Skip to content

Commit 14472bf

Browse files
nicolaswillnicolaswill
committed
Crypto: Refactor type name mapping and fix QL-for-QL alerts
1 parent 710e080 commit 14472bf

File tree

9 files changed

+584
-518
lines changed

9 files changed

+584
-518
lines changed

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/BlockAlgorithmInstance.qll‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,36 +5,37 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
55
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
66
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
77
private import AlgToAVCFlow
8+
private import codeql.quantum.experimental.Standardization::Types::KeyOpAlg as KeyOpAlg
89

910
/**
1011
* Given a `KnownOpenSslBlockModeAlgorithmExpr`, converts this to a block family type.
1112
* Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
1213
*/
1314
predicate knownOpenSslConstantToBlockModeFamilyType(
14-
KnownOpenSslBlockModeAlgorithmExpr e, Crypto::TBlockCipherModeOfOperationType type
15+
KnownOpenSslBlockModeAlgorithmExpr e, KeyOpAlg::ModeOfOperationType type
1516
) {
1617
exists(string name |
1718
name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
1819
(
19-
name = "CBC" and type instanceof Crypto::CBC
20+
name = "CBC" and type instanceof KeyOpAlg::CBC
2021
or
21-
name = "CFB%" and type instanceof Crypto::CFB
22+
name = "CFB%" and type instanceof KeyOpAlg::CFB
2223
or
23-
name = "CTR" and type instanceof Crypto::CTR
24+
name = "CTR" and type instanceof KeyOpAlg::CTR
2425
or
25-
name = "GCM" and type instanceof Crypto::GCM
26+
name = "GCM" and type instanceof KeyOpAlg::GCM
2627
or
27-
name = "OFB" and type instanceof Crypto::OFB
28+
name = "OFB" and type instanceof KeyOpAlg::OFB
2829
or
29-
name = "XTS" and type instanceof Crypto::XTS
30+
name = "XTS" and type instanceof KeyOpAlg::XTS
3031
or
31-
name = "CCM" and type instanceof Crypto::CCM
32+
name = "CCM" and type instanceof KeyOpAlg::CCM
3233
or
33-
name = "GCM" and type instanceof Crypto::GCM
34+
name = "GCM" and type instanceof KeyOpAlg::GCM
3435
or
35-
name = "CCM" and type instanceof Crypto::CCM
36+
name = "CCM" and type instanceof KeyOpAlg::CCM
3637
or
37-
name = "ECB" and type instanceof Crypto::ECB
38+
name = "ECB" and type instanceof KeyOpAlg::ECB
3839
)
3940
)
4041
}
@@ -64,10 +65,10 @@ class KnownOpenSslBlockModeConstantAlgorithmInstance extends OpenSslAlgorithmIns
6465
getterCall = this
6566
}
6667

67-
override Crypto::TBlockCipherModeOfOperationType getModeType() {
68+
override KeyOpAlg::ModeOfOperationType getModeType() {
6869
knownOpenSslConstantToBlockModeFamilyType(this, result)
6970
or
70-
not knownOpenSslConstantToBlockModeFamilyType(this, _) and result = Crypto::OtherMode()
71+
not knownOpenSslConstantToBlockModeFamilyType(this, _) and result = KeyOpAlg::OtherMode()
7172
}
7273

7374
// NOTE: I'm not going to attempt to parse out the mode specific part, so returning

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ class KnownOpenSslCipherConstantAlgorithmInstance extends OpenSslAlgorithmInstan
113113
this.(KnownOpenSslCipherAlgorithmExpr).getExplicitKeySize() = result
114114
}
115115

116-
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
116+
override KeyOpAlg::AlgorithmType getAlgorithmType() {
117117
knownOpenSslConstantToCipherFamilyType(this, result)
118118
or
119119
not knownOpenSslConstantToCipherFamilyType(this, _) and

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,16 +39,22 @@ class KnownOpenSslEllipticCurveConstantAlgorithmInstance extends OpenSslAlgorith
3939
result = this.(Call).getTarget().getName()
4040
}
4141

42-
override Crypto::TEllipticCurveType getEllipticCurveType() {
43-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _, result)
42+
override Crypto::EllipticCurveFamilyType getEllipticCurveFamilyType() {
43+
if
44+
Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _,
45+
_)
46+
then
47+
Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _,
48+
result)
49+
else result = Crypto::OtherEllipticCurveType()
4450
}
4551

