-0}}"
+       control:Tmp-String-1 := "%{hex:%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}}%{hex:%{&request:Tmp-String-0}}"
 }
 
 # To Binary

diff --git a/src/tests/keywords/sha2 b/src/tests/keywords/sha2
index 593105ca63b1d313f65890f0498ea9f25cf3ecc9..d491c1aabd70aaf9ffa95d9762eb75ff4c1f3119 100644 (file)
--- a/src/tests/keywords/sha2
+++ b/src/tests/keywords/sha2
@@ -9,30 +9,41 @@ update {
        request:Tmp-Octets-0 := 0x000504030201
 }
 
+update {
+       request:Tmp-Octets-1 := "%{sha256:This is a string\n}"
+       request:Tmp-Octets-2 := "%{sha256:%{&Tmp-String-0}}"
+       request:Tmp-Octets-3 := "%{sha256:%{&request:Tmp-String-0}}"
+       request:Tmp-Octets-4 := "%{sha256:%{&request:Tmp-Octets-0}}"
+       request:Tmp-Octets-5 := "%{sha256:%{&request:Tmp-Octets-9}}"
+}
+
 #
 #  Put "This is a string" into a file and call "sha256sum" on it.
 #  You should get this string.
 #
-if ("%{sha256:This is a string\n}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+if (&request:Tmp-Octets-1 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
        test_fail
 }
 
-if ("%{sha256:&Tmp-String-0}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+if (&request:Tmp-Octets-2 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
        test_fail
 }
 
-if ("%{sha256:&request:Tmp-String-0}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+if (&request:Tmp-Octets-3 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) {
        test_fail
 }
 
-if ("%{sha256:%{Tmp-String-0}}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') {
+#
+#  SHA256 should also be able to cope with references to octet attributes
+#
+if (&request:Tmp-Octets-4 != 0xf307e202b881fded70e58017aa0c4d7b29c76ab25d02bf078301a5f6635187eb) {
        test_fail
 }
 
 #
-#  SHA256 should also be able to cope with references to octet attributes
+# SHA256 of empty string
 #
-if ("%{sha256:&request:Tmp-Octets-0}" != 'f307e202b881fded70e58017aa0c4d7b29c76ab25d02bf078301a5f6635187eb') {
+if (&request:Tmp-Octets-5 != 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) {
        test_fail
 }
 
@@ -40,15 +51,21 @@ if ("%{sha256:&request:Tmp-Octets-0}" != 'f307e202b881fded70e58017aa0c4d7b29c76a
 #  SHA512 and SHA256 share common code paths, so the tests don't need to be
 #  as exhaustive.
 #
-if ("%{sha512:This is a string\n}" != '56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f') {
+update {
+       request:Tmp-Octets-1 := "%{sha512:This is a string\n}"
+       request:Tmp-Octets-2 := "%{sha512:%{&Tmp-String-0}}"
+       request:Tmp-Octets-3 := "%{sha512:%{&request:Tmp-Octets-0}}"
+}
+
+if (&request:Tmp-Octets-1 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) {
        test_fail
 }
 
-if ("%{sha512:&Tmp-String-0}" != '56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f') {
+if (&request:Tmp-Octets-2 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) {
        test_fail
 }
 
-if ("%{sha512:&request:Tmp-Octets-0}" != 'de80271eb5e03a1c24dd0cd823a22305a743ee3a54f1de5bf97adbf56984561154bfb6928b1da4ccc3f5dde9f4032ad461937b60b9ace4ad3898cf45c90596d7') {
+if (&request:Tmp-Octets-3 != 0xde80271eb5e03a1c24dd0cd823a22305a743ee3a54f1de5bf97adbf56984561154bfb6928b1da4ccc3f5dde9f4032ad461937b60b9ace4ad3898cf45c90596d7) {
        test_fail
 }