From 60228b266bd9a130e810589abacc2acae9480644 Mon Sep 17 00:00:00 2001 From: Vsevolod Stakhov Date: Fri, 6 Feb 2015 11:37:55 +0000 Subject: [PATCH] Start cryptobox library. --- CMakeLists.txt | 2 +- src/CMakeLists.txt | 1 + src/libcryptobox/CMakeLists.txt | 20 ++++++ src/libcryptobox/cryptobox.c | 62 +++++++++++++++++ src/libcryptobox/cryptobox.h | 119 ++++++++++++++++++++++++++++++++ src/libutil/CMakeLists.txt | 1 + src/libutil/http.c | 1 + src/libutil/util.c | 30 -------- src/libutil/util.h | 7 -- 9 files changed, 205 insertions(+), 38 deletions(-) create mode 100644 src/libcryptobox/CMakeLists.txt create mode 100644 src/libcryptobox/cryptobox.c create mode 100644 src/libcryptobox/cryptobox.h diff --git a/CMakeLists.txt b/CMakeLists.txt index 4bad6643c..39e6373eb 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -278,7 +278,7 @@ ENDMACRO() ############################# CONFIG SECTION ############################################# # Initial set -INCLUDE_DIRECTORIES(src/libutil src/libserver src/libmime src/libstat) +INCLUDE_DIRECTORIES(src/libutil src/libserver src/libmime src/libstat src/libcryptobox) IF(CMAKE_INSTALL_PREFIX) SET(PREFIX ${CMAKE_INSTALL_PREFIX}) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 1c67416ac..d915bf551 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -63,6 +63,7 @@ UNSET(SLAVE_BUILD) # Rspamd core components ADD_SUBDIRECTORY(lua) +ADD_SUBDIRECTORY(libcryptobox) ADD_SUBDIRECTORY(libutil) ADD_SUBDIRECTORY(libserver) ADD_SUBDIRECTORY(libmime) diff --git a/src/libcryptobox/CMakeLists.txt b/src/libcryptobox/CMakeLists.txt new file mode 100644 index 000000000..9d3286cd2 --- /dev/null +++ b/src/libcryptobox/CMakeLists.txt @@ -0,0 +1,20 @@ + + +SET(LIBCRYPTOBOXSRC cryptobox.c) + +ADD_LIBRARY(rspamd-cryptobox ${LINK_TYPE} ${LIBCRYPTOBOXSRC}) +IF(NOT DEBIAN_BUILD) + SET_TARGET_PROPERTIES(rspamd-cryptobox PROPERTIES VERSION ${RSPAMD_VERSION}) +ENDIF(NOT DEBIAN_BUILD) +SET_TARGET_PROPERTIES(rspamd-cryptobox PROPERTIES LINKER_LANGUAGE C COMPILE_FLAGS "-DRSPAMD_LIB") + +IF(CMAKE_COMPILER_IS_GNUCC) +SET_TARGET_PROPERTIES(rspamd-cryptobox PROPERTIES COMPILE_FLAGS "-DRSPAMD_LIB -fno-strict-aliasing") +ENDIF(CMAKE_COMPILER_IS_GNUCC) +TARGET_LINK_LIBRARIES(rspamd-cryptobox ottery) + +IF(NO_SHARED MATCHES "OFF") + INSTALL(TARGETS rspamd-cryptobox + LIBRARY DESTINATION ${LIBDIR} + PUBLIC_HEADER DESTINATION ${INCLUDEDIR}) +ENDIF(NO_SHARED MATCHES "OFF") \ No newline at end of file diff --git a/src/libcryptobox/cryptobox.c b/src/libcryptobox/cryptobox.c new file mode 100644 index 000000000..056368e68 --- /dev/null +++ b/src/libcryptobox/cryptobox.c @@ -0,0 +1,62 @@ +/* Copyright (c) 2015, Vsevolod Stakhov + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL AUTHOR BE LIABLE FOR ANY + * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "cryptobox.h" + +struct rspamd_cryptobox_config { + gboolean has_sse3; + gboolean has_avx; + gboolean has_avx2; +}; + + + +#ifdef HAVE_WEAK_SYMBOLS +__attribute__((weak)) void +_dummy_symbol_to_prevent_lto(void * const pnt, const size_t len) +{ + (void) pnt; + (void) len; +} +#endif + +void +rspamd_explicit_memzero(void * const pnt, const gsize len) +{ +#if defined(HAVE_MEMSET_S) + if (memset_s (pnt, (rsize_t) len, 0, (rsize_t) len) != 0) { + g_assert (0); + } +#elif defined(HAVE_EXPLICIT_BZERO) + explicit_bzero (pnt, len); +#elif defined(HAVE_WEAK_SYMBOLS) + memset (pnt, 0, len); + _dummy_symbol_to_prevent_lto (pnt, len); +#else + volatile unsigned char *pnt_ = (volatile unsigned char *) pnt; + gsize i = (gsize) 0U; + while (i < len) { + pnt_[i++] = 0U; + } +#endif +} diff --git a/src/libcryptobox/cryptobox.h b/src/libcryptobox/cryptobox.h new file mode 100644 index 000000000..af857197a --- /dev/null +++ b/src/libcryptobox/cryptobox.h @@ -0,0 +1,119 @@ +/* Copyright (c) 2015, Vsevolod Stakhov + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL AUTHOR BE LIABLE FOR ANY + * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ +#ifndef CRYPTOBOX_H_ +#define CRYPTOBOX_H_ + +#include "config.h" + +#define rspamd_cryptobox_NONCEBYTES 24 +#define rspamd_cryptobox_PKBYTES 32 +#define rspamd_cryptobox_SKBYTES 32 +#define rspamd_cryptobox_MACBYTES 16 +#define rspamd_cryptobox_NMBYTES 32 + +typedef guchar rspamd_pk_t[rspamd_cryptobox_PKBYTES]; +typedef guchar rspamd_sk_t[rspamd_cryptobox_SKBYTES]; +typedef guchar rspamd_sig_t[rspamd_cryptobox_MACBYTES]; +typedef guchar rspamd_nm_t[rspamd_cryptobox_NMBYTES]; + +struct rspamd_encrypt_segment { + guchar *buf; + gsize len; +}; + +/** + * Init cryptobox library + */ +void rspamd_cryptobox_init (void); + +/** + * Generate new keypair + * @param pk public key buffer + * @param sk secret key buffer + */ +void rspamd_cryptobox_keypair (rspamd_pk_t pk, rspamd_sk_t sk); + +/** + * Encrypt segments of data inplace adding signature to sig afterwards + * @param segments segments of data + * @param cnt count of segments + * @param pk remote pubkey + * @param sk local secret key + * @param sig output signature + */ +void rspamd_cryptobox_encrypt_inplace (struct rspamd_encrypt_segment *segments, + gsize cnt, const rspamd_pk_t pk, const rspamd_sk_t sk, rspamd_sig_t sig); + + +/** + * Decrypt and verify data chunk inplace + * @param data data to decrypt + * @param len lenght of data + * @param pk remote pubkey + * @param sk local privkey + * @param sig signature input + * @return TRUE if input has been verified successfully + */ +gboolean rspamd_cryptobox_decrypt_inplace (guchar *data, gsize len, + const rspamd_pk_t pk, const rspamd_sk_t sk, const rspamd_sig_t sig); + +/** + * Encrypt segments of data inplace adding signature to sig afterwards + * @param segments segments of data + * @param cnt count of segments + * @param pk remote pubkey + * @param sk local secret key + * @param sig output signature + */ +void rspamd_cryptobox_encrypt_nm_inplace (struct rspamd_encrypt_segment *segments, + gsize cnt, const rspamd_nm_t nm, rspamd_sig_t sig); + + +/** + * Decrypt and