From 5802626437422a7bd18fc00c57688b5ba665e019 Mon Sep 17 00:00:00 2001 From: gberkes Date: Thu, 28 Mar 2024 20:12:30 +0100 Subject: [PATCH 01/66] Deleted redundant code in 'ModSecurity::serverLog(...)'. --- src/modsecurity.cc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/modsecurity.cc b/src/modsecurity.cc index 854ec31e..809b5c3e 100644 --- a/src/modsecurity.cc +++ b/src/modsecurity.cc @@ -210,10 +210,6 @@ void ModSecurity::serverLog(void *data, std::shared_ptr rm) { if (m_logProperties & RuleMessageLogProperty) { const void *a = static_cast(rm.get()); - if (m_logProperties & IncludeFullHighlightLogProperty) { - m_logCb(data, a); - return; - } m_logCb(data, a); return; } From 7c4dcdfa4b80917588fddd342904955c471730af Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Fri, 29 Mar 2024 16:32:34 +0100 Subject: [PATCH 02/66] Changed 'euqal_range()' + loop by 'find()' in resolveFirst() methods --- src/anchored_set_variable.cc | 9 +++++---- src/collection/backend/in_memory-per_process.cc | 14 +++++++------- 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/src/anchored_set_variable.cc b/src/anchored_set_variable.cc index ec087775..2a1dd6c9 100644 --- a/src/anchored_set_variable.cc +++ b/src/anchored_set_variable.cc @@ -109,12 +109,13 @@ void AnchoredSetVariable::resolve(const std::string &key, std::unique_ptr AnchoredSetVariable::resolveFirst( const std::string &key) { - auto range = equal_range(key); - for (auto it = range.first; it != range.second; ++it) { - std::unique_ptr b(new std::string()); - b->assign(it->second->getValue()); + + if (auto search = this->find(key); search != this->end()) { + auto b = std::make_unique(); + b->assign(search->second->getValue()); return b; } + return nullptr; } diff --git a/src/collection/backend/in_memory-per_process.cc b/src/collection/backend/in_memory-per_process.cc index 59aeb105..a4ca5e2e 100644 --- a/src/collection/backend/in_memory-per_process.cc +++ b/src/collection/backend/in_memory-per_process.cc @@ -67,13 +67,13 @@ bool InMemoryPerProcess::storeOrUpdateFirst(const std::string &key, bool InMemoryPerProcess::updateFirst(const std::string &key, const std::string &value) { pthread_mutex_lock(&m_lock); - auto range = this->equal_range(key); - for (auto it = range.first; it != range.second; ++it) { - it->second.setValue(value); + if (auto search = this->find(key); search != this->end()) { + search->second.setValue(value); pthread_mutex_unlock(&m_lock); return true; } + pthread_mutex_unlock(&m_lock); return false; } @@ -97,11 +97,11 @@ void InMemoryPerProcess::delIfExpired(const std::string& key) { void InMemoryPerProcess::setExpiry(const std::string& key, int32_t expiry_seconds) { pthread_mutex_lock(&m_lock); - auto range = this->equal_range(key); - for (auto it = range.first; it != range.second; ++it) { - it->second.setExpiry(expiry_seconds); + + if (auto search = this->find(key); search != this->end()) { + search->second.setExpiry(expiry_seconds); pthread_mutex_unlock(&m_lock); - return; + return; } // We allow an expiry value to be set for a key that has not (yet) had a value set. From 16d0df0ff9598cedec29330944e09151dba8fea2 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Sun, 31 Mar 2024 14:14:45 +0200 Subject: [PATCH 03/66] Optimized variable handling --- src/anchored_set_variable.cc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/anchored_set_variable.cc b/src/anchored_set_variable.cc index 2a1dd6c9..1931d6cd 100644 --- a/src/anchored_set_variable.cc +++ b/src/anchored_set_variable.cc @@ -111,9 +111,7 @@ std::unique_ptr AnchoredSetVariable::resolveFirst( const std::string &key) { if (auto search = this->find(key); search != this->end()) { - auto b = std::make_unique(); - b->assign(search->second->getValue()); - return b; + return std::make_unique(search->second->getValue()); } return nullptr; From 30fe6f935bdbaf0b5f6b632c7c874a9dbe8c737e Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Mon, 22 Apr 2024 10:23:28 -0300 Subject: [PATCH 04/66] fix(rbl): typo in rbl check selector Signed-off-by: Felipe Zipitria --- src/operators/rbl.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/operators/rbl.h b/src/operators/rbl.h index f002d532..a35a6a7b 100644 --- a/src/operators/rbl.h +++ b/src/operators/rbl.h @@ -71,9 +71,9 @@ class Rbl : public Operator { m_demandsPassword = true; m_provider = RblProvider::httpbl; } else if (m_service.find("uribl.com") != std::string::npos) { - m_provider = RblProvider::httpbl; + m_provider = RblProvider::uribl; } else if (m_service.find("spamhaus.org") != std::string::npos) { - m_provider = RblProvider::httpbl; + m_provider = RblProvider::spamhaus; } } bool evaluate(Transaction *transaction, RuleWithActions *rule, From 7e085ffb6e70cbd394c1065489849a3eca778b0f Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Mon, 22 Apr 2024 15:56:40 -0300 Subject: [PATCH 05/66] fix: update submodule url Signed-off-by: Felipe Zipitria --- .gitmodules | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitmodules b/.gitmodules index e4cf1b8d..9a5c7116 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,9 +1,9 @@ [submodule "test/test-cases/secrules-language-tests"] path = test/test-cases/secrules-language-tests - url = https://github.com/SpiderLabs/secrules-language-tests + url = https://github.com/owasp-modsecurity/secrules-language-tests [submodule "others/libinjection"] path = others/libinjection url = https://github.com/libinjection/libinjection.git [submodule "bindings/python"] path = bindings/python - url = https://github.com/SpiderLabs/ModSecurity-Python-bindings.git + url = https://github.com/owasp-modsecurity/ModSecurity-Python-bindings.git From 4288f5a009b3c64c9baf23637efd2837ff3bd8dc Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sat, 27 Apr 2024 23:25:53 -0300 Subject: [PATCH 06/66] Enable inline suppressions in cppcheck --- Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile.am b/Makefile.am index 3a6b23e5..501fcfdf 100644 --- a/Makefile.am +++ b/Makefile.am @@ -59,6 +59,7 @@ cppcheck: @cppcheck -U YYSTYPE -U MBEDTLS_MD5_ALT -U MBEDTLS_SHA1_ALT \ -D MS_CPPCHECK_DISABLED_FOR_PARSER -U YY_USER_INIT \ --suppressions-list=./test/cppcheck_suppressions.txt \ + --inline-suppr \ --enable=warning,style,performance,portability,unusedFunction,missingInclude \ --inconclusive \ --template="warning: {file},{line},{severity},{id},{message}" \ From b872f11f68c09d9c252fba043901e3b5c087c0dd Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 11:42:05 -0300 Subject: [PATCH 07/66] Fixed memory leak in examples/reading_logs_via_rule_message --- .../reading_logs_via_rule_message.h | 14 ++++---------- test/cppcheck_suppressions.txt | 1 - 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h index 29e4d662..3fb6ef1e 100644 --- a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h +++ b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h @@ -130,29 +130,25 @@ class ReadingLogsViaRuleMessage { struct data_ms dms; void *status; - modsecurity::ModSecurity *modsec; - modsecurity::RulesSet *rules; - - modsec = new modsecurity::ModSecurity(); + auto modsec = std::make_unique(); modsec->setConnectorInformation("ModSecurity-test v0.0.1-alpha" \ " (ModSecurity test)"); modsec->setServerLogCb(logCb, modsecurity::RuleMessageLogProperty | modsecurity::IncludeFullHighlightLogProperty); - rules = new modsecurity::RulesSet(); + auto rules = std::make_unique(); if (rules->loadFromUri(m_rules.c_str()) < 0) { std::cout << "Problems loading the rules..." << std::endl; std::cout << rules->m_parserError.str() << std::endl; return -1; } - dms.modsec = modsec; - dms.rules = rules; + dms.modsec = modsec.get(); + dms.rules = rules.get(); for (i = 0; i < NUM_THREADS; i++) { pthread_create(&threads[i], NULL, process_request, reinterpret_cast(&dms)); - // process_request((void *)&dms); } usleep(10000); @@ -162,8 +158,6 @@ class ReadingLogsViaRuleMessage { std::cout << "Main: completed thread id :" << i << std::endl; } - delete rules; - delete modsec; return 0; } diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index ebbc665e..77479be2 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -101,5 +101,4 @@ stlcstrStream uselessCallsSubstr // Examples -memleak:examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h:147 memleak:examples/using_bodies_in_chunks/simple_request.cc From fde9d279b02f928a09bea5bb3840bedadf905d15 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sat, 27 Apr 2024 18:00:28 -0300 Subject: [PATCH 08/66] Removed unnecessary cppcheck suppression and r-value reference as copy should be avoidded by RVO --- src/modsecurity.cc | 2 +- test/cppcheck_suppressions.txt | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/src/modsecurity.cc b/src/modsecurity.cc index 854ec31e..4b48b799 100644 --- a/src/modsecurity.cc +++ b/src/modsecurity.cc @@ -202,7 +202,7 @@ void ModSecurity::serverLog(void *data, std::shared_ptr rm) { } if (m_logProperties & TextLogProperty) { - std::string &&d = rm->log(); + auto d = rm->log(); const void *a = static_cast(d.c_str()); m_logCb(data, a); return; diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index 77479be2..6668c6f2 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -44,12 +44,10 @@ functionStatic:src/engine/lua.h:71 functionConst:src/utils/geo_lookup.h:49 useInitializationList:src/operators/rbl.h:69 constStatement:test/common/modsecurity_test.cc:82 -danglingTemporaryLifetime:src/modsecurity.cc:206 functionStatic:src/operators/geo_lookup.h:35 duplicateBreak:src/operators/validate_utf8_encoding.cc syntaxError:src/transaction.cc:62 noConstructor:src/variables/variable.h:152 -danglingTempReference:src/modsecurity.cc:206 knownConditionTrueFalse:src/operators/validate_url_encoding.cc:77 knownConditionTrueFalse:src/operators/verify_svnr.cc:87 rethrowNoCurrentException:headers/modsecurity/transaction.h:313 From 94b68b2514053836e431c15128b4e7f3ade2d235 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 12:01:20 -0300 Subject: [PATCH 09/66] Minor updates to simplify code and remove cppcheck suppressions --- test/common/modsecurity_test.cc | 13 ++++++------- test/common/modsecurity_test.h | 4 ++-- test/cppcheck_suppressions.txt | 3 --- 3 files changed, 8 insertions(+), 12 deletions(-) diff --git a/test/common/modsecurity_test.cc b/test/common/modsecurity_test.cc index 5b63580f..22757191 100644 --- a/test/common/modsecurity_test.cc +++ b/test/common/modsecurity_test.cc @@ -46,7 +46,7 @@ std::string ModSecurityTest::header() { } template -bool ModSecurityTest::load_test_json(std::string file) { +bool ModSecurityTest::load_test_json(const std::string &file) { char errbuf[1024]; yajl_val node; @@ -76,13 +76,12 @@ bool ModSecurityTest::load_test_json(std::string file) { u->filename = file; if (this->count(u->filename + ":" + u->name) == 0) { - std::vector *vector = new std::vector; - vector->push_back(u); + auto vec = new std::vector; + vec->push_back(u); std::string filename(u->filename + ":" + u->name); - std::pair*> a(filename, vector); - this->insert(a); + this->insert({filename, vec}); } else { - std::vector *vec = this->at(u->filename + ":" + u->name); + auto vec = this->at(u->filename + ":" + u->name); vec->push_back(u); } } @@ -95,7 +94,7 @@ bool ModSecurityTest::load_test_json(std::string file) { template std::pair>* -ModSecurityTest::load_tests(std::string path) { +ModSecurityTest::load_tests(const std::string &path) { DIR *dir; struct dirent *ent; struct stat buffer; diff --git a/test/common/modsecurity_test.h b/test/common/modsecurity_test.h index 83e06ab8..79a168f7 100644 --- a/test/common/modsecurity_test.h +++ b/test/common/modsecurity_test.h @@ -39,8 +39,8 @@ template class ModSecurityTest : std::string header(); void cmd_options(int, char **); std::pair>* load_tests(); - std::pair>* load_tests(std::string path); - bool load_test_json(std::string); + std::pair>* load_tests(const std::string &path); + bool load_test_json(const std::string &file); std::string target; bool verbose = false; diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index 6668c6f2..15234c70 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -43,7 +43,6 @@ functionStatic:src/engine/lua.h:70 functionStatic:src/engine/lua.h:71 functionConst:src/utils/geo_lookup.h:49 useInitializationList:src/operators/rbl.h:69 -constStatement:test/common/modsecurity_test.cc:82 functionStatic:src/operators/geo_lookup.h:35 duplicateBreak:src/operators/validate_utf8_encoding.cc syntaxError:src/transaction.cc:62 @@ -55,8 +54,6 @@ rethrowNoCurrentException:src/rule_with_actions.cc:127 ctunullpointer:src/rule_with_actions.cc:244 ctunullpointer:src/rule_with_operator.cc:135 ctunullpointer:src/rule_with_operator.cc:95 -passedByValue:test/common/modsecurity_test.cc:49 -passedByValue:test/common/modsecurity_test.cc:98 unreadVariable:src/rule_with_operator.cc:219 uninitvar:src/operators/verify_cpf.cc:77 From 0cd2f459f319eeec1f53545146d4a1a2ad2dc8d2 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 12:43:02 -0300 Subject: [PATCH 10/66] Address cppcheck suppressions in lmdb --- src/collection/backend/lmdb.cc | 2 +- src/collection/backend/lmdb.h | 2 +- test/cppcheck_suppressions.txt | 3 --- 3 files changed, 2 insertions(+), 5 deletions(-) diff --git a/src/collection/backend/lmdb.cc b/src/collection/backend/lmdb.cc index 9197fda8..040ebdff 100644 --- a/src/collection/backend/lmdb.cc +++ b/src/collection/backend/lmdb.cc @@ -659,7 +659,7 @@ MDB_dbi* MDBEnvProvider::GetDBI() { return &m_dbi; } -bool MDBEnvProvider::isValid() { +bool MDBEnvProvider::isValid() const { return valid; } diff --git a/src/collection/backend/lmdb.h b/src/collection/backend/lmdb.h index fb88b003..15c4fa9f 100644 --- a/src/collection/backend/lmdb.h +++ b/src/collection/backend/lmdb.h @@ -83,7 +83,7 @@ class MDBEnvProvider { } MDB_env* GetEnv(); MDB_dbi* GetDBI(); - bool isValid(); + bool isValid() const; ~MDBEnvProvider(); private: diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index 15234c70..bd467b6f 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -59,9 +59,6 @@ unreadVariable:src/rule_with_operator.cc:219 uninitvar:src/operators/verify_cpf.cc:77 uninitvar:src/operators/verify_svnr.cc:67 -functionConst:src/collection/backend/lmdb.h:86 -unusedLabel:src/collection/backend/lmdb.cc:297 - variableScope:src/operators/rx.cc variableScope:src/operators/rx_global.cc From cd2dded659ae965d798653688dd6f52943870918 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 12:50:58 -0300 Subject: [PATCH 11/66] Removed unnecessary break after return --- src/operators/validate_utf8_encoding.cc | 5 ----- test/cppcheck_suppressions.txt | 1 - 2 files changed, 6 deletions(-) diff --git a/src/operators/validate_utf8_encoding.cc b/src/operators/validate_utf8_encoding.cc index e95061af..3e17686f 100644 --- a/src/operators/validate_utf8_encoding.cc +++ b/src/operators/validate_utf8_encoding.cc @@ -132,7 +132,6 @@ bool ValidateUtf8Encoding::evaluate(Transaction *transaction, RuleWithActions *r std::to_string(i) + "\"]"); } return true; - break; case UNICODE_ERROR_INVALID_ENCODING : if (transaction) { ms_dbg_a(transaction, 8, "Invalid UTF-8 encoding: " @@ -142,7 +141,6 @@ bool ValidateUtf8Encoding::evaluate(Transaction *transaction, RuleWithActions *r logOffset(ruleMessage, i, str.size()); } return true; - break; case UNICODE_ERROR_OVERLONG_CHARACTER : if (transaction) { ms_dbg_a(transaction, 8, "Invalid UTF-8 encoding: " @@ -152,7 +150,6 @@ bool ValidateUtf8Encoding::evaluate(Transaction *transaction, RuleWithActions *r logOffset(ruleMessage, i, str.size()); } return true; - break; case UNICODE_ERROR_RESTRICTED_CHARACTER : if (transaction) { ms_dbg_a(transaction, 8, "Invalid UTF-8 encoding: " @@ -162,7 +159,6 @@ bool ValidateUtf8Encoding::evaluate(Transaction *transaction, RuleWithActions *r logOffset(ruleMessage, i, str.size()); } return true; - break; case UNICODE_ERROR_DECODING_ERROR : if (transaction) { ms_dbg_a(transaction, 8, "Error validating UTF-8 decoding " @@ -171,7 +167,6 @@ bool ValidateUtf8Encoding::evaluate(Transaction *transaction, RuleWithActions *r logOffset(ruleMessage, i, str.size()); } return true; - break; } if (rc <= 0) { diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index bd467b6f..bd5e6bf8 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -44,7 +44,6 @@ functionStatic:src/engine/lua.h:71 functionConst:src/utils/geo_lookup.h:49 useInitializationList:src/operators/rbl.h:69 functionStatic:src/operators/geo_lookup.h:35 -duplicateBreak:src/operators/validate_utf8_encoding.cc syntaxError:src/transaction.cc:62 noConstructor:src/variables/variable.h:152 knownConditionTrueFalse:src/operators/validate_url_encoding.cc:77 From 0c38023b2114bc804908f74bf2fe38c568183b6a Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 13:08:39 -0300 Subject: [PATCH 12/66] Removed unmatchedSuppression entries --- test/cppcheck_suppressions.txt | 2 -- 1 file changed, 2 deletions(-) diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index bd5e6bf8..c3a4cf49 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -32,9 +32,7 @@ invalidScanfArgType_int:src/rules_set_properties.cc:102 // // ModSecurity v3 code... // -unmatchedSuppression:src/utils/geo_lookup.cc:82 useInitializationList:src/utils/shared_files.h:87 -unmatchedSuppression:src/utils/msc_tree.cc functionStatic:headers/modsecurity/transaction.h:408 duplicateBranch:src/audit_log/audit_log.cc:226 unreadVariable:src/request_body_processor/multipart.cc:435 From 4aad8e0d061e0f6303c765d1b6605abba6985e8b Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 11:34:37 -0300 Subject: [PATCH 13/66] Inline cppcheck suppressions --- headers/modsecurity/transaction.h | 2 +- src/engine/lua.h | 4 ++-- src/operators/geo_lookup.h | 1 + src/operators/rbl.h | 9 +++++---- src/operators/validate_url_encoding.cc | 2 +- src/operators/verify_cpf.cc | 2 +- src/operators/verify_svnr.cc | 4 ++-- src/rule_with_actions.cc | 2 +- src/rule_with_operator.cc | 3 ++- src/rules_set_properties.cc | 4 ++-- test/cppcheck_suppressions.txt | 17 ----------------- 11 files changed, 18 insertions(+), 32 deletions(-) diff --git a/headers/modsecurity/transaction.h b/headers/modsecurity/transaction.h index b0dc4b71..83d85012 100644 --- a/headers/modsecurity/transaction.h +++ b/headers/modsecurity/transaction.h @@ -405,7 +405,7 @@ class Transaction : public TransactionAnchoredVariables, public TransactionSecMa size_t getRequestBodyLength(); #ifndef NO_LOGS - void debug(int, const std::string&) const; + void debug(int, const std::string &) const; // cppcheck-suppress functionStatic #endif void serverLog(std::shared_ptr rm); diff --git a/src/engine/lua.h b/src/engine/lua.h index 9a678fd7..a33f28f8 100644 --- a/src/engine/lua.h +++ b/src/engine/lua.h @@ -67,8 +67,8 @@ class Lua { public: Lua() { } - bool load(const std::string &script, std::string *err); - int run(Transaction *t, const std::string &str=""); + bool load(const std::string &script, std::string *err); // cppcheck-suppress functionStatic ; triggered when compiling without LUA + int run(Transaction *t, const std::string &str = ""); // cppcheck-suppress functionStatic ; triggered when compiling without LUA static bool isCompatible(const std::string &script, Lua *l, std::string *error); #ifdef WITH_LUA diff --git a/src/operators/geo_lookup.h b/src/operators/geo_lookup.h index e0193782..187a2f31 100644 --- a/src/operators/geo_lookup.h +++ b/src/operators/geo_lookup.h @@ -32,6 +32,7 @@ class GeoLookup : public Operator { bool evaluate(Transaction *transaction, const std::string &exp) override; protected: + // cppcheck-suppress functionStatic bool debug(Transaction *transaction, int x, const std::string &a) { ms_dbg_a(transaction, x, a); return true; diff --git a/src/operators/rbl.h b/src/operators/rbl.h index a35a6a7b..fb57d2d9 100644 --- a/src/operators/rbl.h +++ b/src/operators/rbl.h @@ -66,10 +66,11 @@ class Rbl : public Operator { m_demandsPassword(false), m_provider(RblProvider::UnknownProvider), Operator("Rbl", std::move(param)) { - m_service = m_string->evaluate(); - if (m_service.find("httpbl.org") != std::string::npos) { - m_demandsPassword = true; - m_provider = RblProvider::httpbl; + m_service = m_string->evaluate(); // cppcheck-suppress useInitializationList + if (m_service.find("httpbl.org") != std::string::npos) + { + m_demandsPassword = true; + m_provider = RblProvider::httpbl; } else if (m_service.find("uribl.com") != std::string::npos) { m_provider = RblProvider::uribl; } else if (m_service.find("spamhaus.org") != std::string::npos) { diff --git a/src/operators/validate_url_encoding.cc b/src/operators/validate_url_encoding.cc index 20a86eb6..502aa3d4 100644 --- a/src/operators/validate_url_encoding.cc +++ b/src/operators/validate_url_encoding.cc @@ -74,7 +74,7 @@ bool ValidateUrlEncoding::evaluate(Transaction *transaction, RuleWithActions *ru bool res = false; if (input.empty() == true) { - return res; + return res; // cppcheck-suppress knownConditionTrueFalse } int rc = validate_url_encoding(input.c_str(), input.size(), &offset); diff --git a/src/operators/verify_cpf.cc b/src/operators/verify_cpf.cc index 778584db..1dcf1844 100644 --- a/src/operators/verify_cpf.cc +++ b/src/operators/verify_cpf.cc @@ -74,7 +74,7 @@ bool VerifyCPF::verify(const char *cpfnumber, int len) { c = cpf_len; for (i = 0; i < 9; i++) { - sum += (cpf[i] * --c); + sum += (cpf[i] * --c); // cppcheck-suppress uninitvar } factor = (sum % cpf_len); diff --git a/src/operators/verify_svnr.cc b/src/operators/verify_svnr.cc index 248e6b4e..87834dd4 100644 --- a/src/operators/verify_svnr.cc +++ b/src/operators/verify_svnr.cc @@ -64,7 +64,7 @@ bool VerifySVNR::verify(const char *svnrnumber, int len) { } //Laufnummer mit 3, 7, 9 //Geburtsdatum mit 5, 8, 4, 2, 1, 6 - sum = svnr[0] * 3 + svnr[1] * 7 + svnr[2] * 9 + svnr[4] * 5 + svnr[5] * 8 + svnr[6] * 4 + svnr[7] * 2 + svnr[8] * 1 + svnr[9] * 6; + sum = svnr[0] * 3 + svnr[1] * 7 + svnr[2] * 9 + svnr[4] * 5 + svnr[5] * 8 + svnr[6] * 4 + svnr[7] * 2 + svnr[8] * 1 + svnr[9] * 6; // cppcheck-suppress uninitvar sum %= 11; if(sum == 10){ sum = 0; @@ -84,7 +84,7 @@ bool VerifySVNR::evaluate(Transaction *t, RuleWithActions *rule, int i; if (m_param.empty()) { - return is_svnr; + return is_svnr; // cppcheck-suppress knownConditionTrueFalse } for (i = 0; i < input.size() - 1 && is_svnr == false; i++) { diff --git a/src/rule_with_actions.cc b/src/rule_with_actions.cc index 04ee219c..7c9471c1 100644 --- a/src/rule_with_actions.cc +++ b/src/rule_with_actions.cc @@ -241,7 +241,7 @@ void RuleWithActions::executeActionsAfterFullMatch(Transaction *trans, bool containsBlock, std::shared_ptr ruleMessage) { bool disruptiveAlreadyExecuted = false; - for (auto &a : trans->m_rules->m_defaultActions[getPhase()]) { + for (auto &a : trans->m_rules->m_defaultActions[getPhase()]) { // cppcheck-suppress ctunullpointer if (a.get()->action_kind != actions::Action::RunTimeOnlyIfMatchKind) { continue; } diff --git a/src/rule_with_operator.cc b/src/rule_with_operator.cc index 21d93628..d308443a 100644 --- a/src/rule_with_operator.cc +++ b/src/rule_with_operator.cc @@ -92,6 +92,7 @@ void RuleWithOperator::updateMatchedVars(Transaction *trans, const std::string & void RuleWithOperator::cleanMatchedVars(Transaction *trans) { ms_dbg_a(trans, 9, "Matched vars cleaned."); + // cppcheck-suppress ctunullpointer trans->m_variableMatchedVar.unset(); trans->m_variableMatchedVars.unset(); trans->m_variableMatchedVarName.unset(); @@ -132,7 +133,7 @@ bool RuleWithOperator::executeOperatorAt(Transaction *trans, const std::string & void RuleWithOperator::getVariablesExceptions(Transaction *t, variables::Variables *exclusion, variables::Variables *addition) { - for (auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_tag) { + for (auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_tag) { // cppcheck-suppress ctunullpointer if (containsTag(*a.first.get(), t) == false) { continue; } diff --git a/src/rules_set_properties.cc b/src/rules_set_properties.cc index ffb37e76..075e3e87 100644 --- a/src/rules_set_properties.cc +++ b/src/rules_set_properties.cc @@ -98,8 +98,8 @@ void ConfigUnicodeMap::loadConfig(std::string f, double configCodePage, if (mapping != NULL) { ucode = strtok_r(mapping, ":", &hmap); - sscanf(ucode, "%x", &code); - sscanf(hmap, "%x", &Map); + sscanf(ucode, "%x", &code); // cppcheck-suppress invalidScanfArgType_int + sscanf(hmap, "%x", &Map); // cppcheck-suppress invalidScanfArgType_int if (code >= 0 && code <= 65535) { driver->m_unicodeMapTable.m_unicodeMapTable->change(code, Map); } diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index c3a4cf49..be29218f 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -25,36 +25,19 @@ shiftNegative:src/utils/msc_tree.cc *:src/utils/acmp.cc *:src/utils/msc_tree.cc -invalidScanfArgType_int:src/rules_set_properties.cc:101 -invalidScanfArgType_int:src/rules_set_properties.cc:102 // // ModSecurity v3 code... // useInitializationList:src/utils/shared_files.h:87 -functionStatic:headers/modsecurity/transaction.h:408 duplicateBranch:src/audit_log/audit_log.cc:226 unreadVariable:src/request_body_processor/multipart.cc:435 stlcstrParam:src/audit_log/writer/parallel.cc:145 -functionStatic:src/engine/lua.h:70 -functionStatic:src/engine/lua.h:71 -functionConst:src/utils/geo_lookup.h:49 -useInitializationList:src/operators/rbl.h:69 -functionStatic:src/operators/geo_lookup.h:35 syntaxError:src/transaction.cc:62 noConstructor:src/variables/variable.h:152 -knownConditionTrueFalse:src/operators/validate_url_encoding.cc:77 -knownConditionTrueFalse:src/operators/verify_svnr.cc:87 rethrowNoCurrentException:headers/modsecurity/transaction.h:313 rethrowNoCurrentException:src/rule_with_actions.cc:127 -ctunullpointer:src/rule_with_actions.cc:244 -ctunullpointer:src/rule_with_operator.cc:135 -ctunullpointer:src/rule_with_operator.cc:95 -unreadVariable:src/rule_with_operator.cc:219 - -uninitvar:src/operators/verify_cpf.cc:77 -uninitvar:src/operators/verify_svnr.cc:67 variableScope:src/operators/rx.cc variableScope:src/operators/rx_global.cc From 7a9c0ab15fcb315b8976f3f1c4476e79c11b2e51 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 14:36:18 -0300 Subject: [PATCH 14/66] Removed unused suppresion and avoid copy of logPath --- src/audit_log/writer/parallel.cc | 2 +- test/cppcheck_suppressions.txt | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/src/audit_log/writer/parallel.cc b/src/audit_log/writer/parallel.cc index 0a9777bf..e42d7871 100644 --- a/src/audit_log/writer/parallel.cc +++ b/src/audit_log/writer/parallel.cc @@ -118,7 +118,7 @@ bool Parallel::write(Transaction *transaction, int parts, std::string *error) { log = transaction->toOldAuditLogFormat(parts, "-" + boundary + "--"); } - std::string logPath = m_audit->m_storage_dir; + const auto &logPath = m_audit->m_storage_dir; fileName = logPath + fileName + "-" + *transaction->m_id.get(); if (logPath.empty()) { diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index be29218f..a1004873 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -33,7 +33,6 @@ shiftNegative:src/utils/msc_tree.cc useInitializationList:src/utils/shared_files.h:87 duplicateBranch:src/audit_log/audit_log.cc:226 unreadVariable:src/request_body_processor/multipart.cc:435 -stlcstrParam:src/audit_log/writer/parallel.cc:145 syntaxError:src/transaction.cc:62 noConstructor:src/variables/variable.h:152 rethrowNoCurrentException:headers/modsecurity/transaction.h:313 From 95ce3a7db471bc39d4299c0fcec23a8edecea480 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 14:37:56 -0300 Subject: [PATCH 15/66] Removed unused suppressions --- test/cppcheck_suppressions.txt | 4 ---- 1 file changed, 4 deletions(-) diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index a1004873..7f7c4526 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -31,10 +31,6 @@ shiftNegative:src/utils/msc_tree.cc // ModSecurity v3 code... // useInitializationList:src/utils/shared_files.h:87 -duplicateBranch:src/audit_log/audit_log.cc:226 -unreadVariable:src/request_body_processor/multipart.cc:435 -syntaxError:src/transaction.cc:62 -noConstructor:src/variables/variable.h:152 rethrowNoCurrentException:headers/modsecurity/transaction.h:313 rethrowNoCurrentException:src/rule_with_actions.cc:127 From 9f5dc200ba28e7b729ddfc3621e6cb750eef3c32 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Mon, 29 Apr 2024 22:28:42 -0300 Subject: [PATCH 16/66] Replace final three suppressions entries with line numbers - These were initially not included in these changes, as they were other PRs (#3104 & #3132) that address them. --- headers/modsecurity/transaction.h | 2 +- src/rule_with_actions.cc | 2 +- src/utils/shared_files.h | 2 +- test/cppcheck_suppressions.txt | 4 ---- 4 files changed, 3 insertions(+), 7 deletions(-) diff --git a/headers/modsecurity/transaction.h b/headers/modsecurity/transaction.h index 83d85012..811a2c83 100644 --- a/headers/modsecurity/transaction.h +++ b/headers/modsecurity/transaction.h @@ -310,7 +310,7 @@ class TransactionSecMarkerManagement { if (m_marker) { return m_marker; } else { - throw; + throw; // cppcheck-suppress rethrowNoCurrentException } } diff --git a/src/rule_with_actions.cc b/src/rule_with_actions.cc index 7c9471c1..df323c4b 100644 --- a/src/rule_with_actions.cc +++ b/src/rule_with_actions.cc @@ -124,7 +124,7 @@ RuleWithActions::RuleWithActions( delete a; std::cout << "General failure, action: " << a->m_name; std::cout << " has an unknown type." << std::endl; - throw; + throw; // cppcheck-suppress rethrowNoCurrentException } } delete actions; diff --git a/src/utils/shared_files.h b/src/utils/shared_files.h index bec28f65..d0d8ef99 100644 --- a/src/utils/shared_files.h +++ b/src/utils/shared_files.h @@ -84,7 +84,7 @@ class SharedFiles { bool toBeCreated(false); bool err = false; - m_memKeyStructure = ftok(".", 1); + m_memKeyStructure = ftok(".", 1); // cppcheck-suppress useInitializationList if (m_memKeyStructure < 0) { err = true; goto err_mem_key; diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index 7f7c4526..bff688d8 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -30,10 +30,6 @@ shiftNegative:src/utils/msc_tree.cc // // ModSecurity v3 code... // -useInitializationList:src/utils/shared_files.h:87 -rethrowNoCurrentException:headers/modsecurity/transaction.h:313 -rethrowNoCurrentException:src/rule_with_actions.cc:127 - variableScope:src/operators/rx.cc variableScope:src/operators/rx_global.cc From 1f419bba8f6700fa67f6d0ce0c123e8aa4331b2e Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 28 Apr 2024 18:12:49 -0300 Subject: [PATCH 17/66] Implement sonarcloud suggestions --- .../reading_logs_via_rule_message.h | 2 +- src/rule_with_operator.cc | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h index 3fb6ef1e..9d80d9b1 100644 --- a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h +++ b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h @@ -124,7 +124,7 @@ class ReadingLogsViaRuleMessage { m_rules(rules) { } - int process() { + int process() const { pthread_t threads[NUM_THREADS]; int i; struct data_ms dms; diff --git a/src/rule_with_operator.cc b/src/rule_with_operator.cc index d308443a..5146c6d4 100644 --- a/src/rule_with_operator.cc +++ b/src/rule_with_operator.cc @@ -133,7 +133,7 @@ bool RuleWithOperator::executeOperatorAt(Transaction *trans, const std::string & void RuleWithOperator::getVariablesExceptions(Transaction *t, variables::Variables *exclusion, variables::Variables *addition) { - for (auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_tag) { // cppcheck-suppress ctunullpointer + for (const auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_tag) { // cppcheck-suppress ctunullpointer if (containsTag(*a.first.get(), t) == false) { continue; } @@ -147,7 +147,7 @@ void RuleWithOperator::getVariablesExceptions(Transaction *t, } } - for (auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_msg) { + for (const auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_msg) { if (containsMsg(*a.first.get(), t) == false) { continue; } @@ -161,7 +161,7 @@ void RuleWithOperator::getVariablesExceptions(Transaction *t, } } - for (auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_id) { + for (const auto &a : t->m_rules->m_exceptions.m_variable_update_target_by_id) { if (m_ruleId != a.first) { continue; } From a48856822c0853508c2d096cf6e28f2fa1612571 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 11:46:29 -0300 Subject: [PATCH 18/66] Updated included headers to support compilation on Windows (using Visual C++) - most of posix related functions and constants in unistd.h can be found in io.h in Visual C++ - introduced src/compat/msvc.h to adjust for compiler differences (and avoid updating code with #ifdef blocks for Windows support) - removed some included headers that are not needed (both on Unix and Windows builds) --- examples/multiprocess_c/multi.c | 4 ++++ .../using_bodies_in_chunks/simple_request.cc | 4 ++++ .../transformations/html_entity_decode.cc | 4 ++++ src/actions/transformations/lower_case.cc | 1 + src/actions/transformations/upper_case.cc | 1 + src/audit_log/writer/parallel.cc | 5 +++++ src/audit_log/writer/writer.h | 2 ++ .../backend/in_memory-per_process.h | 1 + src/collection/backend/lmdb.cc | 4 ++++ src/compat/msvc.h | 22 +++++++++++++++++++ src/debug_log/debug_log.cc | 4 ---- src/operators/inspect_file.cc | 4 ++++ src/operators/rbl.cc | 5 +++++ src/operators/rbl.h | 4 ++++ src/parser/seclang-scanner.cc | 4 ++++ src/rules_set_properties.cc | 4 ++++ src/transaction.cc | 3 +++ src/utils/geo_lookup.cc | 5 ++++- src/utils/ip_tree.cc | 4 ++++ src/utils/msc_tree.cc | 6 +++++ src/utils/string.cc | 5 ----- src/utils/system.h | 2 -- src/variables/time.cc | 4 ++++ src/variables/time_day.cc | 4 ++++ src/variables/time_hour.cc | 4 ++++ src/variables/time_min.cc | 4 ++++ src/variables/time_mon.cc | 4 ++++ src/variables/time_sec.cc | 4 ++++ src/variables/time_wday.cc | 4 ++++ src/variables/time_year.cc | 4 ++++ test/fuzzer/afl_fuzzer.cc | 4 ++++ test/regression/regression.cc | 4 ++++ tools/rules-check/rules-check.cc | 4 ++++ 33 files changed, 130 insertions(+), 12 deletions(-) create mode 100644 src/compat/msvc.h diff --git a/examples/multiprocess_c/multi.c b/examples/multiprocess_c/multi.c index 6c2ae521..2481db4e 100644 --- a/examples/multiprocess_c/multi.c +++ b/examples/multiprocess_c/multi.c @@ -19,7 +19,11 @@ #include #include #include +#ifndef WIN32 #include +#else +#include +#endif #include #include #include diff --git a/examples/using_bodies_in_chunks/simple_request.cc b/examples/using_bodies_in_chunks/simple_request.cc index ec8795fe..783e639b 100644 --- a/examples/using_bodies_in_chunks/simple_request.cc +++ b/examples/using_bodies_in_chunks/simple_request.cc @@ -13,7 +13,11 @@ * */ +#ifndef WIN32 #include +#else +#include +#endif #include #include diff --git a/src/actions/transformations/html_entity_decode.cc b/src/actions/transformations/html_entity_decode.cc index b9268df5..6a683245 100644 --- a/src/actions/transformations/html_entity_decode.cc +++ b/src/actions/transformations/html_entity_decode.cc @@ -27,6 +27,10 @@ #include "modsecurity/transaction.h" #include "src/actions/transformations/transformation.