4652
override string getParsedEllipticCurveName() {
4753
result = this.(KnownOpenSslAlgorithmExpr).getNormalizedName()
4854
}
4955

5056
override int getKeySize() {
51-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSslAlgorithmExpr)
57+
Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.(KnownOpenSslAlgorithmExpr)
5258
.getNormalizedName(), result, _)
5359
}
5460
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/MACAlgorithmInstance.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ class KnownOpenSslMacConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
3939
result = this.(Call).getTarget().getName()
4040
}
4141

42-
override Crypto::TMacType getMacType() {
43-
this instanceof KnownOpenSslHMacAlgorithmExpr and result instanceof Crypto::THMAC
42+
override Crypto::MacType getMacType() {
43+
this instanceof KnownOpenSslHMacAlgorithmExpr and result = Crypto::HMAC()
4444
or
45-
this instanceof KnownOpenSslCMacAlgorithmExpr and result instanceof Crypto::TCMAC
45+
this instanceof KnownOpenSslCMacAlgorithmExpr and result = Crypto::CMAC()
4646
}
4747
}
4848

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/PaddingAlgorithmInstance.qll‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
55
private import AlgToAVCFlow
66
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
77
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
8+
private import codeql.quantum.experimental.Standardization::Types::KeyOpAlg as KeyOpAlg
89

910
/**
1011
* A class to define padding specific integer values.
@@ -28,18 +29,18 @@ class OpenSslPaddingLiteral extends Literal {
2829
* Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
2930
*/
3031
predicate knownOpenSslConstantToPaddingFamilyType(
31-
KnownOpenSslPaddingAlgorithmExpr e, Crypto::TPaddingType type
32+
KnownOpenSslPaddingAlgorithmExpr e, KeyOpAlg::PaddingSchemeType type
3233
) {
3334
exists(string name |
3435
name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
3536
(
36-
name = "OAEP" and type = Crypto::OAEP()
37+
name = "OAEP" and type = KeyOpAlg::OAEP()
3738
or
38-
name = "PSS" and type = Crypto::PSS()
39+
name = "PSS" and type = KeyOpAlg::PSS()
3940
or
40-
name = "PKCS7" and type = Crypto::PKCS7()
41+
name = "PKCS7" and type = KeyOpAlg::PKCS7()
4142
or
42-
name = "PKCS1V15" and type = Crypto::PKCS1_v1_5()
43+
name = "PKCS1V15" and type = KeyOpAlg::PKCS1_v1_5()
4344
)
4445
)
4546
}
@@ -98,24 +99,24 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
9899

99100
override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
100101

101-
Crypto::TPaddingType getKnownPaddingType() {
102-
this.(Literal).getValue().toInt() in [1, 7, 8] and result = Crypto::PKCS1_v1_5()
102+
KeyOpAlg::PaddingSchemeType getKnownPaddingType() {
103+
this.(Literal).getValue().toInt() in [1, 7, 8] and result = KeyOpAlg::PKCS1_v1_5()
103104
or
104-
this.(Literal).getValue().toInt() = 3 and result = Crypto::NoPadding()
105+
this.(Literal).getValue().toInt() = 3 and result = KeyOpAlg::NoPadding()
105106
or
106-
this.(Literal).getValue().toInt() = 4 and result = Crypto::OAEP()
107+
this.(Literal).getValue().toInt() = 4 and result = KeyOpAlg::OAEP()
107108
or
108-
this.(Literal).getValue().toInt() = 5 and result = Crypto::ANSI_X9_23()
109+
this.(Literal).getValue().toInt() = 5 and result = KeyOpAlg::ANSI_X9_23()
109110
or
110-
this.(Literal).getValue().toInt() = 6 and result = Crypto::PSS()
111+
this.(Literal).getValue().toInt() = 6 and result = KeyOpAlg::PSS()
111112
}
112113