verify data chunk inplace + * @param data data to decrypt + * @param len lenght of data + * @param pk remote pubkey + * @param sk local privkey + * @param sig signature input + * @return TRUE if input has been verified successfully + */ +gboolean rspamd_cryptobox_decrypt_nm_inplace (guchar *data, gsize len, + const rspamd_nm_t nm, const rspamd_sig_t sig); + +/** + * Generate shared secret from local sk and remote pk + * @param nm shared secret + * @param pk remote pubkey + * @param sk local privkey + */ +void rspamd_cryptobox_nm (rspamd_nm_t nm, rspamd_pk_t pk, rspamd_sk_t sk); + +/** + * Securely clear the buffer specified + * @param buf buffer to zero + * @param buflen length of buffer + */ +void rspamd_explicit_memzero (void * const buf, gsize buflen); + +#endif /* CRYPTOBOX_H_ */ diff --git a/src/libutil/CMakeLists.txt b/src/libutil/CMakeLists.txt index f87012d2a..ae650f55e 100644 --- a/src/libutil/CMakeLists.txt +++ b/src/libutil/CMakeLists.txt @@ -35,6 +35,7 @@ TARGET_LINK_LIBRARIES(rspamd-util xxhash) TARGET_LINK_LIBRARIES(rspamd-util siphash) TARGET_LINK_LIBRARIES(rspamd-util blake2) TARGET_LINK_LIBRARIES(rspamd-util tweetnacl) +TARGET_LINK_LIBRARIES(rspamd-util rspamd-cryptobox) TARGET_LINK_LIBRARIES(rspamd-util rdns) IF(OPENSSL_FOUND) TARGET_LINK_LIBRARIES(rspamd-util ${OPENSSL_LIBRARIES}) diff --git a/src/libutil/http.c b/src/libutil/http.c index 90fbe8e41..d3fc43bee 100644 --- a/src/libutil/http.c +++ b/src/libutil/http.c @@ -32,6 +32,7 @@ #include "blake2.h" #include "ottery.h" #include "keypair_private.h" +#include "cryptobox.h" #include struct rspamd_http_connection_private { diff --git a/src/libutil/util.c b/src/libutil/util.c index 465dd92c6..dbc34733e 100644 --- a/src/libutil/util.c +++ b/src/libutil/util.c @@ -2207,33 +2207,3 @@ randombytes (guchar *buf, guint64 len) { ottery_rand_bytes (buf, (size_t)len); } - -#ifdef HAVE_WEAK_SYMBOLS -__attribute__((weak)) void -_dummy_symbol_to_prevent_lto(void * const pnt, const size_t len) -{ - (void) pnt; - (void) len; -} -#endif - -void -rspamd_explicit_memzero(void * const pnt, const gsize len) -{ -#if defined(HAVE_MEMSET_S) - if (memset_s (pnt, (rsize_t) len, 0, (rsize_t) len) != 0) { - g_assert (0); - } -#elif defined(HAVE_EXPLICIT_BZERO) - explicit_bzero (pnt, len); -#elif defined(HAVE_WEAK_SYMBOLS) - memset (pnt, 0, len); - _dummy_symbol_to_prevent_lto (pnt, len); -#else - volatile unsigned char *pnt_ = (volatile unsigned char *) pnt; - gsize i = (gsize) 0U; - while (i < len) { - pnt_[i++] = 0U; - } -#endif -} diff --git a/src/libutil/util.h b/src/libutil/util.h index 704bc3d63..fd584938f 100644 --- a/src/libutil/util.h +++ b/src/libutil/util.h @@ -434,11 +434,4 @@ gchar * rspamd_encode_base32 (const guchar *in, gsize inlen); */ guchar* rspamd_decode_base32 (const gchar *in, gsize inlen, gsize *outlen); -/** - * Securely clear the buffer specified - * @param buf - * @param buflen - */ -void rspamd_explicit_memzero (void * const buf, gsize buflen); - #endif -- 2.39.5