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace actions { diff --git a/src/actions/transformations/lower_case.cc b/src/actions/transformations/lower_case.cc index d00ab40c..7bca9479 100644 --- a/src/actions/transformations/lower_case.cc +++ b/src/actions/transformations/lower_case.cc @@ -17,6 +17,7 @@ #include #include +#include #include "modsecurity/transaction.h" #include "src/actions/transformations/transformation.h" diff --git a/src/actions/transformations/upper_case.cc b/src/actions/transformations/upper_case.cc index 118696ad..998ec725 100644 --- a/src/actions/transformations/upper_case.cc +++ b/src/actions/transformations/upper_case.cc @@ -17,6 +17,7 @@ #include #include +#include #include "modsecurity/transaction.h" #include "src/actions/transformations/transformation.h" diff --git a/src/audit_log/writer/parallel.cc b/src/audit_log/writer/parallel.cc index e42d7871..d23e7958 100644 --- a/src/audit_log/writer/parallel.cc +++ b/src/audit_log/writer/parallel.cc @@ -21,7 +21,12 @@ #include #include #include +#ifndef WIN32 #include +#else +#include +#include "src/compat/msvc.h" +#endif #include #include diff --git a/src/audit_log/writer/writer.h b/src/audit_log/writer/writer.h index 093f271c..56dada06 100644 --- a/src/audit_log/writer/writer.h +++ b/src/audit_log/writer/writer.h @@ -18,8 +18,10 @@ #include +#ifndef WIN32 #include #include +#endif #include #include diff --git a/src/collection/backend/in_memory-per_process.h b/src/collection/backend/in_memory-per_process.h index 43b8de24..3cacdca0 100644 --- a/src/collection/backend/in_memory-per_process.h +++ b/src/collection/backend/in_memory-per_process.h @@ -12,6 +12,7 @@ * directly using the email address security@modsecurity.org. * */ +#include #ifdef __cplusplus diff --git a/src/collection/backend/lmdb.cc b/src/collection/backend/lmdb.cc index 040ebdff..85c68e3c 100644 --- a/src/collection/backend/lmdb.cc +++ b/src/collection/backend/lmdb.cc @@ -18,7 +18,11 @@ #include "src/collection/backend/collection_data.h" #include +#ifndef WIN32 #include +#else +#include +#endif #include #include diff --git a/src/compat/msvc.h b/src/compat/msvc.h new file mode 100644 index 00000000..ce9a14c0 --- /dev/null +++ b/src/compat/msvc.h @@ -0,0 +1,22 @@ +#ifndef __COMPAT_MSVC +#define __COMPAT_MSVC + +#include + +#if !defined(S_ISREG) && defined(S_IFMT) && defined(S_IFREG) +#define S_ISREG(m) (((m) & S_IFMT) == S_IFREG) +#endif + +#define strcasecmp _stricmp +#define strncasecmp _strnicmp +#define strtok_r strtok_s +#define popen _popen +#define pclose _pclose + +inline tm* localtime_r(const time_t* tin, tm* tout) { + if (!localtime_s(tout, tin)) return tout; + + return nullptr; +} + +#endif diff --git a/src/debug_log/debug_log.cc b/src/debug_log/debug_log.cc index 54d86bda..e883177c 100644 --- a/src/debug_log/debug_log.cc +++ b/src/debug_log/debug_log.cc @@ -15,10 +15,6 @@ #include "modsecurity/debug_log.h" -#include - -#include - #include "src/debug_log/debug_log_writer.h" #include "src/debug_log_writer_agent.h" diff --git a/src/operators/inspect_file.cc b/src/operators/inspect_file.cc index 9ce43af0..72052a32 100644 --- a/src/operators/inspect_file.cc +++ b/src/operators/inspect_file.cc @@ -23,6 +23,10 @@ #include "src/operators/operator.h" #include "src/utils/system.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace operators { diff --git a/src/operators/rbl.cc b/src/operators/rbl.cc index ffdb17a2..eb7c3f0b 100644 --- a/src/operators/rbl.cc +++ b/src/operators/rbl.cc @@ -16,10 +16,15 @@ #include "src/operators/rbl.h" #include +#ifndef WIN32 #include #include #include #include +#else +#include +#include +#endif #include diff --git a/src/operators/rbl.h b/src/operators/rbl.h index fb57d2d9..7f70b599 100644 --- a/src/operators/rbl.h +++ b/src/operators/rbl.h @@ -17,10 +17,14 @@ #define SRC_OPERATORS_RBL_H_ #include +#ifndef WIN32 #include #include #include #include +#else +#include +#endif #include #include diff --git a/src/parser/seclang-scanner.cc b/src/parser/seclang-scanner.cc index c0d4d766..92afab76 100644 --- a/src/parser/seclang-scanner.cc +++ b/src/parser/seclang-scanner.cc @@ -4952,7 +4952,11 @@ static std::stack YY_PREVIOUS_STATE; * The user has a chance to override it with an option. */ /* %if-c-only */ +#ifndef WIN32 #include +#else +#include +#endif /* %endif */ /* %if-c++-only */ /* %endif */ diff --git a/src/rules_set_properties.cc b/src/rules_set_properties.cc index 075e3e87..80078b3d 100644 --- a/src/rules_set_properties.cc +++ b/src/rules_set_properties.cc @@ -19,6 +19,10 @@ #include "src/utils/string.h" #include "src/variables/variable.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { diff --git a/src/transaction.cc b/src/transaction.cc index cf52288d..a0762125 100644 --- a/src/transaction.cc +++ b/src/transaction.cc @@ -53,6 +53,9 @@ #include "src/actions/disruptive/allow.h" #include "src/variables/remote_user.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif using modsecurity::actions::Action; diff --git a/src/utils/geo_lookup.cc b/src/utils/geo_lookup.cc index 33a80be5..e76e728d 100644 --- a/src/utils/geo_lookup.cc +++ b/src/utils/geo_lookup.cc @@ -13,10 +13,13 @@ * */ +#ifndef WIN32 #include -#include #include #include +#else +#include +#endif #include #include diff --git a/src/utils/ip_tree.cc b/src/utils/ip_tree.cc index 969213a5..c4c38f1c 100644 --- a/src/utils/ip_tree.cc +++ b/src/utils/ip_tree.cc @@ -15,10 +15,14 @@ #include "src/utils/ip_tree.h" +#ifndef WIN32 #include #include #include #include +#else +#include +#endif #include #include diff --git a/src/utils/msc_tree.cc b/src/utils/msc_tree.cc index 8e36f274..c2850750 100644 --- a/src/utils/msc_tree.cc +++ b/src/utils/msc_tree.cc @@ -15,9 +15,15 @@ #include #include #include +#ifndef WIN32 #include #include #include +#else +#include "src/compat/msvc.h" +#include +#include +#endif #include "src/utils/msc_tree.h" diff --git a/src/utils/string.cc b/src/utils/string.cc index 750d2bd1..8d9e08ff 100644 --- a/src/utils/string.cc +++ b/src/utils/string.cc @@ -17,11 +17,6 @@ #include #include #include -#ifdef __OpenBSD__ -#include -#else -#include -#endif #include #include diff --git a/src/utils/system.h b/src/utils/system.h index b3033b44..d6b0adf6 100644 --- a/src/utils/system.h +++ b/src/utils/system.h @@ -13,8 +13,6 @@ * */ -#include -#include #include #include diff --git a/src/variables/time.cc b/src/variables/time.cc index ae071b49..7d481ee6 100644 --- a/src/variables/time.cc +++ b/src/variables/time.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/src/variables/time_day.cc b/src/variables/time_day.cc index f74a8409..f094d4c9 100644 --- a/src/variables/time_day.cc +++ b/src/variables/time_day.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/src/variables/time_hour.cc b/src/variables/time_hour.cc index 0f2a4219..ab809ead 100644 --- a/src/variables/time_hour.cc +++ b/src/variables/time_hour.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/src/variables/time_min.cc b/src/variables/time_min.cc index 526d8e6f..9d03be4d 100644 --- a/src/variables/time_min.cc +++ b/src/variables/time_min.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/src/variables/time_mon.cc b/src/variables/time_mon.cc index 53ba2919..17e74f31 100644 --- a/src/variables/time_mon.cc +++ b/src/variables/time_mon.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/src/variables/time_sec.cc b/src/variables/time_sec.cc index 20d3be7a..5e39af7f 100644 --- a/src/variables/time_sec.cc +++ b/src/variables/time_sec.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/src/variables/time_wday.cc b/src/variables/time_wday.cc index ff9825c1..fd6a0278 100644 --- a/src/variables/time_wday.cc +++ b/src/variables/time_wday.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/src/variables/time_year.cc b/src/variables/time_year.cc index a4656125..f68e8cd6 100644 --- a/src/variables/time_year.cc +++ b/src/variables/time_year.cc @@ -30,6 +30,10 @@ #include "modsecurity/transaction.h" +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + namespace modsecurity { namespace variables { diff --git a/test/fuzzer/afl_fuzzer.cc b/test/fuzzer/afl_fuzzer.cc index 6b19a18f..21bfa1bf 100644 --- a/test/fuzzer/afl_fuzzer.cc +++ b/test/fuzzer/afl_fuzzer.cc @@ -114,7 +114,11 @@ using namespace modsecurity; #include #include +#ifndef WIN32 #include +#else +#include +#endif #include #include diff --git a/test/regression/regression.cc b/test/regression/regression.cc index 6343c9e1..a5c4832d 100644 --- a/test/regression/regression.cc +++ b/test/regression/regression.cc @@ -15,7 +15,11 @@ #include +#ifndef WIN32 #include +#else +#include +#endif #include #include diff --git a/tools/rules-check/rules-check.cc b/tools/rules-check/rules-check.cc index f59439ee..46c8e1a8 100644 --- a/tools/rules-check/rules-check.cc +++ b/tools/rules-check/rules-check.cc @@ -15,7 +15,11 @@ #include #include +#ifndef WIN32 #include +#else +#include +#endif #include #include From 942c8ba606bc2f1cd9e578dced3c282552a4d038 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 12:23:53 -0300 Subject: [PATCH 19/66] Replaced usage of usleep (not available in Visual C++) with C++11's std::this_thread::sleep_for & std::chrono::microseconds. - disabled build error from warning C4716 because process_request does not return a value and Visual C++ doesn't support [[noreturn]] --- .../reading_logs_via_rule_message.h | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h index 9d80d9b1..6b280048 100644 --- a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h +++ b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h @@ -13,10 +13,11 @@ * */ -#include - #include #include +#include +#include +#include #define NUM_THREADS 100 @@ -72,6 +73,11 @@ struct data_ms { modsecurity::RulesSet *rules; }; +#if defined _MSC_VER +#pragma warning(push) +#pragma warning(disable:4716) // avoid error C4716: 'process_request': must return a value, as MSVC C++ compiler doesn't support [[noreturn]] +#pragma warning(disable:4715) // avoid warning c4715: 'process_request' : not all control paths return a value +#endif [[noreturn]] static void *process_request(void *data) { struct data_ms *a = (struct data_ms *)data; @@ -85,7 +91,7 @@ struct data_ms { modsecTransaction->processConnection(ip, 12345, "127.0.0.1", 80); modsecTransaction->processURI(request_uri, "GET", "1.1"); - usleep(10); + std::this_thread::sleep_for(std::chrono::microseconds(10)); modsecTransaction->addRequestHeader("Host", "net.tutsplus.com"); modsecTransaction->processRequestHeaders(); @@ -105,6 +111,9 @@ struct data_ms { pthread_exit(nullptr); } +#if defined _MSC_VER +#pragma warning(pop) +#endif class ReadingLogsViaRuleMessage { public: @@ -151,7 +160,7 @@ class ReadingLogsViaRuleMessage { reinterpret_cast(&dms)); } - usleep(10000); + std::this_thread::sleep_for(std::chrono::microseconds(10000)); for (i=0; i < NUM_THREADS; i++) { pthread_join(threads[i], &status); From abbd7b2f4255d61aaf562600344256855c43fdbd Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 12:40:47 -0300 Subject: [PATCH 20/66] Replaced usage of apr_snprintf with snprintf (already in Windows exclusive code block) - updated included headers to support compilation on Windows (using Visual C++) --- src/unique_id.cc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/unique_id.cc b/src/unique_id.cc index a78ebd75..c6234112 100644 --- a/src/unique_id.cc +++ b/src/unique_id.cc @@ -17,6 +17,7 @@ #include "src/config.h" #ifdef WIN32 +#include "src/compat/msvc.h" #include #include #endif @@ -48,7 +49,11 @@ #endif #include +#ifndef WIN32 #include +#else +#include +#endif #include #include "src/utils/sha1.h" @@ -207,7 +212,7 @@ std::string UniqueId::ethernetMacAddress() { pAdapter = pAdapterInfo; while (pAdapter && !mac[0] && !mac[1] && !mac[2]) { if (pAdapter->AddressLength > 4) { - apr_snprintf(mac, MAC_ADDRESS_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x", + snprintf(mac, MAC_ADDRESS_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x", (unsigned char)pAdapter->Address[0], (unsigned char)pAdapter->Address[1], (unsigned char)pAdapter->Address[2], From 35949179a40d32d46fac681d6c5adfdcb7e3a59d Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 12:43:22 -0300 Subject: [PATCH 21/66] setenv is not available in Windows build, replaced with _putenv_s --- src/actions/set_env.cc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/actions/set_env.cc b/src/actions/set_env.cc index e1c3afdb..29290653 100644 --- a/src/actions/set_env.cc +++ b/src/actions/set_env.cc @@ -37,7 +37,11 @@ bool SetENV::evaluate(RuleWithActions *rule, Transaction *t) { auto pair = utils::string::ssplit_pair(colNameExpanded, '='); ms_dbg_a(t, 8, "Setting environment variable: " + pair.first + " to " + pair.second); +#ifndef WIN32 setenv(pair.first.c_str(), pair.second.c_str(), /*overwrite*/ 1); +#else + _putenv_s(pair.first.c_str(), pair.second.c_str()); +#endif return true; } From 373633ffe2ae754973ce8b34373b9ee16bd359b8 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Wed, 24 Apr 2024 11:01:32 -0300 Subject: [PATCH 22/66] mkstemp is not available in Windows build, replaced with _mktemp_s plus _open. - Updated included headers to support compilation on Windows (using Visual C++) - Minor change to use C++ default (zero) initialization instead of calling memset. --- src/request_body_processor/multipart.cc | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/request_body_processor/multipart.cc b/src/request_body_processor/multipart.cc index 691a6fd3..d9ed6c6d 100644 --- a/src/request_body_processor/multipart.cc +++ b/src/request_body_processor/multipart.cc @@ -21,7 +21,12 @@ #include #include #include +#ifndef WIN32 #include +#else +#include +#include "src/compat/msvc.h" +#endif #include #include #include @@ -61,12 +66,11 @@ MultipartPartTmpFile::~MultipartPartTmpFile() { void MultipartPartTmpFile::Open() { struct tm timeinfo; - char tstr[300]; time_t tt = time(NULL); localtime_r(&tt, &timeinfo); - memset(tstr, '\0', 300); + char tstr[300] {}; strftime(tstr, 299, "/%Y%m%d-%H%M%S", &timeinfo); std::string path = m_transaction->m_rules->m_uploadDirectory.m_value; @@ -74,14 +78,23 @@ void MultipartPartTmpFile::Open() { path += "-file-XXXXXX"; char* tmp = strdup(path.c_str()); +#ifndef WIN32 m_tmp_file_fd = mkstemp(tmp); +#else + _mktemp_s(tmp, path.length()+1); + m_tmp_file_fd = _open(tmp, _O_CREAT | _O_EXCL | _O_RDWR); +#endif m_tmp_file_name.assign(tmp); free(tmp); ms_dbg_a(m_transaction, 4, "MultipartPartTmpFile: Create filename= " + m_tmp_file_name); int mode = m_transaction->m_rules->m_uploadFileMode.m_value; if ((m_tmp_file_fd != -1) && (mode != 0)) { +#ifndef WIN32 if (fchmod(m_tmp_file_fd, mode) == -1) { +#else + if (_chmod(m_tmp_file_name.c_str(), mode) == -1) { +#endif m_tmp_file_fd = -1; } } From 91a736692a6d2c921d569fd0775501bf649cfb2d Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 12:57:28 -0300 Subject: [PATCH 23/66] Minor changes to debug_log_writer - Removed unused m_first data member. - Explicitly delete copy constructor and assignment operator. - Removed unused included headers. --- src/debug_log/debug_log_writer.cc | 12 ------------ src/debug_log/debug_log_writer.h | 16 +++------------- 2 files changed, 3 insertions(+), 25 deletions(-) diff --git a/src/debug_log/debug_log_writer.cc b/src/debug_log/debug_log_writer.cc index 86facfed..b7bb1ff2 100644 --- a/src/debug_log/debug_log_writer.cc +++ b/src/debug_log/debug_log_writer.cc @@ -15,18 +15,6 @@ #include "src/debug_log/debug_log_writer.h" -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include - #include "src/utils/shared_files.h" namespace modsecurity { diff --git a/src/debug_log/debug_log_writer.h b/src/debug_log/debug_log_writer.h index 1f4f43df..698ff358 100644 --- a/src/debug_log/debug_log_writer.h +++ b/src/debug_log/debug_log_writer.h @@ -13,15 +13,7 @@ * */ -#include -#include -#include -#include - -#include -#include #include -#include #ifndef SRC_DEBUG_LOG_DEBUG_LOG_WRITER_H_ @@ -45,7 +37,7 @@ class DebugLogWriter { static int open(const std::string& m_fileName, std::string *error); private: - DebugLogWriter() : m_first(NULL) { } + DebugLogWriter() { } ~DebugLogWriter() { } // C++ 03 @@ -53,10 +45,8 @@ class DebugLogWriter { // Dont forget to declare these two. You want to make sure they // are unacceptable otherwise you may accidentally get copies of // your singleton appearing. - DebugLogWriter(DebugLogWriter const&); - void operator=(DebugLogWriter const&); - - struct debug_log_file_handler *m_first; + DebugLogWriter(DebugLogWriter const&) = delete; + void operator=(DebugLogWriter const&) = delete; }; From ebf1f8fd28251fd6bd205e510421c46d2eee9269 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 13:00:19 -0300 Subject: [PATCH 24/66] On Windows use the operating system's native CA store for certificate verification of https requests. - Updated included headers to support compilation on Windows (using Visual C++) --- src/utils/https_client.cc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/utils/https_client.cc b/src/utils/https_client.cc index 9ee84b15..66e818d4 100644 --- a/src/utils/https_client.cc +++ b/src/utils/https_client.cc @@ -20,10 +20,14 @@ #include #endif +#ifndef WIN32 #include #include #include #include +#else +#include +#endif #include #include @@ -94,6 +98,11 @@ bool HttpsClient::download(const std::string &uri) { curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1); +#ifdef WIN32 + /* use the operating system's native CA store for certificate verification.