Skip to content

Crypto: Improve literal filtering for OpenSSL for algorithms and generic sources #19553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
May 22, 2025
Merged

Crypto: Improve literal filtering for OpenSSL for algorithms and generic sources #19553

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a36fd2c
Crypto: Advanced literal filtering for OpenSSL, used for both unknown…
bdrodes May 21, 2025
100045d
Crypto: optimizing out the "getPossibleNidFromLiteral" predicate, and…
bdrodes May 21, 2025
09170e5
Crypto: Making generic literal filter more explicit that it is for fi…
bdrodes May 22, 2025
a5b57d3
Merge branch 'main' into generic_constant_filtering
bdrodes May 22, 2025
570fdeb
Crypto: Code Cleanup (+1 squashed commits)
bdrodes May 22, 2025
ca1d4e2
Crypto: Separating out an IntLiteral class so it is clearer that some…
bdrodes May 22, 2025
28f4824
Crypto: Adding signature constant support, and fixing key exchange an…
bdrodes May 22, 2025
007683f
Crypto: Simplifying constant comparisons.
bdrodes May 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,15 @@
}
}

class KnownOpenSSLSignatureAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {

Check warning

Code scanning / CodeQL

Acronyms should be PascalCase/camelCase. Warning

Acronyms in KnownOpenSSLSignatureAlgorithmConstant should be PascalCase/camelCase.
string algType;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should not be a field if it's not the result of or used in a member predicate.


KnownOpenSSLSignatureAlgorithmConstant() {
resolveAlgorithmFromExpr(this, _, algType) and
algType.matches("SIGNATURE")
}
}

/**
* Resolves a call to a 'direct algorithm getter', e.g., EVP_MD5()
* This approach to fetching algorithms was used in OpenSSL 1.0.2.
Expand Down Expand Up @@ -263,8 +272,12 @@
or
name = "ed25519" and nid = 1087 and normalized = "ED25519" and algType = "ELLIPTIC_CURVE"
or
name = "ed25519" and nid = 1087 and normalized = "ED25519" and algType = "SIGNATURE"
or
name = "ed448" and nid = 1088 and normalized = "ED448" and algType = "ELLIPTIC_CURVE"
or
name = "ed448" and nid = 1088 and normalized = "ED448" and algType = "SIGNATURE"
or
name = "md2" and nid = 3 and normalized = "MD2" and algType = "HASH"
or
name = "sha" and nid = 41 and normalized = "SHA" and algType = "HASH"
Expand Down Expand Up @@ -1684,8 +1697,12 @@
or
name = "x448" and nid = 1035 and normalized = "X448" and algType = "ELLIPTIC_CURVE"
or
name = "x448" and nid = 1035 and normalized = "X448" and algType = "KEY_EXCHANGE"
or
name = "x25519" and nid = 1034 and normalized = "X25519" and algType = "ELLIPTIC_CURVE"
or
name = "x25519" and nid = 1034 and normalized = "X25519" and algType = "KEY_EXCHANGE"
or
name = "authecdsa" and nid = 1047 and normalized = "ECDSA" and algType = "SIGNATURE"
or
name = "authgost01" and nid = 1050 and normalized = "GOST" and algType = "SYMMETRIC_ENCRYPTION"
Expand Down
Loading