113-
override Crypto::TPaddingType getPaddingType() {
114+
override KeyOpAlg::PaddingSchemeType getPaddingType() {
114115
isPaddingSpecificConsumer = true and
115116
(
116117
result = this.getKnownPaddingType()
117118
or
118-
not exists(this.getKnownPaddingType()) and result = Crypto::OtherPadding()
119+
not exists(this.getKnownPaddingType()) and result = KeyOpAlg::OtherPadding()
119120
)
120121
or
121122
isPaddingSpecificConsumer = false and
@@ -165,7 +166,7 @@ class OaepPaddingAlgorithmInstance extends Crypto::OaepPaddingAlgorithmInstance,
165166
KnownOpenSslPaddingConstantAlgorithmInstance
166167
{
167168
OaepPaddingAlgorithmInstance() {
168-
this.(Crypto::PaddingAlgorithmInstance).getPaddingType() = Crypto::OAEP()
169+
this.(Crypto::PaddingAlgorithmInstance).getPaddingType() = KeyOpAlg::OAEP()
169170
}
170171

171172
override Crypto::HashAlgorithmInstance getOaepEncodingHashAlgorithm() {

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/SignatureAlgorithmInstance.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ class KnownOpenSslSignatureConstantAlgorithmInstance extends OpenSslAlgorithmIns
7373
none()
7474
}
7575

76-
override KeyOpAlg::Algorithm getAlgorithmType() {
76+
override KeyOpAlg::AlgorithmType getAlgorithmType() {
7777
knownOpenSslConstantToSignatureFamilyType(this, result)
7878
or
7979
not knownOpenSslConstantToSignatureFamilyType(this, _) and

‎java/ql/lib/experimental/quantum/JCA.qll‎

Lines changed: 31 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import semmle.code.java.controlflow.Dominance
55

66
module JCAModel {
77
import Language
8-
import Crypto::KeyOpAlg as KeyOpAlg
8+
import codeql.quantum.experimental.Standardization::Types::KeyOpAlg as KeyOpAlg
99

1010
abstract class CipherAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer { }
1111

@@ -115,7 +115,7 @@ module JCAModel {
115115
}
116116

117117
bindingset[name]
118-
Crypto::THashType hash_name_to_type_known(string name, int digestLength) {
118+
Crypto::HashType hash_name_to_type_known(string name, int digestLength) {
119119
name = "SHA-1" and result instanceof Crypto::SHA1 and digestLength = 160
120120
or
121121
name = ["SHA-256", "SHA-384", "SHA-512"] and
@@ -152,24 +152,22 @@ module JCAModel {
152152
}
153153

154154
bindingset[name]
155-
private predicate mode_name_to_type_known(
156-
Crypto::TBlockCipherModeOfOperationType type, string name
157-
) {
158-
type = Crypto::ECB() and name = "ECB"
155+
private predicate mode_name_to_type_known(KeyOpAlg::ModeOfOperationType type, string name) {
156+
type = KeyOpAlg::ECB() and name = "ECB"
159157
or
160-
type = Crypto::CBC() and name = "CBC"
158+
type = KeyOpAlg::CBC() and name = "CBC"
161159
or
162-
type = Crypto::GCM() and name = "GCM"
160+
type = KeyOpAlg::GCM() and name = "GCM"
163161
or
164-
type = Crypto::CTR() and name = "CTR"
162+
type = KeyOpAlg::CTR() and name = "CTR"
165163
or
166-
type = Crypto::XTS() and name = "XTS"
164+
type = KeyOpAlg::XTS() and name = "XTS"
167165
or
168-
type = Crypto::CCM() and name = "CCM"
166+
type = KeyOpAlg::CCM() and name = "CCM"
169167
or
170-
type = Crypto::SIV() and name = "SIV"
168+
type = KeyOpAlg::SIV() and name = "SIV"
171169
or
172-
type = Crypto::OCB() and name = "OCB"
170+
type = KeyOpAlg::OCB() and name = "OCB"
173171
}
174172

175173
bindingset[name]
@@ -206,7 +204,7 @@ module JCAModel {
206204

207205
bindingset[name]
208206
predicate mac_name_to_mac_type_known(Crypto::TMacType type, string name) {
209-
type = Crypto::THMAC() and
207+
type = Crypto::HMAC() and
210208
name.toUpperCase().matches("HMAC%")
211209
}
212210

@@ -298,18 +296,18 @@ module JCAModel {
298296
override string getRawPaddingAlgorithmName() { result = super.getPadding() }
299297