*/ + curl_easy_setopt(curl, CURLOPT_SSL_OPTIONS, (long)CURLSSLOPT_NATIVE_CA); +#endif + /* send all data to this function */ curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, &HttpsClient::handle); From 10c6ee726f63cddbd71cd9c071876a7b1fbbfb07 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 14:55:39 -0300 Subject: [PATCH 25/66] Added support for expandEnv, createDir & cpu_seconds on Windows - expandEnv on Windows uses POCO C++ Libraries implementation of Glob - Paths of matched files are adjusted to preserve UNIX path separators for consistency with the rest of the code. - Minor change to code shared with other platforms that removes allocation of std::ifstream on the heap to check whether the file can be opened, which can be done with local stack variable that closes the file when out of scope. - createDir uses _mkdir on Windows, which doesn't support configuring the new directory's mode. - added public domain implementation of clock_gettime for clock_id CLOCK_PROCESS_CPUTIME_ID from mingw-w64's winpthreads to support cpu_seconds on Windows. - Updated included headers to support compilation on Windows (using Visual C++) --- src/utils/system.cc | 62 +++++++++++++++++++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 8 deletions(-) diff --git a/src/utils/system.cc b/src/utils/system.cc index 69b90404..ef4e5060 100644 --- a/src/utils/system.cc +++ b/src/utils/system.cc @@ -19,6 +19,9 @@ #include #ifdef __OpenBSD__ #include +#elif defined(WIN32) +#include "Poco/Glob.h" +#include #else #include #endif @@ -31,6 +34,7 @@ #include #if defined _MSC_VER +#include "src/compat/msvc.h" #include #elif defined __GNUC__ #include @@ -40,6 +44,36 @@ #include "src/utils/system.h" #include "src/config.h" +#ifdef WIN32 + +// Public domain code from mingw-w64's winpthreads +// https://sourceforge.net/p/mingw-w64/code/HEAD/tree/trunk/mingw-w64-libraries/winpthreads/src/clock.c +// + +#define CLOCK_PROCESS_CPUTIME_ID 2 +#define POW10_7 10000000 + +// NOTE: includes only CLOCK_PROCESS_CPUTIME_ID implementation, ignores clock_id argument +static int clock_gettime(int clock_id, struct timespec *tp) +{ + unsigned __int64 t; + LARGE_INTEGER pf, pc; + union { + unsigned __int64 u64; + FILETIME ft; + } ct, et, kt, ut; + + if(0 == GetProcessTimes(GetCurrentProcess(), &ct.ft, &et.ft, &kt.ft, &ut.ft)) + return -1; + t = kt.u64 + ut.u64; + tp->tv_sec = t / POW10_7; + tp->tv_nsec = ((int) (t % POW10_7)) * 100; + + return 0; +} + +#endif + namespace modsecurity { namespace utils { @@ -122,8 +156,16 @@ std::string get_path(const std::string& file) { std::list expandEnv(const std::string& var, int flags) { std::list vars; - -#ifdef __OpenBSD__ +#ifdef WIN32 + // NOTE: align scopes with if & if in other versions + { + { + std::set files; + Poco::Glob::glob(var, files); + for(auto file : files) { + std::replace(file.begin(), file.end(), '\\', '/'); // preserve unix-like paths + const char* exp[] = { file.c_str() }; +#elif defined(__OpenBSD__) glob_t p; if (glob(var.c_str(), flags, NULL, &p) == false) { if (p.gl_pathc) { @@ -135,15 +177,13 @@ std::list expandEnv(const std::string& var, int flags) { if (p.we_wordc) { for (char** exp = p.we_wordv; *exp; ++exp) { #endif - std::ifstream *iss = new std::ifstream(exp[0], std::ios::in); - if (iss->is_open()) { - iss->close(); + auto iss = std::ifstream(exp[0], std::ios::in); + if (iss.is_open()) vars.push_back(exp[0]); - } - delete iss; } } -#ifdef __OpenBSD__ +#ifdef WIN32 +#elif defined(__OpenBSD__) globfree(&p); #else wordfree(&p); @@ -153,7 +193,13 @@ std::list expandEnv(const std::string& var, int flags) { } bool createDir(const std::string& dir, int mode, std::string *error) { +#ifndef WIN32 int ret = mkdir(dir.data(), mode); +#else + if (dir == ".") + return true; + int ret = _mkdir(dir.c_str()); +#endif if (ret != 0 && errno != EEXIST) { error->assign("Not able to create directory: " + dir + ": " \ + strerror(errno) + "."); From fef419f9869bd5b160683011f284fde585e6667f Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 16:22:58 -0300 Subject: [PATCH 26/66] Minor changes related to std::shared_ptr usage in RuleWithActions - RuleWithActions::evaluate(Transaction *transaction) - Removed temporary rm local variable used to immediately create std::shared_ptr. - Leverage std::make_shared & auto to simplify code. --- src/rule_with_actions.cc | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/src/rule_with_actions.cc b/src/rule_with_actions.cc index df323c4b..5ae7d407 100644 --- a/src/rule_with_actions.cc +++ b/src/rule_with_actions.cc @@ -172,9 +172,7 @@ RuleWithActions::~RuleWithActions() { bool RuleWithActions::evaluate(Transaction *transaction) { - RuleMessage rm(this, transaction); - std::shared_ptr rm2 = std::make_shared(&rm); - return evaluate(transaction, rm2); + return evaluate(transaction, std::make_shared(this, transaction)); } @@ -330,7 +328,7 @@ inline void RuleWithActions::executeTransformation( std::string newValue = a->evaluate(*oldValue, trans); if (newValue != *oldValue) { - std::shared_ptr u(new std::string(newValue)); + auto u = std::make_shared(newValue); if (m_containsMultiMatchAction) { ret->push_back(std::make_pair(u, a->m_name)); (*nth)++; @@ -355,14 +353,13 @@ void RuleWithActions::executeTransformations( int none = 0; int transformations = 0; std::string path(""); - std::shared_ptr value = - std::shared_ptr(new std::string(in)); + auto value = std::make_shared(in); if (m_containsMultiMatchAction == true) { /* keep the original value */ ret.push_back(std::make_pair( - std::shared_ptr(new std::string(*value)), - std::shared_ptr(new std::string(path)))); + std::make_shared(*value), + std::make_shared(path))); } for (Action *a : m_transformations) { @@ -436,8 +433,8 @@ void RuleWithActions::executeTransformations( if (!m_containsMultiMatchAction) { ret.push_back(std::make_pair( - std::shared_ptr(new std::string(*value)), - std::shared_ptr(new std::string(path)))); + std::make_shared(*value), + std::make_shared(path))); } } From 7bff2f77aa4bbbb267de5667db0cf4de8cd7467b Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 16:35:37 -0300 Subject: [PATCH 27/66] Updated references to coreruleset repository - For OWASP v2 rules, switch to a v2 tag for the paths referenced in the rest of the script to apply. --- test/benchmark/download-owasp-v2-rules.sh | 5 ++++- test/benchmark/download-owasp-v3-rules.sh | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/test/benchmark/download-owasp-v2-rules.sh b/test/benchmark/download-owasp-v2-rules.sh index facc48d3..dd1623e7 100755 --- a/test/benchmark/download-owasp-v2-rules.sh +++ b/test/benchmark/download-owasp-v2-rules.sh @@ -2,7 +2,10 @@ # # -git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git owasp-v2 +git clone https://github.com/coreruleset/coreruleset.git owasp-v2 +cd owasp-v2 +git checkout 2.2.9 -b tag2.2.9 +cd - echo 'Include "owasp-v2/base_rules/*.conf"' >> basic_rules.conf echo 'Include "owasp-v2/optional_rules/*.conf"' >> basic_rules.conf diff --git a/test/benchmark/download-owasp-v3-rules.sh b/test/benchmark/download-owasp-v3-rules.sh index c3bc0dfa..d0d9f809 100755 --- a/test/benchmark/download-owasp-v3-rules.sh +++ b/test/benchmark/download-owasp-v3-rules.sh @@ -1,7 +1,7 @@ #!/bin/bash -git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git owasp-v3 +git clone https://github.com/coreruleset/coreruleset.git owasp-v3 cd owasp-v3 git checkout v3.0.2 -b tag3.0.2 cd - From 50c35345ed941209331aaa2fe785df53053609c1 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 17:10:47 -0300 Subject: [PATCH 28/66] Fixed use after free in ModSecurity::processContentOffset - Use after free issue detected with Address Sanitizer while running the reading_logs_with_offset example. - Keeps reference to last element in vars vector with vars.back(). Then it removes the element from vars calling vars.pop_back() which invalidates the reference, but it's accessed later in the function. --- src/modsecurity.cc | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/src/modsecurity.cc b/src/modsecurity.cc index 4b48b799..7319bb96 100644 --- a/src/modsecurity.cc +++ b/src/modsecurity.cc @@ -258,14 +258,11 @@ int ModSecurity::processContentOffset(const char *content, size_t len, strlen("highlight")); yajl_gen_array_open(g); - while (vars.size() > 3) { - std::string value; + for(auto [it, pending] = std::tuple{vars.rbegin(), vars.size()}; pending > 3; pending -= 3) { yajl_gen_map_open(g); - vars.pop_back(); - const std::string &startingAt = vars.back().str(); - vars.pop_back(); - const std::string &size = vars.back().str(); - vars.pop_back(); + it++; + const std::string &startingAt = it->str(); it++; + const std::string &size = it->str(); it++; yajl_gen_string(g, reinterpret_cast("startingAt"), strlen("startingAt")); @@ -284,7 +281,7 @@ int ModSecurity::processContentOffset(const char *content, size_t len, return -1; } - value = std::string(content, stoi(startingAt), stoi(size)); + const auto value = std::string(content, stoi(startingAt), stoi(size)); if (varValue.size() > 0) { varValue.append(" " + value); } else { @@ -340,16 +337,13 @@ int ModSecurity::processContentOffset(const char *content, size_t len, yajl_gen_map_open(g); - while (ops.size() > 3) { - std::string value; + for(auto [it, pending] = std::tuple{ops.rbegin(), ops.size()}; pending > 3; pending -= 3) { yajl_gen_string(g, reinterpret_cast("highlight"), strlen("highlight")); yajl_gen_map_open(g); - ops.pop_back(); - std::string startingAt = ops.back().str(); - ops.pop_back(); - std::string size = ops.back().str(); - ops.pop_back(); + it++; + const std::string &startingAt = it->str(); it++; + const std::string &size = ops.back().str(); it++; yajl_gen_string(g, reinterpret_cast("startingAt"), strlen("startingAt")); @@ -371,7 +365,7 @@ int ModSecurity::processContentOffset(const char *content, size_t len, reinterpret_cast("value"), strlen("value")); - value = std::string(varValue, stoi(startingAt), stoi(size)); + const auto value = std::string(varValue, stoi(startingAt), stoi(size)); yajl_gen_string(g, reinterpret_cast(value.c_str()), From 50e78331b1b79d907fd77204e9b3a8bb26a8dab6 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 17:40:24 -0300 Subject: [PATCH 29/66] Updated Env::evaluate to support case-insensitive environment variable names in Windows - Env::evaluate - Environment variable names in Windows are case-insensitive, so in the Windows build we use strcasecmp to ignore case when matching variables in transaction->m_variableEnvs. - If the variable is found, we use the expected variable name to create the VariableValue instance, as further rule processing will look for the variable using case-sensitive comparisons. - This code is not limited to Windows to avoid another #ifdef block because for other platforms, because the env variable names are case-sensitive the value from either x.first and m_name will be the same. - In Windows build, avoid redefining environ, already defined by including stdlib.h. --- src/variables/env.cc | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/src/variables/env.cc b/src/variables/env.cc index dfb2c3f0..bf40954a 100644 --- a/src/variables/env.cc +++ b/src/variables/env.cc @@ -25,9 +25,15 @@ #include #include +#ifdef WIN32 +#include "src/compat/msvc.h" +#endif + #include "modsecurity/transaction.h" +#ifndef WIN32 extern char **environ; +#endif namespace modsecurity { namespace variables { @@ -47,12 +53,20 @@ void Env::evaluate(Transaction *transaction, transaction->m_variableEnvs.insert(a); } + const auto hasName = m_name.length() > 0; for (auto& x : transaction->m_variableEnvs) { - if (x.first != m_name && m_name.length() > 0) { +#ifndef WIN32 + if (hasName && x.first != m_name) { +#else + if (hasName && strcasecmp(x.first.c_str(), m_name.c_str()) != 0) { +#endif continue; } - if (!m_keyExclusion.toOmit(x.first)) { - l->push_back(new VariableValue(&m_collectionName, &x.first, + // (Windows) we need to keep the case from the rule in case that from + // the environment differs. + const auto &key = hasName ? m_name : x.first; + if (!m_keyExclusion.toOmit(key)) { + l->push_back(new VariableValue(&m_collectionName, &key, &x.second)); } } From d7c49ed590a32208f07cd2894ca5a39f70444194 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 23 Apr 2024 17:52:25 -0300 Subject: [PATCH 30/66] Added support to lock files on Windows and major rewrite to reintroduce reference counting and remove unused code. - In Windows build, replaced usage of fcntl with cmd F_SETLKW with Win32 APIs to do file locking (LockFileEx & UnlockFileEx). - Reintroduced the reference counting initially present in the class which is necessary to correctly handle merging of rules. This allows for correctly closing the file and removing the associated entry from m_handlers when the file is no longer used. - The need for reference counting can be seen in the example simple_example_using_c, where rules are initially loaded locally and then further rules are loaded remotely. This will initially open a shared file for a log, then in order to merge rules, the shared file is opened again for the new configuration. Then, the previous configuration closes the shared file on destruction. That is, two consecutive opens are done on a shared file, which is followed by a close. If the shared file is not reference counted, the shared file will be closed while there is still a reference active. The current version works because closing of the file has been disabled after reference counting was removed. - Replaced `std::vector` data structure with `std::unordered_map` to improve lookup/update times, and simplify code. - Removed unused code - Shared memory to store msc_file_handler structure - Initially SharedFiles used shared memory to store information about each shared file, including its file pointer and a mutex to synchronize access to the file on write. See code at commit 01c13da, in particular, usage of lock & fp fields in the msc_file_handler_t structure. - At that time, msc_file_handler_t included reference counting too with the using_it field, which was incremented when a file was opened and decremented on close. If the reference count reached zero, the shared file would be closed, the lock destroyed and the file handler entry removed from m_handlers. - Reference counting was removed in commit 7f9cd76, which introduced the following issues in SharedFiles::close: - No longer closes the file pointer. - The file pointer appears to be reset when a.second = 0, but this is a local copy of the data pair obtained from m_handlers, so this is essentially a nop (updating a local variable that is not referenced later in the function). - NOTE: The file pointer was moved out of the shared memory in this commit too, and stored alongside the msc_file_handler_t instance in the m_handlers entry associated to the shared file. - The lock is no longer destroyed. - The shared memory is marked to be destroyed in the call to: shmctl(a.first->shm_id_structure, IPC_RMID, NULL); - The shared file entry is not removed from m_handlers, so: - the file pointer is still valid, which is how writing to the file continues to work, - the reference to the shared memory is also present and will be marked to be destroyed whenever close is called again on the shared file. - File locking using the mutex in msc_file_handler_t was replaced in commit 3d20304 with usage of fcntl with cmd F_SETLKW. - At this time, it appears that the shared memory is no longer used, as the file pointer and locking no longer depend on it. - MODSEC_USE_GENERAL_LOCK - This code is introduced commit 7f9cd76 and is enabled if MODSEC_USE_GENERAL_LOCK` is defined. - The define is commented out in the source code since the original commit and is not present in the build configuration either. - In commit ff9152e, in the SharedFiles constructor, the initialization of the local variable toBeCreated is removed. This means that in this version, if MODSEC_USE_GENERAL_LOCK is enabled, execution of the code that checks on toBeCreated is undefined. - Then, in commit 9b40a04, the variable toBeCreated is initialized again, but is now set to false, which means that if MODSEC_USE_GENERAL_LOCK is enabled, the shared memory and lock it uses will *not* be initialized and thus doesn't work (execution of the current version will result in trying to acquire a lock that will be null). - I conclude that the feature is not used and can be removed. - Additionally, if it were working, I think the lock should be used in SharedFiles::write as well, which is a reader of the underlying data structures protected by this lock when they're modified in SharedFiles::open & SharedFiles::close. --- src/utils/shared_files.cc | 227 ++++++++------------------------------ src/utils/shared_files.h | 119 +++----------------- 2 files changed, 64 insertions(+), 282 deletions(-) diff --git a/src/utils/shared_files.cc b/src/utils/shared_files.cc index 73216bd0..df18022f 100644 --- a/src/utils/shared_files.cc +++ b/src/utils/shared_files.cc @@ -15,236 +15,103 @@ #include "src/utils/shared_files.h" -#include #include -#include -#include -#include -#include -#include -#include -#include -#include -#include +#ifdef WIN32 +#include +#include +#endif -#include -#include -#include namespace modsecurity { namespace utils { -std::pair SharedFiles::find_handler( - const std::string &fileName) { - for (const auto &i : m_handlers) { - if (i.first == fileName) { - return i.second; - } - } - return std::pair(NULL, NULL); -} - - -std::pair SharedFiles::add_new_handler( +SharedFiles::handlers_map::iterator SharedFiles::add_new_handler( const std::string &fileName, std::string *error) { - int shm_id; - int ret; - key_t mem_key_structure; - msc_file_handler_t *new_debug_log = NULL; - struct shmid_ds shared_mem_info; - FILE *fp; - bool toBeCreated = true; - - fp = fopen(fileName.c_str(), "a"); + FILE *fp = fopen(fileName.c_str(), "a"); if (fp == 0) { error->assign("Failed to open file: " + fileName); - goto err_fh; + return m_handlers.end(); } - mem_key_structure = ftok(fileName.c_str(), 1); - if (mem_key_structure < 0) { - error->assign("Failed to select key for the shared memory (1): "); - error->append(strerror(errno)); - goto