From: Philippe Wooding Date: Tue, 4 Dec 2018 16:57:09 +0000 (+0100) Subject: Convert sha2 & sha3 xlats to new async API X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eee75929406d86259ea4c662741e451154936fbc;p=thirdparty%2Ffreeradius-server.git Convert sha2 & sha3 xlats to new async API --- diff --git a/src/lib/server/xlat_func.c b/src/lib/server/xlat_func.c index 577617defb6..17026c5b590 100644 --- a/src/lib/server/xlat_func.c +++ b/src/lib/server/xlat_func.c @@ -1275,45 +1275,47 @@ static xlat_action_t sha1_xlat(TALLOC_CTX *ctx, fr_cursor_t *out, * Example: "%{sha256:foo}" == "0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33" */ #ifdef HAVE_OPENSSL_EVP_H -static ssize_t evp_md_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, - UNUSED void const *mod_inst, UNUSED void const *xlat_inst, - REQUEST *request, char const *fmt, EVP_MD const *md) +static xlat_action_t evp_md_xlat(TALLOC_CTX *ctx, fr_cursor_t *out, + REQUEST *request, UNUSED void const *xlat_inst, UNUSED void *xlat_thread_inst, + fr_value_box_t **in, EVP_MD const *md) { uint8_t digest[EVP_MAX_MD_SIZE]; - unsigned int digestlen, i, len; - size_t inlen; - uint8_t *p; + unsigned int digestlen; EVP_MD_CTX *md_ctx; - TALLOC_CTX *tmp_ctx = NULL; + fr_value_box_t *vb; - VALUE_FROM_FMT(tmp_ctx, p, inlen, request, fmt); + /* + * Concatenate all input if there is some + */ + if (*in && fr_value_box_list_concat(ctx, *in, in, FR_TYPE_OCTETS, true) < 0) { + RPEDEBUG("Failed concatenating input"); + return XLAT_ACTION_FAIL; + } md_ctx = EVP_MD_CTX_create(); EVP_DigestInit_ex(md_ctx, md, NULL); - EVP_DigestUpdate(md_ctx, p, inlen); + if (*in) { + EVP_DigestUpdate(md_ctx, (*in)->vb_octets, (*in)->vb_length); + } else { + EVP_DigestUpdate(md_ctx, NULL, 0); + } EVP_DigestFinal_ex(md_ctx, digest, &digestlen); EVP_MD_CTX_destroy(md_ctx); - /* - * Each digest octet takes two hex digits, plus one for - * the terminating NUL. - */ - len = (outlen / 2) - 1; - if (len > digestlen) len = digestlen; - - for (i = 0; i < len; i++) snprintf((*out) + (i * 2), 3, "%02x", digest[i]); + MEM(vb = fr_value_box_alloc_null(ctx)); + fr_value_box_memdup(vb, vb, NULL, digest, digestlen, false); - talloc_free(tmp_ctx); + fr_cursor_append(out, vb); - return strlen(*out); + return XLAT_ACTION_DONE; } # define EVP_MD_XLAT(_md) \ -static ssize_t _md##_xlat(TALLOC_CTX *ctx, char **out, size_t outlen,\ - void const *mod_inst, void const *xlat_inst,\ - REQUEST *request, char const *fmt)\ +static xlat_action_t _md##_xlat(TALLOC_CTX *ctx, fr_cursor_t *out,\ + REQUEST *request, void const *xlat_inst, void *xlat_thread_inst,\ + fr_value_box_t **in)\ {\ - return evp_md_xlat(ctx, out, outlen, mod_inst, xlat_inst, request, fmt, EVP_##_md());\ + return evp_md_xlat(ctx, out, request, xlat_inst, xlat_thread_inst, in, EVP_##_md());\ } EVP_MD_XLAT(sha224) @@ -2621,19 +2623,6 @@ int xlat_init(void) XLAT_REGISTER(module); XLAT_REGISTER(debug_attr); -#ifdef HAVE_OPENSSL_EVP_H - xlat_register(NULL, "sha224", sha224_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); - xlat_register(NULL, "sha256", sha256_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); - xlat_register(NULL, "sha384", sha384_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); - xlat_register(NULL, "sha512", sha512_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); - -# ifdef HAVE_EVP_SHA3_512 - xlat_register(NULL, "sha3_224", sha3_224_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); - xlat_register(NULL, "sha3_256", sha3_256_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); - xlat_register(NULL, "sha3_384", sha3_384_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); - xlat_register(NULL, "sha3_512", sha3_512_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); -# endif -#endif xlat_register(NULL, "hmacmd5", hmac_md5_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); xlat_register(NULL, "hmacsha1", hmac_sha1_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); xlat_register(NULL, "pairs", pairs_xlat, NULL, NULL, 0, XLAT_DEFAULT_BUF_LEN, true); @@ -2664,6 +2653,21 @@ int xlat_init(void) xlat_async_register(NULL, "regex", regex_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); #endif xlat_async_register(NULL, "sha1", sha1_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + +#ifdef HAVE_OPENSSL_EVP_H + xlat_async_register(NULL, "sha224", sha224_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + xlat_async_register(NULL, "sha256", sha256_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + xlat_async_register(NULL, "sha384", sha384_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + xlat_async_register(NULL, "sha512", sha512_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + +# ifdef HAVE_EVP_SHA3_512 + xlat_async_register(NULL, "sha3_224", sha3_224_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + xlat_async_register(NULL, "sha3_256", sha3_256_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + xlat_async_register(NULL, "sha3_384", sha3_384_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + xlat_async_register(NULL, "sha3_512", sha3_512_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); +# endif +#endif + xlat_async_register(NULL, "urlquote", urlquote_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); xlat_async_register(NULL, "urlunquote", urlunquote_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); xlat_async_register(NULL, "tolower", tolower_xlat, NULL, NULL, NULL, NULL, NULL, NULL, NULL); diff --git a/src/tests/keywords/pap-ssha2 b/src/tests/keywords/pap-ssha2 index ab3db4e854c..e577417146e 100644 --- a/src/tests/keywords/pap-ssha2 +++ b/src/tests/keywords/pap-ssha2 @@ -21,7 +21,7 @@ update { # Hex encoded SSHA2-512 password # update { - control:Password-With-Header += "{ssha512}%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:%{&request:Tmp-String-0}}" + control:Password-With-Header += "{ssha512}%{hex:%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}}%{hex:%{&request:Tmp-String-0}}" } pap.authorize @@ -40,7 +40,7 @@ update { # Base64 encoded SSHA2-512 password # update { - control:Tmp-String-1 := "%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:%{&request:Tmp-String-0}}" + control:Tmp-String-1 := "%{hex:%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}}%{hex:%{&request:Tmp-String-0}}" } # To Binary @@ -73,7 +73,7 @@ update { # Base64 of Base64 encoded SSHA2-512 password # update { - control:Tmp-String-1 := "%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}%{hex:%{&request:Tmp-String-0}}" + control:Tmp-String-1 := "%{hex:%{sha512:%{request:User-Password}%{&request:Tmp-String-0}}}%{hex:%{&request:Tmp-String-0}}" } # To Binary diff --git a/src/tests/keywords/sha2 b/src/tests/keywords/sha2 index 593105ca63b..d491c1aabd7 100644 --- a/src/tests/keywords/sha2 +++ b/src/tests/keywords/sha2 @@ -9,30 +9,41 @@ update { request:Tmp-Octets-0 := 0x000504030201 } +update { + request:Tmp-Octets-1 := "%{sha256:This is a string\n}" + request:Tmp-Octets-2 := "%{sha256:%{&Tmp-String-0}}" + request:Tmp-Octets-3 := "%{sha256:%{&request:Tmp-String-0}}" + request:Tmp-Octets-4 := "%{sha256:%{&request:Tmp-Octets-0}}" + request:Tmp-Octets-5 := "%{sha256:%{&request:Tmp-Octets-9}}" +} + # # Put "This is a string" into a file and call "sha256sum" on it. # You should get this string. # -if ("%{sha256:This is a string\n}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') { +if (&request:Tmp-Octets-1 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) { test_fail } -if ("%{sha256:&Tmp-String-0}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') { +if (&request:Tmp-Octets-2 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) { test_fail } -if ("%{sha256:&request:Tmp-String-0}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') { +if (&request:Tmp-Octets-3 != 0xb3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124) { test_fail } -if ("%{sha256:%{Tmp-String-0}}" != 'b3716a1ab53042bb392034f29071e13b0c38aa19b4edd75d9a76022f91189124') { +# +# SHA256 should also be able to cope with references to octet attributes +# +if (&request:Tmp-Octets-4 != 0xf307e202b881fded70e58017aa0c4d7b29c76ab25d02bf078301a5f6635187eb) { test_fail } # -# SHA256 should also be able to cope with references to octet attributes +# SHA256 of empty string # -if ("%{sha256:&request:Tmp-Octets-0}" != 'f307e202b881fded70e58017aa0c4d7b29c76ab25d02bf078301a5f6635187eb') { +if (&request:Tmp-Octets-5 != 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) { test_fail } @@ -40,15 +51,21 @@ if ("%{sha256:&request:Tmp-Octets-0}" != 'f307e202b881fded70e58017aa0c4d7b29c76a # SHA512 and SHA256 share common code paths, so the tests don't need to be # as exhaustive. # -if ("%{sha512:This is a string\n}" != '56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f') { +update { + request:Tmp-Octets-1 := "%{sha512:This is a string\n}" + request:Tmp-Octets-2 := "%{sha512:%{&Tmp-String-0}}" + request:Tmp-Octets-3 := "%{sha512:%{&request:Tmp-Octets-0}}" +} + +if (&request:Tmp-Octets-1 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) { test_fail } -if ("%{sha512:&Tmp-String-0}" != '56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f') { +if (&request:Tmp-Octets-2 != 0x56b57df5cce42d4e35c644649798ea23ec16f4f4626e78faf4d2d8f430ea349bcc28cd5532457c82f0aa66bf68988346039fe75b900a92ff94fd53993d45990f) { test_fail } -if ("%{sha512:&request:Tmp-Octets-0}" != 'de80271eb5e03a1c24dd0cd823a22305a743ee3a54f1de5bf97adbf56984561154bfb6928b1da4ccc3f5dde9f4032ad461937b60b9ace4ad3898cf45c90596d7') { +if (&request:Tmp-Octets-3 != 0xde80271eb5e03a1c24dd0cd823a22305a743ee3a54f1de5bf97adbf56984561154bfb6928b1da4ccc3f5dde9f4032ad461937b60b9ace4ad3898cf45c90596d7) { test_fail }