300298
bindingset[name]
301-
private predicate paddingToNameMappingKnown(Crypto::TPaddingType type, string name) {
302-
type instanceof Crypto::NoPadding and name = "NOPADDING"
299+
private predicate paddingToNameMappingKnown(KeyOpAlg::PaddingSchemeType type, string name) {
300+
type instanceof KeyOpAlg::NoPadding and name = "NOPADDING"
303301
or
304-
type instanceof Crypto::PKCS7 and name = ["PKCS5Padding", "PKCS7Padding"] // TODO: misnomer in the JCA?
302+
type instanceof KeyOpAlg::PKCS7 and name = ["PKCS5Padding", "PKCS7Padding"] // TODO: misnomer in the JCA?
305303
or
306-
type instanceof Crypto::OAEP and name.matches("OAEP%") // TODO: handle OAEPWith%
304+
type instanceof KeyOpAlg::OAEP and name.matches("OAEP%") // TODO: handle OAEPWith%
307305
}
308306

309-
override Crypto::TPaddingType getPaddingType() {
307+
override KeyOpAlg::PaddingSchemeType getPaddingType() {
310308
if this.paddingToNameMappingKnown(_, super.getPadding())
311309
then this.paddingToNameMappingKnown(result, super.getPadding())
312-
else result instanceof Crypto::OtherPadding
310+
else result instanceof KeyOpAlg::OtherPadding
313311
}
314312
}
315313

@@ -320,10 +318,10 @@ module JCAModel {
320318

321319
override string getRawModeAlgorithmName() { result = super.getMode() }
322320

323-
override Crypto::TBlockCipherModeOfOperationType getModeType() {
321+
override KeyOpAlg::ModeOfOperationType getModeType() {
324322
if mode_name_to_type_known(_, super.getMode())
325323
then mode_name_to_type_known(result, super.getMode())
326-
else result instanceof Crypto::OtherMode
324+
else result instanceof KeyOpAlg::OtherMode
327325
}
328326
}
329327

@@ -347,7 +345,7 @@ module JCAModel {
347345

348346
override string getRawAlgorithmName() { result = super.getValue() }
349347

350-
override KeyOpAlg::Algorithm getAlgorithmType() {
348+
override KeyOpAlg::AlgorithmType getAlgorithmType() {
351349
if cipher_name_to_type_known(_, super.getAlgorithmName())
352350
then cipher_name_to_type_known(result, super.getAlgorithmName())
353351
else result instanceof KeyOpAlg::TUnknownKeyOperationAlgorithmType
@@ -1249,7 +1247,7 @@ module JCAModel {
12491247
result = super.getRawKdfAlgorithmName().splitAt("WithHmac", 1)
12501248
}
12511249

1252-
override Crypto::TMacType getMacType() { result instanceof Crypto::THMAC }
1250+
override Crypto::MacType getMacType() { result = Crypto::HMAC() }
12531251

12541252
override Crypto::AlgorithmValueConsumer getHmacAlgorithmValueConsumer() { result = this }
12551253

@@ -1487,10 +1485,10 @@ module JCAModel {
14871485

14881486
override string getRawMacAlgorithmName() { result = super.getValue() }
14891487

1490-
override Crypto::TMacType getMacType() {
1488+
override Crypto::MacType getMacType() {
14911489
if mac_name_to_mac_type_known(_, super.getValue())
14921490
then mac_name_to_mac_type_known(result, super.getValue())
1493-
else result instanceof Crypto::TOtherMACType
1491+
else result = Crypto::OtherMacType()
14941492
}
14951493
}
14961494

@@ -1597,15 +1595,18 @@ module JCAModel {
15971595

15981596
override string getRawEllipticCurveName() { result = super.getValue() }
15991597

1600-
override Crypto::TEllipticCurveType getEllipticCurveType() {
1601-
if Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getRawEllipticCurveName(), _, _)
1598+
override Crypto::EllipticCurveFamilyType getEllipticCurveFamilyType() {
1599+
if
1600+
Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getRawEllipticCurveName(), _, _)
16021601
then
1603-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getRawEllipticCurveName(), _, result)
1602+
Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getRawEllipticCurveName(), _,
1603+
result)
16041604
else result = Crypto::OtherEllipticCurveType()
16051605
}
16061606

16071607
override int getKeySize() {
1608-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getRawEllipticCurveName(), result, _)
1608+
Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getRawEllipticCurveName(),
1609+
result, _)
16091610
}
16101611

16111612
EllipticCurveAlgorithmValueConsumer getConsumer() { result = consumer }

0 commit comments

Comments
 (0)