err_mem_key; - } - - shm_id = shmget(mem_key_structure, sizeof (msc_file_handler_t) \ - + fileName.size() + 1, IPC_CREAT | IPC_EXCL | 0666); - if (shm_id < 0) { - shm_id = shmget(mem_key_structure, sizeof (msc_file_handler_t) - + fileName.size() + 1, IPC_CREAT | 0666); - toBeCreated = false; - if (shm_id < 0) { - error->assign("Failed to allocate shared memory (1): "); - error->append(strerror(errno)); - goto err_shmget1; - } - } - - ret = shmctl(shm_id, IPC_STAT, &shared_mem_info); - if (ret < 0) { - error->assign("Failed to get information on shared memory (1): "); - error->append(strerror(errno)); - goto err_shmctl1; - } - - new_debug_log = reinterpret_cast( - shmat(shm_id, NULL, 0)); - if ((reinterpret_cast(new_debug_log)[0]) == -1) { - error->assign("Failed to attach shared memory (1): "); - error->append(strerror(errno)); - goto err_shmat1; - } - - if (toBeCreated == false && shared_mem_info.shm_nattch == 0) { - toBeCreated = true; - } - - if (toBeCreated) { - memset(new_debug_log, '\0', sizeof(msc_file_handler_t)); - new_debug_log->shm_id_structure = shm_id; - memcpy(new_debug_log->file_name, fileName.c_str(), fileName.size()); - new_debug_log->file_name[fileName.size()] = '\0'; - } - m_handlers.push_back(std::make_pair(fileName, - std::make_pair(new_debug_log, fp))); - - return std::make_pair(new_debug_log, fp); -err_shmat1: - shmdt(new_debug_log); -err_shmctl1: -err_shmget1: -err_mem_key: - fclose(fp); -err_fh: - return std::pair(NULL, NULL); + return m_handlers.insert({ fileName, {fp, 0} }).first; } bool SharedFiles::open(const std::string& fileName, std::string *error) { - std::pair a; - bool ret = true; - - #if MODSEC_USE_GENERAL_LOCK - pthread_mutex_lock(m_generalLock); -#endif - - a = find_handler(fileName); - if (a.first == NULL) { - a = add_new_handler(fileName, error); - if (error->size() > 0) { - ret = false; - goto out; - } + auto it = m_handlers.find(fileName); + if (it == m_handlers.end()) { + it = add_new_handler(fileName, error); + if (error->size() > 0) + return false; } - if (a.first == NULL) { + + if (it == m_handlers.end()) { error->assign("Not able to open: " + fileName); - ret = false; - goto out; + return false; } -out: -#if MODSEC_USE_GENERAL_LOCK - pthread_mutex_unlock(m_generalLock); -#endif + it->second.cnt++; - return ret; + return true; } void SharedFiles::close(const std::string& fileName) { - std::pair a; - /* int ret; */ - /* int shm_id; */ - /* struct shmid_ds shared_mem_info; */ - /* int j = 0; */ + if (fileName.empty()) + return; -#if MODSEC_USE_GENERAL_LOCK - pthread_mutex_lock(m_generalLock); -#endif + auto it = m_handlers.find(fileName); + if (it == m_handlers.end()) + return; - if (fileName.empty()) { - goto out; + it->second.cnt--; + if (it->second.cnt == 0) + { + fclose(it->second.fp); + + m_handlers.erase(it); } - - a = find_handler(fileName); - if (a.first == NULL || a.second == NULL) { - goto out; - } - - /* fclose(a.second); */ - a.second = 0; - - /* - * Delete the file structure will be welcomed, but we cannot delay - * while the process is being killed. - * - for (std::pair> i : m_handlers) { - if (i.first == fileName) { - j++; - } - } - - m_handlers.erase(m_handlers.begin()+j); - */ - - /* hmdt(a.second); */ - shmctl(a.first->shm_id_structure, IPC_RMID, NULL); - - /* - * - * We could check to see how many process attached to the shared memory - * we have, prior to the deletion of the shared memory. - * - ret = shmctl(a.first->shm_id_structure, IPC_STAT, &shared_mem_info); - if (ret < 0) { - goto out; - } - ret = shared_mem_info.shm_nattch; - shm_id = a.first->shm_id_structure; - */ - -out: -#if MODSEC_USE_GENERAL_LOCK - pthread_mutex_unlock(m_generalLock); -#endif - return; } bool SharedFiles::write(const std::string& fileName, const std::string &msg, std::string *error) { - std::pair a; - std::string lmsg = msg; - size_t wrote; - struct flock lock{}; bool ret = true; - a = find_handler(fileName); - if (a.first == NULL) { + auto it = m_handlers.find(fileName); + if (it == m_handlers.end()) { error->assign("file is not open: " + fileName); return false; } //Exclusively lock whole file +#ifndef WIN32 + struct flock lock {}; lock.l_start = lock.l_len = lock.l_whence = 0; lock.l_type = F_WRLCK; - fcntl(fileno(a.second), F_SETLKW, &lock); + fcntl(fileno(it->second.fp), F_SETLKW, &lock); +#else + auto handle = reinterpret_cast(_get_osfhandle(fileno(it->second.fp))); + OVERLAPPED overlapped = { 0 }; + ::LockFileEx(handle, LOCKFILE_EXCLUSIVE_LOCK, 0, MAXDWORD, MAXDWORD, &overlapped); +#endif - wrote = fwrite(lmsg.c_str(), 1, lmsg.size(), a.second); + auto wrote = fwrite(msg.c_str(), 1, msg.size(), it->second.fp); if (wrote < msg.size()) { error->assign("failed to write: " + fileName); ret = false; } - fflush(a.second); + fflush(it->second.fp); //Remove exclusive lock +#ifndef WIN32 lock.l_type = F_UNLCK; - fcntl(fileno(a.second), F_SETLKW, &lock); + fcntl(fileno(it->second.fp), F_SETLKW, &lock); +#else + overlapped = { 0 }; + ::UnlockFileEx(handle, 0, MAXDWORD, MAXDWORD, &overlapped); +#endif return ret; } diff --git a/src/utils/shared_files.h b/src/utils/shared_files.h index d0d8ef99..4953eeff 100644 --- a/src/utils/shared_files.h +++ b/src/utils/shared_files.h @@ -17,45 +17,18 @@ #define SRC_UTILS_SHARED_FILES_H_ -#include -#include -#include #include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include +#include #include -#include "modsecurity/transaction.h" -#include "modsecurity/audit_log.h" - -/** - * Not using this critical section yet. - * - */ -/* #define MODSEC_USE_GENERAL_LOCK */ - namespace modsecurity { namespace utils { -typedef struct msc_file_handler { - int shm_id_structure; - char file_name[]; -} msc_file_handler_t; - - class SharedFiles { - public: +public: bool open(const std::string& fileName, std::string *error); void close(const std::string& fileName); bool write(const std::string& fileName, const std::string &msg, @@ -66,86 +39,28 @@ class SharedFiles { return instance; } - protected: - std::pair find_handler( - const std::string &fileName); - std::pair add_new_handler( - const std::string &fileName, std::string *error); - - private: - SharedFiles() -#ifdef MODSEC_USE_GENERAL_LOCK - : m_generalLock(NULL), - m_memKeyStructure(0) -#endif - { -#ifdef MODSEC_USE_GENERAL_LOCK - int shm_id; - bool toBeCreated(false); - bool err = false; - - m_memKeyStructure = ftok(".", 1); // cppcheck-suppress useInitializationList - if (m_memKeyStructure < 0) { - err = true; - goto err_mem_key; - } - - shm_id = shmget(m_memKeyStructure, sizeof(pthread_mutex_t), - IPC_CREAT | IPC_EXCL | 0666); - if (shm_id < 0) { - shm_id = shmget(m_memKeyStructure, sizeof(pthread_mutex_t), - IPC_CREAT | 0666); - toBeCreated = false; - if (shm_id < 0) { - err = true; - goto err_shmget1; - } - } - - m_generalLock = reinterpret_cast( - shmat(shm_id, NULL, 0)); - if ((reinterpret_cast(m_generalLock)[0]) == -1) { - err = true; - goto err_shmat1; - } - - if (toBeCreated) { - memset(m_generalLock, '\0', sizeof(pthread_mutex_t)); - pthread_mutex_init(m_generalLock, NULL); - pthread_mutex_unlock(m_generalLock); - } - - if (err) { -err_mem_key: - std::cerr << strerror(errno) << std::endl; -err_shmget1: - std::cerr << "err_shmget1" << std::endl; -err_shmat1: - std::cerr << "err_shmat1" << std::endl; - } -#endif - } - ~SharedFiles() { -#if MODSEC_USE_GENERAL_LOCK - shmdt(m_generalLock); - shmctl(m_memKeyStructure, IPC_RMID, NULL); -#endif - } +private: + SharedFiles() = default; + ~SharedFiles() = default; // C++ 03 // ======== // Dont forget to declare these two. You want to make sure they // are unacceptable otherwise you may accidentally get copies of // your singleton appearing. - SharedFiles(SharedFiles const&); - void operator=(SharedFiles const&); + SharedFiles(SharedFiles const&) = delete; + void operator=(SharedFiles const&) = delete; - std::vector>> m_handlers; -#if MODSEC_USE_GENERAL_LOCK - pthread_mutex_t *m_generalLock; - key_t m_memKeyStructure; -#endif + struct handler_info { + FILE* fp; + unsigned int cnt; + }; + + using handlers_map = std::unordered_map; + handlers_map m_handlers; + + handlers_map::iterator add_new_handler( + const std::string &fileName, std::string *error); }; From faae58eed79d2096210e0e3812f2c10cb21974e9 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Wed, 24 Apr 2024 10:51:07 -0300 Subject: [PATCH 31/66] Added Windows build scripts using Build Tools for Visual Studio 2022 (MSVC compiler & CMake) and Conan package manager - Included Dockerfile to automate the setup process of prerequisites and build of libModSecurity binaries. --- build/win32/CMakeLists.txt | 196 +++++++++++++++++++++++ build/win32/ConfigureChecks.cmake | 18 +++ build/win32/README.md | 111 +++++++++++++ build/win32/conanfile.txt | 15 ++ build/win32/config.h.cmake | 92 +++++++++++ build/win32/docker/Dockerfile | 86 ++++++++++ build/win32/docker/InstallBuildTools.cmd | 17 ++ build/win32/docker/git.inf | 20 +++ vcbuild.bat | 28 ++++ 9 files changed, 583 insertions(+) create mode 100644 build/win32/CMakeLists.txt create mode 100644 build/win32/ConfigureChecks.cmake create mode 100644 build/win32/README.md create mode 100644 build/win32/conanfile.txt create mode 100644 build/win32/config.h.cmake create mode 100644 build/win32/docker/Dockerfile create mode 100644 build/win32/docker/InstallBuildTools.cmd create mode 100644 build/win32/docker/git.inf create mode 100644 vcbuild.bat diff --git a/build/win32/CMakeLists.txt b/build/win32/CMakeLists.txt new file mode 100644 index 00000000..f7bad3ba --- /dev/null +++ b/build/win32/CMakeLists.txt @@ -0,0 +1,196 @@ +cmake_minimum_required(VERSION 3.15) + +set(BASE_DIR ${CMAKE_CURRENT_LIST_DIR}/../..) + +set(USE_ASAN OFF CACHE BOOL "Build with Address Sanitizer") + +# common compiler settings + +# NOTE: MBEDTLS_CONFIG_FILE is not only required to compile the mbedtls subset in others, but also +# when their headers are included while compiling libModSecurity +add_compile_definitions(WIN32 _CRT_SECURE_NO_WARNINGS MBEDTLS_CONFIG_FILE="mbed-tls-config.h") + +# set standards conformance preprocessor & compiler to align with cross-compiled codebase +# NOTE: otherwise visual c++'s default compiler/preprocessor behaviour generates C4067 warnings +# (unexpected tokens following preprocessor directive - expected a newline) +add_compile_options(/Zc:preprocessor /permissive-) + +if(USE_ASAN) + add_compile_options(/fsanitize=address) + add_link_options(/INFERASANLIBS /INCREMENTAL:no) +endif() + +# libinjection + +project(libinjection C) + +add_library(libinjection STATIC ${BASE_DIR}/others/libinjection/src/libinjection_sqli.c ${BASE_DIR}/others/libinjection/src/libinjection_xss.c ${BASE_DIR}/others/libinjection/src/libinjection_html5.c) + +# mbedtls + +project(mbedtls C) + +add_library(mbedtls STATIC ${BASE_DIR}/others/mbedtls/base64.c ${BASE_DIR}/others/mbedtls/sha1.c ${BASE_DIR}/others/mbedtls/md5.c) + +target_include_directories(mbedtls PRIVATE ${BASE_DIR}/others) + +# +# libModSecurity +# + +project(libModSecurity + VERSION + 3.0.12 + LANGUAGES + CXX +) + +set(CMAKE_CXX_STANDARD 17) +set(CMAKE_CXX_STANDARD_REQUIRED On) +set(CMAKE_CXX_EXTENSIONS Off) + +set(PACKAGE_BUGREPORT "security@modsecurity.org") +set(PACKAGE_NAME "modsecurity") +set(PACKAGE_VERSION "${PROJECT_VERSION}") +set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}") +set(PACKAGE_TARNAME "${PACKAGE_NAME}") + +set(HAVE_GEOIP 0) # should always be zero, no conan package available +set(HAVE_LMDB 1) +set(HAVE_LUA 1) +set(HAVE_LIBXML2 1) +set(HAVE_MAXMIND 1) +set(HAVE_SSDEEP 0) # should always be zero, no conan package available +set(HAVE_YAJL 1) # should always be one, mandatory dependency +set(HAVE_CURL 1) + +include(${CMAKE_CURRENT_LIST_DIR}/ConfigureChecks.cmake) + +configure_file(config.h.cmake ${BASE_DIR}/src/config.h) + +find_package(PCRE2 REQUIRED) +find_package(PThreads4W REQUIRED) +find_package(Poco REQUIRED) +find_package(dirent REQUIRED) # used only by tests (check dirent::dirent refernces) + +macro(include_package package flag) + if(${flag}) + find_package(${package} REQUIRED) + endif() +endmacro() + +include_package(yajl HAVE_YAJL) +include_package(libxml2 HAVE_LIBXML2) +include_package(lua HAVE_LUA) +include_package(CURL HAVE_CURL) +include_package(lmdb HAVE_LMDB) +include_package(maxminddb HAVE_MAXMIND) + +# library +# + +# NOTE: required to generate libModSecurity's import library (libModSecurity.lib), used by tests to link with shared library +set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS ON) + +file(GLOB_RECURSE libModSecuritySources ${BASE_DIR}/src/*.cc) + +add_library(libModSecurity SHARED ${libModSecuritySources}) + +target_compile_definitions(libModSecurity PRIVATE WITH_PCRE2) +target_include_directories(libModSecurity PRIVATE ${BASE_DIR} ${BASE_DIR}/headers ${BASE_DIR}/others) +target_link_libraries(libModSecurity PRIVATE pcre2::pcre2 pthreads4w::pthreads4w libinjection mbedtls Poco::Poco Iphlpapi.lib) + +macro(add_package_dependency project compile_definition link_library flag) + if(${flag}) + target_compile_definitions(${project} PRIVATE ${compile_definition}) + target_link_libraries(${project} PRIVATE ${link_library}) + endif() +endmacro() + +add_package_dependency(libModSecurity WITH_YAJL yajl::yajl HAVE_YAJL) +add_package_dependency(libModSecurity WITH_LIBXML2 LibXml2::LibXml2 HAVE_LIBXML2) +add_package_dependency(libModSecurity WITH_LUA lua::lua HAVE_LUA) +if(HAVE_LUA) + target_compile_definitions(libModSecurity PRIVATE WITH_LUA_5_4) +endif() +add_package_dependency(libModSecurity MSC_WITH_CURL CURL::libcurl HAVE_CURL) +add_package_dependency(libModSecurity WITH_LMDB lmdb::lmdb HAVE_LMDB) +add_package_dependency(libModSecurity WITH_MAXMIND maxminddb::maxminddb HAVE_MAXMIND) + +# tests +# + +project(libModSecurityTests) + +function(setTestTargetProperties executable) + target_compile_definitions(${executable} PRIVATE WITH_PCRE2) + target_include_directories(${executable} PRIVATE ${BASE_DIR} ${BASE_DIR}/headers) + target_link_libraries(${executable} PRIVATE libModSecurity pcre2::pcre2 dirent::dirent) + add_package_dependency(${executable} WITH_YAJL yajl::yajl HAVE_YAJL) +endfunction() + +# unit tests +file(GLOB unitTestSources ${BASE_DIR}/test/unit/*.cc) +add_executable(unit_tests ${unitTestSources}) +setTestTargetProperties(unit_tests) +target_compile_options(unit_tests PRIVATE /wd4805) + +# regression tests +file(GLOB regressionTestsSources ${BASE_DIR}/test/regression/*.cc) +add_executable(regression_tests ${regressionTestsSources}) +setTestTargetProperties(regression_tests) + +macro(add_regression_test_capability compile_definition flag) + if(${flag}) + target_compile_definitions(regression_tests PRIVATE ${compile_definition}) + endif() +endmacro() + +add_regression_test_capability(WITH_LUA HAVE_LUA) +add_regression_test_capability(WITH_CURL HAVE_CURL) +add_regression_test_capability(WITH_LMDB HAVE_LMDB) +add_regression_test_capability(WITH_MAXMIND HAVE_MAXMIND) + +# benchmark +add_executable(benchmark ${BASE_DIR}/test/benchmark/benchmark.cc) +setTestTargetProperties(benchmark) + +# rules_optimization +add_executable(rules_optimization ${BASE_DIR}/test/optimization/optimization.cc) +setTestTargetProperties(rules_optimization) + + +# examples +# + +project(libModSecurityExamples) + +function(setExampleTargetProperties executable) + target_include_directories(${executable} PRIVATE ${BASE_DIR} ${BASE_DIR}/headers) + target_link_libraries(${executable} PRIVATE libModSecurity) +endfunction() + +# simple_example_using_c +add_executable(simple_example_using_c ${BASE_DIR}/examples/simple_example_using_c/test.c) +setExampleTargetProperties(simple_example_using_c) + +# using_bodies_in_chunks +add_executable(using_bodies_in_chunks ${BASE_DIR}/examples/using_bodies_in_chunks/simple_request.cc) +setExampleTargetProperties(using_bodies_in_chunks) + +# reading_logs_via_rule_message +add_executable(reading_logs_via_rule_message ${BASE_DIR}/examples/reading_logs_via_rule_message/simple_request.cc) +setExampleTargetProperties(reading_logs_via_rule_message) +target_link_libraries(reading_logs_via_rule_message PRIVATE libModSecurity pthreads4w::pthreads4w) + +# reading_logs_with_offset +add_executable(reading_logs_with_offset ${BASE_DIR}/examples/reading_logs_with_offset/read.cc) +setExampleTargetProperties(reading_logs_with_offset) + +# tools +# + +# rules_check +add_executable(rules_check ${BASE_DIR}/tools/rules-check/rules-check.cc) +target_include_directories(rules_check PRIVATE ${BASE_DIR} ${BASE_DIR}/headers) +target_link_libraries(rules_check PRIVATE libModSecurity) diff --git a/build/win32/ConfigureChecks.cmake b/build/win32/ConfigureChecks.cmake new file mode 100644 index 00000000..6322b696 --- /dev/null +++ b/build/win32/ConfigureChecks.cmake @@ -0,0 +1,18 @@ +include(CheckIncludeFile) +include(CheckIncludeFiles) + +check_include_file("dlfcn.h" HAVE_DLFCN_H) +check_include_file("inttypes.h" HAVE_INTTYPES_H) +check_include_file("stdint.h" HAVE_STDINT_H) +check_include_file("stdio.h" HAVE_STDIO_H) +check_include_file("stdlib.h" HAVE_STDLIB_H) +check_include_file("string" HAVE_STRING) +check_include_file("strings.h" HAVE_STRINGS_H) +check_include_file("string.h" HAVE_STRING_H) +check_include_file("sys/stat.h" HAVE_SYS_STAT_H) +check_include_file("sys/types.h" HAVE_SYS_TYPES_H) +check_include_file("sys/utsname.h" HAVE_SYS_UTSNAME_H) +check_include_file("unistd.h" HAVE_UNISTD_H) + +#/* Define to 1 if you have the ANSI C header files. */ +check_include_files("stdlib.h;stdarg.h;string.h;float.h" STDC_HEADERS) diff --git a/build/win32/README.md b/build/win32/README.md new file mode 100644 index 00000000..7b70cfbd --- /dev/null +++ b/build/win32/README.md @@ -0,0 +1,111 @@ +# libModSecurity Windows build information + +The Windows build of libModSecurity uses Build Tools for Visual Studio 2022 (for Visual C++ & CMake) and Conan package manager. + +## Contents + +- [Prerequisites](#prerequisites) +- [Build](#build) + - [Optional features](#optional-features) + - [Address Sanitizer](#address-sanitizer) + - [Docker container](#docker-container) + +## Prerequisites + + * [Build Tools for Visual Studio 2022](https://aka.ms/vs/17/release/vs_buildtools.exe) + * Install *Desktop development with C++* workload, which includes: + * MSVC C++ compiler + * Windows SDK + * CMake + * Address Sanitizer + * [Conan package manager 2.2.2](https://github.com/conan-io/conan/releases/download/2.2.2/conan-2.2.2-windows-x86_64-installer.exe) + * Install and then setup the default Conan profile to use the MSVC C++ compiler: + 1. Open a command-prompt and set the MSVC C++ compiler environment by executing: `C:\BuildTools\VC\Auxiliary\Build\vcvars64.bat` + 2. Execute: `conan profile detect --force` + * [Git for Windows 2.44.0](https://github.com/git-for-windows/git/releases/download/v2.44.0.windows.1/Git-2.44.0-64-bit.exe) + * To clone the libModSecurity repository. + * NOTE: Make sure to initialize and update submodules (to get `libinjection` and regression tests) + * `git submodule init` + * `git submodule update` + +## Build + +Install the prerequisites listsed in the previous section, checkout libModSecurity and from the directory where it's located execute: + +``` +vcbuild.bat [build_configuration] [arch] [USE_ASAN] +``` + +where `[build_configuration]` can be: `Release` (default), `RelWithDebInfo`, `MinSizeRel` or `Debug`, and `[arch]` can be: `x86_64` (default) or `x86`. + +Built files will be located in the directory: `build\win32\build\[build_configuration]` and include: + + * `libModSecurity.dll` + * Executable files for test projects + * `unit_tests.exe` + * `regression_tests.exe` + * `benchmark.exe` + * `rules_optimization.exe` + * Executable files for examples + * `simple_example_using_c.exe` + * `using_bodies_in_chunks.exe` + * `reading_logs_via_rule_message.exe` + * `reading_logs_with_offset.exe` + * Executable files for tools + * `rules_check.exe` + +NOTE: When building a different configuration, it's recommended to reset: + + * the build directory: `build\win32\build` + * previously built conan packages executing the command: + * `conan remove * -c` + +### Optional features + +By default the following all the following features are enabled by including the associated third-party library through a Conan package: + + * libxml2 2.12.6 for XML processing support + * libcurl 8.6.0 to support http requests from rules + * libmaxminddb 1.9.1 to support reading MaxMind DB files. + * LUA 5.4.6 to enable rules to run scripts in this language for extensibility + * lmdb 0.9.31 in-memory database + +Each of these can be turned off by updating the associated `HAVE_xxx` variable (setting it to zero) in the beginning of the libModSecurity section of `CMakeLists.txt`. + +### Address Sanitizer + +[AddressSanitizer](https://github.com/google/sanitizers/wiki/AddressSanitizer) (aka ASan) is a memory error detector for C/C++. + +To generate a build with *Address Sanitizer*, add the `USE_ASAN` optional third argument to `vcbuild.bat`. For example: + * `vcbuild.bat Debug x86_64 USE_ASAN` + +NOTE: `USE_ASAN` does not work with `Release` & `MinSizeRel` configurations because they do not include debug info (it is only compatible with `Debug` & `RelWithDebInfo` builds). + + * References + * [AddressSanitizer | Microsoft Learn](https://learn.microsoft.com/en-us/cpp/sanitizers/asan?view=msvc-170) + * [AddressSanitizer for Windows: x64 and Debug Build Support - C++ Team Blog (microsoft.com)](https://devblogs.microsoft.com/cppblog/asan-for-windows-x64-and-debug-build-support/) + * [AddressSanitizer language, build, and debugging reference | Microsoft Learn](https://learn.microsoft.com/en-us/cpp/sanitizers/asan-building?view=msvc-170) + +### Docker container + +A `Dockerfile` configuration file is provided in the `docker` subdir that creates a Windows container image which installs the [prerequisites](#prerequisites) and builds libModSecurity and other binaries. + +NOTE: Windows containers are supported in Docker Desktop for Windows, using the *Switch to Windows containers...* option on the context menu of the system tray icon. + +To build the docker image, execute the following command (from the `build\win32\docker` directory): + + * `docker build -t libmodsecurity:latest -m 4GB .` + * Build type, architecture and build with Address Sanitizer can be configured through build arguments (`BUILD_TYPE`, `ARCH` & `USE_ASAN` respectively). For example, to generate a debug build, add the following argument: + * `--build-arg BUILD_TYPE=Debug` + +Once the image is generated, the library and associated binaries (tests & examples) are located in the `C:\src\ModSecurity\build\win32\build\[build_type]` directory. + +To extract the library (`libModSecurity.dll`) from the image, you can execute the following commands: + + * `docker container create --name [container_name] libmodsecurity` + * `docker cp [container_name]:C:\src\ModSecurity\build\win32\build\[build_type]\libModSecurity.dll .` + * NOTE: If you leave out the `libModSecurity.dll` filename out, you can copy all the built binaries (including examples & tests). + +Additionally, the image can be used interactively for additional development work by executing: + + * `docker run -it libmodsecurity` diff --git a/build/win32/conanfile.txt b/build/win32/conanfile.txt new file mode 100644 index 00000000..b1a69821 --- /dev/null +++ b/build/win32/conanfile.txt @@ -0,0 +1,15 @@ +[requires] +yajl/2.1.0 +pcre2/10.42 +pthreads4w/3.0.0 +libxml2/2.12.6 +lua/5.4.6 +libcurl/8.6.0 +lmdb/0.9.31 +libmaxminddb/1.9.1 +dirent/1.24 +poco/1.13.3 + +[generators] +CMakeDeps +CMakeToolchain diff --git a/build/win32/config.h.cmake b/build/win32/config.h.cmake new file mode 100644 index 00000000..2f6a7308 --- /dev/null +++ b/build/win32/config.h.cmake @@ -0,0 +1,92 @@ +/* config.h.cmake. Based upon generated config.h.in. */ + +#ifndef MODSECURITY_CONFIG_H +#define MODSECURITY_CONFIG_H 1 + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_DLFCN_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_INTTYPES_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_IOSTREAM + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_STDINT_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_STDIO_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_STDLIB_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_STRING + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_STRINGS_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_STRING_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_SYS_STAT_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_SYS_TYPES_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_SYS_UTSNAME_H + +/* Define to 1 if you have the header file. */ +#cmakedefine HAVE_UNISTD_H + +/* Define if GeoIP is available */ +#cmakedefine HAVE_GEOIP + +/* Define if LMDB is available */ +#cmakedefine HAVE_LMDB + +/* Define if LUA is available */ +#cmakedefine HAVE_LUA + +/* Define if MaxMind is available */ +#cmakedefine HAVE_MAXMIND + +/* Define if SSDEEP is available */ +#cmakedefine HAVE_SSDEEP + +/* Define if YAJL is available */ +#cmakedefine HAVE_YAJL + +/* Define if libcurl is available */ +#cmakedefine HAVE_CURL + +/* Name of package */ +#define PACKAGE "@PACKAGE_NAME@" + +/* Define to the address where bug reports for this package should be sent. */ +#cmakedefine PACKAGE_BUGREPORT "@PACKAGE_BUGREPORT@" + +/* Define to the full name of this package. */ +#cmakedefine PACKAGE_NAME "@PACKAGE_NAME@" + +/* Define to the full name and version of this package. */ +#cmakedefine PACKAGE_STRING "@PACKAGE_STRING@" + +/* Define to the one symbol short name of this package. */ +#cmakedefine PACKAGE_TARNAME "@PACKAGE_TARNAME@" + +/* Define to the home page for this package. */ +#define PACKAGE_URL "" + +/* Define to the version of this package. */ +#cmakedefine PACKAGE_VERSION "@PACKAGE_VERSION@" + +/* Define to 1 if you have the ANSI C header files. */ +#ifndef STDC_HEADERS +#cmakedefine STDC_HEADERS +#endif + +#endif // ndef MODSECURITY_CONFIG_H \ No newline at end of file diff --git a/build/win32/docker/Dockerfile b/build/win32/docker/Dockerfile new file mode 100644 index 00000000..4967226e --- /dev/null +++ b/build/win32/docker/Dockerfile @@ -0,0 +1,86 @@ +# escape=` + +ARG FROM_IMAGE=mcr.microsoft.com/windows/servercore:ltsc2022 +FROM ${FROM_IMAGE} + +# reset the shell. +SHELL ["cmd", "/S", "/C"] + +# set up environment to collect install errors. +COPY InstallBuildTools.cmd C:\TEMP\ +ADD https://aka.ms/vscollect.exe C:\TEMP\collect.exe + +# download channel for fixed install. +ARG CHANNEL_URL=https://aka.ms/vs/17/release/channel +ADD ${CHANNEL_URL} C:\TEMP\VisualStudio.chman + +# download and install Build Tools for Visual Studio 2022 for native desktop workload. +ADD https://aka.ms/vs/17/release/vs_buildtools.exe C:\TEMP\vs_buildtools.exe +RUN C:\TEMP\InstallBuildTools.cmd C:\TEMP\vs_buildtools.exe --quiet --wait --norestart --nocache ` + --channelUri C:\TEMP\VisualStudio.chman ` + --installChannelUri C:\TEMP\VisualStudio.chman ` + --add Microsoft.VisualStudio.Workload.VCTools ` + --includeRecommended ` + --installPath C:\BuildTools + +# download & install GIT +ARG GIT_VERSION=2.44.0 +ARG GIT_BINARY=Git-${GIT_VERSION}-64-bit.exe +ARG GIT_URL=https://github.com/git-for-windows/git/releases/download/v${GIT_VERSION}.windows.1/${GIT_BINARY} + +COPY git.inf C:\TEMP\ +ARG INSTALLER=C:\TEMP\${GIT_BINARY} +ADD ${GIT_URL} ${INSTALLER} +RUN %INSTALLER% /SP- /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL ` + /NORESTART /CLOSEAPPLICATIONS /RESTARTAPPLICATIONS /LOADINF=git.inf + +# download & setup conan +ARG CONAN_VERSION=2.2.2 +ARG CONAN_BINARY=conan-${CONAN_VERSION}-windows-x86_64-installer.exe +ARG CONAN_URL=https://github.com/conan-io/conan/releases/download/${CONAN_VERSION}/${CONAN_BINARY} + +ARG INSTALLER=C:\TEMP\${CONAN_BINARY} +ADD ${CONAN_URL} ${INSTALLER} +RUN %INSTALLER% /SP- /VERYSILENT /SUPPRESSMSGBOXES + +# setup conan profile +RUN C:\BuildTools\VC\Auxiliary\Build\vcvars64.bat && conan profile detect --force + +# download libModSecurity +# + +# create src dir +ARG SRC_DIR=C:\src + +WORKDIR C:\ +RUN cmd.exe /C md %SRC_DIR% + +# libModSecurity +WORKDIR C:\src + +ARG MOD_SECURITY_TAG=v3/master +RUN git clone -c advice.detachedHead=false --depth 1 --branch %MOD_SECURITY_TAG% https://github.com/owasp-modsecurity/ModSecurity.git + +ARG MOD_SECURITY_DIR=${SRC_DIR}\ModSecurity +WORKDIR ${MOD_SECURITY_DIR} + +# fetch submodules (bindings/python, others/libinjection, test/test-cases/secrules-language-tests) +RUN git submodule init +RUN git submodule update + +# build libraries +# + +ARG BUILD_TYPE=Release +ARG ARCH=x86_64 +ARG USE_ASAN= + +RUN C:\BuildTools\VC\Auxiliary\Build\vcvars64.bat && vcbuild.bat %BUILD_TYPE% %ARCH% %USE_ASAN% + +# setup container's entrypoint +# + +WORKDIR C:\ + +# Use developer command prompt and start PowerShell if no other command specified. +ENTRYPOINT ["C:\\BuildTools\\VC\\Auxiliary\\Build\\vcvars64.bat", "&&", "powershell.exe", "-NoLogo", "-ExecutionPolicy", "Bypass"] diff --git a/build/win32/docker/InstallBuildTools.cmd b/build/win32/docker/InstallBuildTools.cmd new file mode 100644 index 00000000..a0c07c78 --- /dev/null +++ b/build/win32/docker/InstallBuildTools.cmd @@ -0,0 +1,17 @@ +@rem Copyright (C) Microsoft Corporation. All rights reserved. +@rem Licensed under the MIT license. See LICENSE.txt in the project root for license information. + +@if not defined _echo echo off +setlocal enabledelayedexpansion + +call %* +if "%ERRORLEVEL%"=="3010" ( + exit /b 0 +) else ( + if not "%ERRORLEVEL%"=="0" ( + set ERR=%ERRORLEVEL% + call C:\TEMP\collect.exe -zip:C:\vslogs.zip + + exit /b !ERR! + ) +) diff --git a/build/win32/docker/git.inf b/build/win32/docker/git.inf new file mode 100644 index 00000000..49781dd9 --- /dev/null +++ b/build/win32/docker/git.inf @@ -0,0 +1,20 @@ +[Setup] +Lang=default +Dir=C:\Program Files\Git +Group=Git +NoIcons=0 +SetupType=default +Components=ext,ext\shellhere,ext\guihere,gitlfs,assoc,autoupdate +Tasks= +EditorOption=VIM +CustomEditorPath= +PathOption=Cmd +SSHOption=OpenSSH +TortoiseOption=false +CURLOption=WinSSL +CRLFOption=LFOnly +BashTerminalOption=ConHost +PerformanceTweaksFSCache=Enabled +UseCredentialManager=Enabled +EnableSymlinks=Disabled +EnableBuiltinInteractiveAdd=Disabled \ No newline at end of file diff --git a/vcbuild.bat b/vcbuild.bat new file mode 100644 index 00000000..0789c9f8 --- /dev/null +++ b/vcbuild.bat @@ -0,0 +1,28 @@ +@rem For Windows build information, see build\win32\README.md + +@echo off +pushd %CD% + +if not "%1"=="" (set build_type=%1) else (set build_type=Release) +echo Build type: %build_type% + +if not "%2"=="" (set arch=%2) else (set arch=x86_64) +echo Arch: %arch% + +if "%3"=="USE_ASAN" ( + echo Address Sanitizer: Enabled + set CI_ASAN=-c tools.build:cxxflags="[""/fsanitize=address""]" + set ASAN_FLAG=ON +) else ( + echo Address Sanitizer: Disabled + set CI_ASAN= + set ASAN_FLAG=OFF +) + +cd build\win32 +conan install . -s compiler.cppstd=17 %CI_ASAN% --output-folder=build --build=missing --settings=build_type=%build_type% --settings=arch=%arch% +cd build +cmake .. -G "Visual Studio 17 2022" -DCMAKE_TOOLCHAIN_FILE=conan_toolchain.cmake -DUSE_ASAN=%ASAN_FLAG% +cmake --build . --config %build_type% + +popd From 411bbb2d36ad286483a4741b6ad38aadb66c83fe Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Fri, 26 Apr 2024 10:28:39 -0300 Subject: [PATCH 32/66] Updated case of winsock header files - Address SonarCloud cpp:S3806 issues ("#include" paths should be portable) - This is not an actual issue in this case, because WinSock2.h and WS2tcpip.h are Windows only. --- src/operators/rbl.cc | 4 ++-- src/operators/rbl.h | 2 +- src/unique_id.cc | 2 +- src/utils/geo_lookup.cc | 2 +- src/utils/https_client.cc | 2 +- src/utils/ip_tree.cc | 2 +- src/utils/msc_tree.cc | 4 ++-- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/operators/rbl.cc b/src/operators/rbl.cc index eb7c3f0b..f1561e7f 100644 --- a/src/operators/rbl.cc +++ b/src/operators/rbl.cc @@ -22,8 +22,8 @@ #include #include #else -#include -#include +#include +#include #endif #include diff --git a/src/operators/rbl.h b/src/operators/rbl.h index 7f70b599..30fcaa3e 100644 --- a/src/operators/rbl.h +++ b/src/operators/rbl.h @@ -23,7 +23,7 @@ #include #include #else -#include +#include #endif #include diff --git a/src/unique_id.cc b/src/unique_id.cc index c6234112..3106776e 100644 --- a/src/unique_id.cc +++ b/src/unique_id.cc @@ -18,7 +18,7 @@ #ifdef WIN32 #include "src/compat/msvc.h" -#include +#include #include #endif diff --git a/src/utils/geo_lookup.cc b/src/utils/geo_lookup.cc index e76e728d..4e06a1ec 100644 --- a/src/utils/geo_lookup.cc +++ b/src/utils/geo_lookup.cc @@ -18,7 +18,7 @@ #include #include #else -#include +#include #endif #include diff --git a/src/utils/https_client.cc b/src/utils/https_client.cc index 66e818d4..f413e8ca 100644 --- a/src/utils/https_client.cc +++ b/src/utils/https_client.cc @@ -26,7 +26,7 @@ #include #include #else -#include +#include #endif #include diff --git a/src/utils/ip_tree.cc b/src/utils/ip_tree.cc index c4c38f1c..124bc47f 100644 --- a/src/utils/ip_tree.cc +++ b/src/utils/ip_tree.cc @@ -21,7 +21,7 @@ #include #include #else -#include +#include #endif #include diff --git a/src/utils/msc_tree.cc b/src/utils/msc_tree.cc index c2850750..27c7461c 100644 --- a/src/utils/msc_tree.cc +++ b/src/utils/msc_tree.cc @@ -21,8 +21,8 @@ #include #else #include "src/compat/msvc.h" -#include -#include +#include +#include #endif #include "src/utils/msc_tree.h" From b69405a372dbcdf843b47c4901bca903f2ce2362 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Fri, 26 Apr 2024 10:35:01 -0300 Subject: [PATCH 33/66] Use default keyword to implement constructor/destructor - Addresses SonarCloud cpp:S3490 issue (Special member function should not be defined unless a non standard behavior is required) --- src/debug_log/debug_log_writer.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/debug_log/debug_log_writer.h b/src/debug_log/debug_log_writer.h index 698ff358..46b641d6 100644 --- a/src/debug_log/debug_log_writer.h +++ b/src/debug_log/debug_log_writer.h @@ -37,8 +37,8 @@ class DebugLogWriter { static int open(const std::string& m_fileName, std::string *error); private: - DebugLogWriter() { } - ~DebugLogWriter() { } + DebugLogWriter() = default; + ~DebugLogWriter() = default; // C++ 03 // ======== From a8e132f3a18e24ba5f11d394d50cf65e2f88201d Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Fri, 26 Apr 2024 10:50:24 -0300 Subject: [PATCH 34/66] Replaced the use of "new" in find_resource - Addresses SonarCloud issue cpp:S5025 (Memory should not be managed manually) - This function was not changed for the Windows port, but a similar change to the one suggested was done in expandEnv in the same file. - The first stream is not destructed at the exact same point it was in the previous code (but rather when the second stream replaces it on assignment to the same variable). An arbitrary scope could have been introduced to destruct the object at the same place, but it doesn't seem to be necessary and would make the code a bit strange. --- src/utils/system.cc | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/src/utils/system.cc b/src/utils/system.cc index ef4e5060..f48afb7d 100644 --- a/src/utils/system.cc +++ b/src/utils/system.cc @@ -98,19 +98,15 @@ double cpu_seconds(void) { std::string find_resource(const std::string& resource, const std::string& config, std::string *err) { - std::ifstream *iss; err->assign("Looking at: "); // Trying absolute or relative to the current dir. - iss = new std::ifstream(resource, std::ios::in); - if (iss->is_open()) { - iss->close(); - delete iss; + auto iss = std::ifstream(resource, std::ios::in); + if (iss.is_open()) { return resource; } else { err->append("'" + resource + "', "); } - delete iss; // What about `*' ? if (utils::expandEnv(resource, 0).size() > 0) { @@ -121,15 +117,12 @@ std::string find_resource(const std::string& resource, // Trying the same path of the configuration file. std::string f = get_path(config) + "/" + resource; - iss = new std::ifstream(f, std::ios::in); - if (iss->is_open()) { - iss->close(); - delete iss; + iss = std::ifstream(f, std::ios::in); + if (iss.is_open()) { return f; } else { err->append("'" + f + "', "); } - delete iss; // What about `*' ? if (utils::expandEnv(f, 0).size() > 0) { From 4b8c3679b9f3a86228bb09d3e05e137c6df5a177 Mon Sep 17 00:00:00 2001 From: Rohan Krishnaswamy <47869999+rkrishn7@users.noreply.github.com> Date: Sun, 12 May 2024 18:49:02 -0700 Subject: [PATCH 35/66] Add link to Rust bindings in README (#1) --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3be08810..d41e19d2 100644 --- a/README.md +++ b/README.md @@ -262,8 +262,9 @@ new issue, please check if there is one already opened on the same topic. ## Bindings -The libModSecurity design allows the integration with bindings. There is an effort to avoid breaking API [binary] compatibility to make an easy integration with possible bindings. Currently, there are two notable projects maintained by the community: +The libModSecurity design allows the integration with bindings. There is an effort to avoid breaking API [binary] compatibility to make an easy integration with possible bindings. Currently, there are a few notable projects maintained by the community: * Python - https://github.com/actions-security/pymodsecurity + * Rust - https://github.com/rkrishn7/rust-modsecurity * Varnish - https://github.com/xdecock/vmod-modsecurity ## Packaging From e6e2989bd597a7bb454e975d371db46591a77b77 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sat, 11 May 2024 14:52:32 +0000 Subject: [PATCH 36/66] Configure test fixture using CTest for Windows build - Added new test/test_suite.in with list of regression and unit tests previously in Makefile.am, to be shared between Unix and Windows builds. - Updated regression.cc & unit.cc to return the number of failed tests to indicate to CTest that the test failed. Similarly, a crash or unhandled exception terminates the process with a non-zero exit code. - This change doesn't affect running the tests with autotest in Unix builds because this processes test output from custom-test-driver & test-suite.sh, and ignores the exit code of the test runner. - Removed comment in test/test-cases/regression-offset-variable.json as this is not supported by JSON and prevents strict parsers to read and process the file. - Minor change in regression.cc's clearAuditLog to replace std::ifstream with std::ofstream as the mode to open the flag applies to an output stream. - Minor change in unit.cc to simplify code that deletes tests. - Minor changes to test/custom-test-driver to correct usage information. --- Makefile.am | 257 +----------------- build/win32/CMakeLists.txt | 33 +++ build/win32/docker/Dockerfile | 29 ++ test/custom-test-driver | 6 +- test/regression/regression.cc | 7 +- .../regression/offset-variable.json | 2 - test/test-suite.in | 255 +++++++++++++++++ test/test-suite.sh | 6 +- test/unit/unit.cc | 25 +- 9 files changed, 338 insertions(+), 282 deletions(-) create mode 100644 test/test-suite.in diff --git a/Makefile.am b/Makefile.am index 501fcfdf..5983c7c4 100644 --- a/Makefile.am +++ b/Makefile.am @@ -89,263 +89,8 @@ LOG_DRIVER = env $(SHELL) $(top_srcdir)/test/custom-test-driver AM_TESTS_ENVIRONMENT=AUTOMAKE_TESTS=true; export AUTOMAKE_TESTS; LOG_COMPILER=test/test-suite.sh -# for i in `find test/test-cases -iname *.json`; do echo TESTS+=$i; done TESTS= -TESTS+=test/test-cases/regression/action-allow.json -TESTS+=test/test-cases/regression/action-block.json -TESTS+=test/test-cases/regression/action-ctl_request_body_access.json -TESTS+=test/test-cases/regression/action-ctl_request_body_processor.json -TESTS+=test/test-cases/regression/action-ctl_request_body_processor_urlencoded.json -TESTS+=test/test-cases/regression/action-ctl_rule_engine.json -TESTS+=test/test-cases/regression/action-ctl_audit_engine.json -TESTS+=test/test-cases/regression/action-ctl_rule_remove_by_id.json -TESTS+=test/test-cases/regression/action-ctl_rule_remove_by_tag.json -TESTS+=test/test-cases/regression/action-ctl_rule_remove_target_by_id.json -TESTS+=test/test-cases/regression/action-ctl_rule_remove_target_by_tag.json -TESTS+=test/test-cases/regression/action-disruptive.json -TESTS+=test/test-cases/regression/action-exec.json -TESTS+=test/test-cases/regression/action-expirevar.json -TESTS+=test/test-cases/regression/action-id.json -TESTS+=test/test-cases/regression/action-initcol.json -TESTS+=test/test-cases/regression/action-msg.json -TESTS+=test/test-cases/regression/action-setenv.json -TESTS+=test/test-cases/regression/action-setrsc.json -TESTS+=test/test-cases/regression/action-setsid.json -TESTS+=test/test-cases/regression/action-setuid.json -TESTS+=test/test-cases/regression/actions.json -TESTS+=test/test-cases/regression/action-skip.json -TESTS+=test/test-cases/regression/action-tag.json -TESTS+=test/test-cases/regression/action-tnf-base64.json -TESTS+=test/test-cases/regression/action-xmlns.json -TESTS+=test/test-cases/regression/auditlog.json -TESTS+=test/test-cases/regression/collection-case-insensitive.json -TESTS+=test/test-cases/regression/collection-lua.json -TESTS+=test/test-cases/regression/collection-regular_expression_selection.json -TESTS+=test/test-cases/regression/collection-resource.json -TESTS+=test/test-cases/regression/collection-tx.json -TESTS+=test/test-cases/regression/collection-tx-with-macro.json -TESTS+=test/test-cases/regression/config-body_limits.json -TESTS+=test/test-cases/regression/config-calling_phases_by_name.json -TESTS+=test/test-cases/regression/config-include-bad.json -TESTS+=test/test-cases/regression/config-include.json -TESTS+=test/test-cases/regression/config-remove_by_id.json -TESTS+=test/test-cases/regression/config-remove_by_msg.json -TESTS+=test/test-cases/regression/config-remove_by_tag.json -TESTS+=test/test-cases/regression/config-response_type.json -TESTS+=test/test-cases/regression/config-secdefaultaction.json -TESTS+=test/test-cases/regression/config-secremoterules.json -TESTS+=test/test-cases/regression/config-update-action-by-id.json -TESTS+=test/test-cases/regression/config-update-target-by-id.json -TESTS+=test/test-cases/regression/config-update-target-by-msg.json -TESTS+=test/test-cases/regression/config-update-target-by-tag.json -TESTS+=test/test-cases/regression/config-xml_external_entity.json -TESTS+=test/test-cases/regression/debug_log.json -TESTS+=test/test-cases/regression/directive-sec_rule_script.json -TESTS+=test/test-cases/regression/issue-1152.json -TESTS+=test/test-cases/regression/issue-1528.json -TESTS+=test/test-cases/regression/issue-1565.json -TESTS+=test/test-cases/regression/issue-1576.json -TESTS+=test/test-cases/regression/issue-1591.json -TESTS+=test/test-cases/regression/issue-1725.json -TESTS+=test/test-cases/regression/issue-1743.json -TESTS+=test/test-cases/regression/issue-1785.json -TESTS+=test/test-cases/regression/issue-1812.json -TESTS+=test/test-cases/regression/issue-1831.json -TESTS+=test/test-cases/regression/issue-1844.json -TESTS+=test/test-cases/regression/issue-1850.json -TESTS+=test/test-cases/regression/issue-1941.json -TESTS+=test/test-cases/regression/issue-1943.json -TESTS+=test/test-cases/regression/issue-1956.json -TESTS+=test/test-cases/regression/issue-1960.json -TESTS+=test/test-cases/regression/issue-2099.json -TESTS+=test/test-cases/regression/issue-2000.json -TESTS+=test/test-cases/regression/issue-2111.json -TESTS+=test/test-cases/regression/issue-2196.json -TESTS+=test/test-cases/regression/issue-2423-msg-in-chain.json -TESTS+=test/test-cases/regression/issue-2427.json -TESTS+=test/test-cases/regression/issue-2296.json -TESTS+=test/test-cases/regression/issue-394.json -TESTS+=test/test-cases/regression/issue-849.json -TESTS+=test/test-cases/regression/issue-960.json -TESTS+=test/test-cases/regression/misc.json -TESTS+=test/test-cases/regression/misc-variable-under-quotes.json -TESTS+=test/test-cases/regression/offset-variable.json -TESTS+=test/test-cases/regression/operator-detectsqli.json -TESTS+=test/test-cases/regression/operator-detectxss.json -TESTS+=test/test-cases/regression/operator-fuzzyhash.json -TESTS+=test/test-cases/regression/operator-inpectFile.json -TESTS+=test/test-cases/regression/operator-ipMatchFromFile.json -TESTS+=test/test-cases/regression/operator-pm.json -TESTS+=test/test-cases/regression/operator-rx.json -TESTS+=test/test-cases/regression/operator-rxGlobal.json -TESTS+=test/test-cases/regression/operator-UnconditionalMatch.json -TESTS+=test/test-cases/regression/operator-validate-byte-range.json -TESTS+=test/test-cases/regression/operator-verifycc.json -TESTS+=test/test-cases/regression/operator-verifycpf.json -TESTS+=test/test-cases/regression/operator-verifyssn.json -TESTS+=test/test-cases/regression/operator-verifysvnr.json -TESTS+=test/test-cases/regression/request-body-parser-json.json -TESTS+=test/test-cases/regression/request-body-parser-multipart-crlf.json -TESTS+=test/test-cases/regression/request-body-parser-multipart.json -TESTS+=test/test-cases/regression/request-body-parser-xml.json -TESTS+=test/test-cases/regression/request-body-parser-xml-validade-dtd.json -TESTS+=test/test-cases/regression/rule-920120.json -TESTS+=test/test-cases/regression/rule-920200.json -TESTS+=test/test-cases/regression/rule-920274.json -TESTS+=test/test-cases/regression/secaction.json -TESTS+=test/test-cases/regression/secargumentslimit.json -TESTS+=test/test-cases/regression/sec_component_signature.json -TESTS+=test/test-cases/regression/secmarker.json -TESTS+=test/test-cases/regression/secruleengine.json -TESTS+=test/test-cases/regression/transformation-none.json -TESTS+=test/test-cases/regression/transformations.json -TESTS+=test/test-cases/regression/variable-ARGS_COMBINED_SIZE.json -TESTS+=test/test-cases/regression/variable-ARGS_GET.json -TESTS+=test/test-cases/regression/variable-ARGS_GET_NAMES.json -TESTS+=test/test-cases/regression/variable-ARGS.json -TESTS+=test/test-cases/regression/variable-ARGS_NAMES.json -TESTS+=test/test-cases/regression/variable-ARGS_POST.json -TESTS+=test/test-cases/regression/variable-ARGS_POST_NAMES.json -TESTS+=test/test-cases/regression/variable-AUTH_TYPE.json -TESTS+=test/test-cases/regression/variable-DURATION.json -TESTS+=test/test-cases/regression/variable-ENV.json -TESTS+=test/test-cases/regression/variable-FILES_COMBINED_SIZE.json -TESTS+=test/test-cases/regression/variable-FILES.json -TESTS+=test/test-cases/regression/variable-FILES_NAMES.json -TESTS+=test/test-cases/regression/variable-FILES_SIZES.json -TESTS+=test/test-cases/regression/variable-FULL_REQUEST.json -TESTS+=test/test-cases/regression/variable-FULL_REQUEST_LENGTH.json -TESTS+=test/test-cases/regression/variable-GEO.json -TESTS+=test/test-cases/regression/variable-HIGHEST_SEVERITY.json -TESTS+=test/test-cases/regression/variable-INBOUND_DATA_ERROR.json -TESTS+=test/test-cases/regression/variable-MATCHED_VAR.json -TESTS+=test/test-cases/regression/variable-MATCHED_VAR_NAME.json -TESTS+=test/test-cases/regression/variable-MATCHED_VARS.json -TESTS+=test/test-cases/regression/variable-MATCHED_VARS_NAMES.json -TESTS+=test/test-cases/regression/variable-MODSEC_BUILD.json -TESTS+=test/test-cases/regression/variable-MULTIPART_CRLF_LF_LINES.json -TESTS+=test/test-cases/regression/variable-MULTIPART_FILENAME.json -TESTS+=test/test-cases/regression/variable-MULTIPART_INVALID_HEADER_FOLDING.json -TESTS+=test/test-cases/regression/variable-MULTIPART_NAME.json -TESTS+=test/test-cases/regression/variable-MULTIPART_PART_HEADERS.json -TESTS+=test/test-cases/regression/variable-MULTIPART_STRICT_ERROR.json -TESTS+=test/test-cases/regression/variable-MULTIPART_UNMATCHED_BOUNDARY.json -TESTS+=test/test-cases/regression/variable-OUTBOUND_DATA_ERROR.json -TESTS+=test/test-cases/regression/variable-PATH_INFO.json -TESTS+=test/test-cases/regression/variable-QUERY_STRING.json -TESTS+=test/test-cases/regression/variable-REMOTE_ADDR.json -TESTS+=test/test-cases/regression/variable-REMOTE_HOST.json -TESTS+=test/test-cases/regression/variable-REMOTE_PORT.json -TESTS+=test/test-cases/regression/variable-REMOTE_USER.json -TESTS+=test/test-cases/regression/variable-REQBODY_PROCESSOR_ERROR.json -TESTS+=test/test-cases/regression/variable-REQBODY_PROCESSOR.json -TESTS+=test/test-cases/regression/variable-REQUEST_BASENAME.json -TESTS+=test/test-cases/regression/variable-REQUEST_BODY.json -TESTS+=test/test-cases/regression/variable-REQUEST_BODY_LENGTH.json -TESTS+=test/test-cases/regression/variable-REQUEST_COOKIES.json -TESTS+=test/test-cases/regression/variable-REQUEST_COOKIES_NAMES.json -TESTS+=test/test-cases/regression/variable-REQUEST_FILENAME.json -TESTS+=test/test-cases/regression/variable-REQUEST_HEADERS.json -TESTS+=test/test-cases/regression/variable-REQUEST_HEADERS_NAMES.json -TESTS+=test/test-cases/regression/variable-REQUEST_LINE.json -TESTS+=test/test-cases/regression/variable-REQUEST_METHOD.json -TESTS+=test/test-cases/regression/variable-REQUEST_PROTOCOL.json -TESTS+=test/test-cases/regression/variable-REQUEST_URI.json -TESTS+=test/test-cases/regression/variable-REQUEST_URI_RAW.json -TESTS+=test/test-cases/regression/variable-RESPONSE_BODY.json -TESTS+=test/test-cases/regression/variable-RESPONSE_CONTENT_LENGTH.json -TESTS+=test/test-cases/regression/variable-RESPONSE_CONTENT_TYPE.json -TESTS+=test/test-cases/regression/variable-RESPONSE_HEADERS.json -TESTS+=test/test-cases/regression/variable-RESPONSE_HEADERS_NAMES.json -TESTS+=test/test-cases/regression/variable-RESPONSE_PROTOCOL.json -TESTS+=test/test-cases/regression/variable-RULE.json -TESTS+=test/test-cases/regression/variable-SERVER_ADDR.json -TESTS+=test/test-cases/regression/variable-SERVER_NAME.json -TESTS+=test/test-cases/regression/variable-SERVER_PORT.json -TESTS+=test/test-cases/regression/variable-SESSIONID.json -TESTS+=test/test-cases/regression/variable-STATUS.json -TESTS+=test/test-cases/regression/variable-TIME_DAY.json -TESTS+=test/test-cases/regression/variable-TIME_EPOCH.json -TESTS+=test/test-cases/regression/variable-TIME_HOUR.json -TESTS+=test/test-cases/regression/variable-TIME.json -TESTS+=test/test-cases/regression/variable-TIME_MIN.json -TESTS+=test/test-cases/regression/variable-TIME_MON.json -TESTS+=test/test-cases/regression/variable-TIME_SEC.json -TESTS+=test/test-cases/regression/variable-TIME_WDAY.json -TESTS+=test/test-cases/regression/variable-TIME_YEAR.json -TESTS+=test/test-cases/regression/variable-TX.json -TESTS+=test/test-cases/regression/variable-UNIQUE_ID.json -TESTS+=test/test-cases/regression/variable-URLENCODED_ERROR.json -TESTS+=test/test-cases/regression/variable-USERID.json -TESTS+=test/test-cases/regression/variable-variation-count.json -TESTS+=test/test-cases/regression/variable-variation-exclusion.json -TESTS+=test/test-cases/regression/variable-WEBAPPID.json -TESTS+=test/test-cases/regression/variable-WEBSERVER_ERROR_LOG.json -TESTS+=test/test-cases/regression/variable-XML.json -TESTS+=test/test-cases/secrules-language-tests/operators/beginsWith.json -TESTS+=test/test-cases/secrules-language-tests/operators/contains.json -TESTS+=test/test-cases/secrules-language-tests/operators/containsWord.json -TESTS+=test/test-cases/secrules-language-tests/operators/detectSQLi.json -TESTS+=test/test-cases/secrules-language-tests/operators/detectXSS.json -TESTS+=test/test-cases/secrules-language-tests/operators/endsWith.json -TESTS+=test/test-cases/secrules-language-tests/operators/eq.json -TESTS+=test/test-cases/secrules-language-tests/operators/ge.json -TESTS+=test/test-cases/secrules-language-tests/operators/geoLookup.json -TESTS+=test/test-cases/secrules-language-tests/operators/gt.json -TESTS+=test/test-cases/secrules-language-tests/operators/ipMatch.json -TESTS+=test/test-cases/secrules-language-tests/operators/le.json -TESTS+=test/test-cases/secrules-language-tests/operators/lt.json -TESTS+=test/test-cases/secrules-language-tests/operators/noMatch.json -TESTS+=test/test-cases/secrules-language-tests/operators/pmFromFile.json -TESTS+=test/test-cases/secrules-language-tests/operators/pm.json -TESTS+=test/test-cases/secrules-language-tests/operators/rx.json -TESTS+=test/test-cases/secrules-language-tests/operators/rxGlobal.json -TESTS+=test/test-cases/secrules-language-tests/operators/streq.json -TESTS+=test/test-cases/secrules-language-tests/operators/strmatch.json -TESTS+=test/test-cases/secrules-language-tests/operators/unconditionalMatch.json -TESTS+=test/test-cases/secrules-language-tests/operators/validateByteRange.json -TESTS+=test/test-cases/secrules-language-tests/operators/validateUrlEncoding.json -TESTS+=test/test-cases/secrules-language-tests/operators/validateUtf8Encoding.json -TESTS+=test/test-cases/secrules-language-tests/operators/verifyCC.json -TESTS+=test/test-cases/secrules-language-tests/operators/verifycpf.json -TESTS+=test/test-cases/secrules-language-tests/operators/verifyssn.json -TESTS+=test/test-cases/secrules-language-tests/operators/verifysvnr.json -TESTS+=test/test-cases/secrules-language-tests/operators/within.json -TESTS+=test/test-cases/secrules-language-tests/transformations/base64DecodeExt.json -TESTS+=test/test-cases/secrules-language-tests/transformations/base64Decode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/base64Encode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/cmdLine.json -TESTS+=test/test-cases/secrules-language-tests/transformations/compressWhitespace.json -TESTS+=test/test-cases/secrules-language-tests/transformations/cssDecode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/escapeSeqDecode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/hexDecode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/hexEncode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/htmlEntityDecode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/jsDecode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/length.json -TESTS+=test/test-cases/secrules-language-tests/transformations/lowercase.json -TESTS+=test/test-cases/secrules-language-tests/transformations/md5.json -TESTS+=test/test-cases/secrules-language-tests/transformations/normalisePath.json -TESTS+=test/test-cases/secrules-language-tests/transformations/normalisePathWin.json -TESTS+=test/test-cases/secrules-language-tests/transformations/parityEven7bit.json -TESTS+=test/test-cases/secrules-language-tests/transformations/parityOdd7bit.json -TESTS+=test/test-cases/secrules-language-tests/transformations/parityZero7bit.json -TESTS+=test/test-cases/secrules-language-tests/transformations/removeCommentsChar.json -TESTS+=test/test-cases/secrules-language-tests/transformations/removeComments.json -TESTS+=test/test-cases/secrules-language-tests/transformations/removeNulls.json -TESTS+=test/test-cases/secrules-language-tests/transformations/removeWhitespace.json -TESTS+=test/test-cases/secrules-language-tests/transformations/replaceComments.json -TESTS+=test/test-cases/secrules-language-tests/transformations/replaceNulls.json -TESTS+=test/test-cases/secrules-language-tests/transformations/sha1.json -TESTS+=test/test-cases/secrules-language-tests/transformations/sqlHexDecode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/trim.json -TESTS+=test/test-cases/secrules-language-tests/transformations/trimLeft.json -TESTS+=test/test-cases/secrules-language-tests/transformations/trimRight.json -TESTS+=test/test-cases/secrules-language-tests/transformations/urlDecode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/urlDecodeUni.json -TESTS+=test/test-cases/secrules-language-tests/transformations/urlEncode.json -TESTS+=test/test-cases/secrules-language-tests/transformations/utf8toUnicode.json - +include test/test-suite.in pkgconfigdir = $(libdir)/pkgconfig pkgconfig_DATA = modsecurity.pc diff --git a/build/win32/CMakeLists.txt b/build/win32/CMakeLists.txt index f7bad3ba..9b52926c 100644 --- a/build/win32/CMakeLists.txt +++ b/build/win32/CMakeLists.txt @@ -151,6 +151,39 @@ add_regression_test_capability(WITH_CURL HAVE_CURL) add_regression_test_capability(WITH_LMDB HAVE_LMDB) add_regression_test_capability(WITH_MAXMIND HAVE_MAXMIND) +enable_testing() + +file(READ ${BASE_DIR}/test/test-suite.in TEST_FILES_RAW) +string(REPLACE "\n" ";" TEST_FILES ${TEST_FILES_RAW}) + +foreach(TEST_FILE ${TEST_FILES}) + # ignore comment lines + string(FIND ${TEST_FILE} "#" is_comment) + if(NOT is_comment EQUAL 0) + string(FIND ${TEST_FILE} "TESTS+=" is_valid_prefix) + if(NOT is_valid_prefix EQUAL 0) + message(FATAL_ERROR "Invalid prefix in line: ${TEST_FILE}") + endif() + + # remove 'TESTS+=' prefix and 'test/' too because tests are launched + # from that directory + string(SUBSTRING ${TEST_FILE} 12 -1 TEST_FILE) + + # test name + get_filename_component(TEST_NAME ${TEST_FILE} NAME_WE) + + # determine test runner based on test path prefix + string(FIND ${TEST_FILE} "test-cases/regression/" is_regression_test) + if(is_regression_test EQUAL 0) + set(TEST_RUNNER "regression_tests") + else() + set(TEST_RUNNER "unit_tests") + endif() + + add_test(NAME ${TEST_NAME} COMMAND ${TEST_RUNNER} ${TEST_FILE} WORKING_DIRECTORY ${BASE_DIR}/test) + endif() +endforeach() + # benchmark add_executable(benchmark ${BASE_DIR}/test/benchmark/benchmark.cc) setTestTargetProperties(benchmark) diff --git a/build/win32/docker/Dockerfile b/build/win32/docker/Dockerfile index 4967226e..1dc60482 100644 --- a/build/win32/docker/Dockerfile +++ b/build/win32/docker/Dockerfile @@ -77,6 +77,35 @@ ARG USE_ASAN= RUN C:\BuildTools\VC\Auxiliary\Build\vcvars64.bat && vcbuild.bat %BUILD_TYPE% %ARCH% %USE_ASAN% +# test suite +# + +# setup test environment +RUN cmd.exe /C md \tmp +RUN cmd.exe /C md \bin +RUN cmd.exe /C copy "C:\Program Files\GIT\usr\bin" \bin > NUL +RUN cmd.exe /C copy "C:\Program Files\GIT\usr\bin\echo.exe" \bin\echo > NUL + +# disable tests that don't work on windows +ARG JQ_VERSION=1.7.1 +ARG JQ_BINARY=jq-windows-amd64.exe +ARG JQ_URL=https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/${JQ_BINARY} + +ARG JQ_BIN=C:\TEMP\jq.exe +ADD ${JQ_URL} ${JQ_BIN} + +WORKDIR ${MOD_SECURITY_DIR}\test\test-cases\regression + +RUN %JQ_BIN% "map(if .title == \"Test match variable (1/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json +RUN %JQ_BIN% "map(if .title == \"Test match variable (2/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json +RUN %JQ_BIN% "map(if .title == \"Test match variable (3/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json +RUN %JQ_BIN% "map(if .title == \"Variable offset - FILES_NAMES\" then .enabled = 0 else . end)" offset-variable.json > tmp.json && move /Y tmp.json offset-variable.json + +# run tests +WORKDIR ${MOD_SECURITY_DIR}\build\win32\build + +RUN C:\BuildTools\VC\Auxiliary\Build\vcvars64.bat && ctest -C %BUILD_TYPE% --output-on-failure + # setup container's entrypoint # diff --git a/test/custom-test-driver b/test/custom-test-driver index aa490ee6..d9b0d0ff 100755 --- a/test/custom-test-driver +++ b/test/custom-test-driver @@ -42,9 +42,9 @@ print_usage () { cat <print() << std::endl; } + const int skp = std::count_if(results.cbegin(), results.cend(), [](const auto &i) + { return i->skipped; }); + const int failed = results.size() - skp; + if (!test.m_automake_output) { std::cout << std::endl; @@ -202,13 +206,7 @@ int main(int argc, char **argv) { if (results.size() == 0) { std::cout << KGRN << "All tests passed" << RESET << std::endl; } else { - int skp = 0; - for (const auto &i : results) { - if (i->skipped == true) { - skp++; - } - } - std::cout << KRED << results.size()-skp << " failed."; + std::cout << KRED << failed << " failed."; std::cout << RESET << std::endl; if (skp > 0) { std::cout << " " << std::to_string(skp) << " "; @@ -217,13 +215,12 @@ int main(int argc, char **argv) { } } - for (std::pair *> a : test) { - std::vector *vec = a.second; - for (int i = 0; i < vec->size(); i++) { - delete vec->at(i); - } + for (auto a : test) { + auto *vec = a.second; + for(auto *t : *vec) + delete t; delete vec; } + + return failed; } - - From 6bf78f2560fc60e47f0753b4db2aa8727d22c798 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Mon, 13 May 2024 13:37:24 -0700 Subject: [PATCH 37/66] Added GitHub workflow to build libModSecurity on Windows. --- .github/workflows/ci.yml | 46 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3350743b..110bfa69 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,3 +72,49 @@ jobs: run: make -j `sysctl -n hw.logicalcpu` - name: check run: make check + + build-windows: + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [windows-2022] + platform: [x86_64] + configuration: [Release] + steps: + - uses: actions/checkout@v4 + with: + submodules: true + - name: Install Conan + run: | + pip3 install conan --upgrade + conan profile detect + - uses: ammaraskar/msvc-problem-matcher@master + - name: Build ${{ matrix.configuration }} ${{ matrix.platform }} + shell: cmd + run: vcbuild.bat ${{ matrix.configuration }} ${{ matrix.platform }} + - name: Set up test environment + working-directory: build\win32\build\${{ matrix.configuration }} + env: + BASE_DIR: ..\..\..\.. + shell: cmd + run: | + copy unit_tests.exe %BASE_DIR%\test + copy regression_tests.exe %BASE_DIR%\test + copy libModSecurity.dll %BASE_DIR%\test + copy %BASE_DIR%\unicode.mapping %BASE_DIR%\test + md \tmp + md \bin + copy "C:\Program Files\Git\usr\bin\echo.exe" \bin + copy "C:\Program Files\Git\usr\bin\echo.exe" \bin\echo + - name: Disable tests that don't work on Windows + working-directory: test\test-cases\regression + shell: cmd + run: | + jq "map(if .title == \"Test match variable (1/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json + jq "map(if .title == \"Test match variable (2/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json + jq "map(if .title == \"Test match variable (3/n)\" then .enabled = 0 else . end)" issue-2423-msg-in-chain.json > tmp.json && move /Y tmp.json issue-2423-msg-in-chain.json + jq "map(if .title == \"Variable offset - FILES_NAMES\" then .enabled = 0 else . end)" offset-variable.json > tmp.json && move /Y tmp.json offset-variable.json + - name: Run tests + working-directory: build\win32\build + run: | + ctest -C ${{ matrix.configuration }} --output-on-failure From 1b2de5a5d3cf8231977cb2c87bced2fee7f37ede Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Tue, 14 May 2024 13:42:20 -0700 Subject: [PATCH 38/66] Add support to turn 3rd party dependencies off - By default, all the 3rd party dependencies are enabled. - A dependency can be turned off by adding the "-DWITHOUT_xxx=ON" to the call of vcbuild.bat - List of 3rd party dependencies and associated option to turn them off: - LMDB: WITHOUT_LMDB - LUA: WITHOUT_LUA - LibXML2: WITHOUT_LIBXML2 - MaxMind: WITHOUT_MAXMIND - cURL: WITHOUT_CURL --- .github/workflows/ci.yml | 10 ++++++++-- build/win32/CMakeLists.txt | 33 ++++++++++++++++++++++++--------- vcbuild.bat | 2 +- 3 files changed, 33 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 110bfa69..34f345d6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -80,6 +80,12 @@ jobs: os: [windows-2022] platform: [x86_64] configuration: [Release] + configure: + - {label: "full", opt: "" } + - {label: "wo lmdb", opt: "-DWITHOUT_LMDB=ON" } + - {label: "wo lua", opt: "-DWITHOUT_LUA=ON" } + - {label: "wo maxmind", opt: "-DWITHOUT_MAXMIND=ON" } + - {label: "wo curl", opt: "-DWITHOUT_CURL=ON" } steps: - uses: actions/checkout@v4 with: @@ -89,9 +95,9 @@ jobs: pip3 install conan --upgrade conan profile detect - uses: ammaraskar/msvc-problem-matcher@master - - name: Build ${{ matrix.configuration }} ${{ matrix.platform }} + - name: Build ${{ matrix.configuration }} ${{ matrix.platform }} ${{ matrix.configure.label }} shell: cmd - run: vcbuild.bat ${{ matrix.configuration }} ${{ matrix.platform }} + run: vcbuild.bat ${{ matrix.configuration }} ${{ matrix.platform }} NO_ASAN "${{ matrix.configure.opt }}" - name: Set up test environment working-directory: build\win32\build\${{ matrix.configuration }} env: diff --git a/build/win32/CMakeLists.txt b/build/win32/CMakeLists.txt index 9b52926c..20cba66c 100644 --- a/build/win32/CMakeLists.txt +++ b/build/win32/CMakeLists.txt @@ -1,8 +1,14 @@ -cmake_minimum_required(VERSION 3.15) +cmake_minimum_required(VERSION 3.24) set(BASE_DIR ${CMAKE_CURRENT_LIST_DIR}/../..) -set(USE_ASAN OFF CACHE BOOL "Build with Address Sanitizer") +option(WITHOUT_LMDB "Include LMDB support" OFF) +option(WITHOUT_LUA "Include LUA support" OFF) +option(WITHOUT_LIBXML2 "Include LibXML2 support" OFF) +option(WITHOUT_MAXMIND "Include MaxMind support" OFF) +option(WITHOUT_CURL "Include CURL support" OFF) + +option(USE_ASAN "Build with Address Sanitizer" OFF) # common compiler settings @@ -55,14 +61,23 @@ set(PACKAGE_VERSION "${PROJECT_VERSION}") set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}") set(PACKAGE_TARNAME "${PACKAGE_NAME}") -set(HAVE_GEOIP 0) # should always be zero, no conan package available -set(HAVE_LMDB 1) -set(HAVE_LUA 1) -set(HAVE_LIBXML2 1) -set(HAVE_MAXMIND 1) -set(HAVE_SSDEEP 0) # should always be zero, no conan package available set(HAVE_YAJL 1) # should always be one, mandatory dependency -set(HAVE_CURL 1) +set(HAVE_GEOIP 0) # should always be zero, no conan package available +set(HAVE_SSDEEP 0) # should always be zero, no conan package available + +macro(enable_feature flag option) + if(${option}) + set(${flag} 0) + else() + set(${flag} 1) + endif() +endmacro() + +enable_feature(HAVE_LMDB ${WITHOUT_LMDB}) +enable_feature(HAVE_LUA ${WITHOUT_LUA}) +enable_feature(HAVE_LIBXML2 ${WITHOUT_LIBXML2}) +enable_feature(HAVE_MAXMIND ${WITHOUT_MAXMIND}) +enable_feature(HAVE_CURL ${WITHOUT_CURL}) include(${CMAKE_CURRENT_LIST_DIR}/ConfigureChecks.cmake) diff --git a/vcbuild.bat b/vcbuild.bat index 0789c9f8..b24572ab 100644 --- a/vcbuild.bat +++ b/vcbuild.bat @@ -22,7 +22,7 @@ if "%3"=="USE_ASAN" ( cd build\win32 conan install . -s compiler.cppstd=17 %CI_ASAN% --output-folder=build --build=missing --settings=build_type=%build_type% --settings=arch=%arch% cd build -cmake .. -G "Visual Studio 17 2022" -DCMAKE_TOOLCHAIN_FILE=conan_toolchain.cmake -DUSE_ASAN=%ASAN_FLAG% +cmake --fresh .. -G "Visual Studio 17 2022" -DCMAKE_TOOLCHAIN_FILE=conan_toolchain.cmake -DUSE_ASAN=%ASAN_FLAG% %4 %5 %6 %7 %8 %9 cmake --build . --config %build_type% popd From 2c488386c4fc393ff1decf8b824f451d18fff12a Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 19 May 2024 16:38:03 +0000 Subject: [PATCH 39/66] Add options nounistd & never-interactive to seclang-scanner.ll - The parser is not used interactively so we can avoid including unistd.h, which is not available on Windows MSVC C++ compiler. - The #ifdef WIN32 introduced in PR #3132 would probably be overwritten when the parser is updated. --- src/parser/seclang-scanner.cc | 13 +++++-------- src/parser/seclang-scanner.ll | 2 +- 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/src/parser/seclang-scanner.cc b/src/parser/seclang-scanner.cc index 92afab76..4e55e00b 100644 --- a/src/parser/seclang-scanner.cc +++ b/src/parser/seclang-scanner.cc @@ -4900,13 +4900,14 @@ static std::stack YY_PREVIOUS_STATE; // The location of the current token. #line 4902 "seclang-scanner.cc" #define YY_NO_INPUT 1 +#define YY_NO_UNISTD_H 1 #line 494 "seclang-scanner.ll" // Code run each time a pattern is matched. # define YY_USER_ACTION driver.loc.back()->columns (yyleng); -#line 4909 "seclang-scanner.cc" #line 4910 "seclang-scanner.cc" +#line 4911 "seclang-scanner.cc" #define INITIAL 0 #define EXPECTING_ACTION_PREDICATE_VARIABLE 1 @@ -4952,11 +4953,7 @@ static std::stack YY_PREVIOUS_STATE; * The user has a chance to override it with an option. */ /* %if-c-only */ -#ifndef WIN32 #include -#else -#include -#endif /* %endif */ /* %if-c++-only */ /* %endif */ @@ -5232,7 +5229,7 @@ YY_DECL // Code run each time yylex is called. driver.loc.back()->step(); -#line 5232 "seclang-scanner.cc" +#line 5233 "seclang-scanner.cc" while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */ { @@ -8338,7 +8335,7 @@ YY_RULE_SETUP #line 1340 "seclang-scanner.ll" ECHO; YY_BREAK -#line 8338 "seclang-scanner.cc" +#line 8339 "seclang-scanner.cc" case YY_END_OF_BUFFER: { @@ -8960,7 +8957,7 @@ static void yy_load_buffer_state (void) /* %if-c-only */ - b->yy_is_interactive = file ? (isatty( fileno(file) ) > 0) : 0; + b->yy_is_interactive = 0; /* %endif */ /* %if-c++-only */ diff --git a/src/parser/seclang-scanner.ll b/src/parser/seclang-scanner.ll index c6756d6f..c1a04a65 100755 --- a/src/parser/seclang-scanner.ll +++ b/src/parser/seclang-scanner.ll @@ -73,7 +73,7 @@ static std::stack YY_PREVIOUS_STATE; // The location of the current token. %} -%option noyywrap nounput batch debug noinput +%option noyywrap nounput batch debug noinput nounistd never-interactive From 7267c1dc21883e8572f164c9564cebbf6d593dc6 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Wed, 15 May 2024 06:34:34 -0700 Subject: [PATCH 40/66] Added support to run regression tests without libxml2 - Annotated regression tests that depend on libxml2 support - Added Windows build without libxml2 --- .github/workflows/ci.yml | 1 + test/regression/regression.cc | 6 +++--- .../regression/action-ctl_request_body_processor.json | 3 +++ test/test-cases/regression/action-xmlns.json | 1 + test/test-cases/regression/config-body_limits.json | 2 ++ test/test-cases/regression/config-xml_external_entity.json | 3 +++ .../regression/request-body-parser-xml-validade-dtd.json | 4 ++++ test/test-cases/regression/request-body-parser-xml.json | 5 +++++ .../regression/variable-REQBODY_PROCESSOR_ERROR.json | 1 + test/test-cases/regression/variable-XML.json | 1 + 10 files changed, 24 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 34f345d6..2a870a58 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -84,6 +84,7 @@ jobs: - {label: "full", opt: "" } - {label: "wo lmdb", opt: "-DWITHOUT_LMDB=ON" } - {label: "wo lua", opt: "-DWITHOUT_LUA=ON" } + - {label: "wo libxml2", opt: "-WITHOUT_LIBXML2=ON" } - {label: "wo maxmind", opt: "-DWITHOUT_MAXMIND=ON" } - {label: "wo curl", opt: "-DWITHOUT_CURL=ON" } steps: diff --git a/test/regression/regression.cc b/test/regression/regression.cc index 1420ddcd..759b7dbb 100644 --- a/test/regression/regression.cc +++ b/test/regression/regression.cc @@ -486,15 +486,12 @@ int main(int argc, char **argv) { #if defined(WITH_GEOIP) or defined(WITH_MAXMIND) resources.push_back("geoip-or-maxmind"); #endif - #if defined(WITH_MAXMIND) resources.push_back("maxmind"); #endif - #if defined(WITH_GEOIP) resources.push_back("geoip"); #endif - #ifdef WITH_CURL resources.push_back("curl"); #endif @@ -504,6 +501,9 @@ int main(int argc, char **argv) { #ifdef WITH_LUA resources.push_back("lua"); #endif +#ifdef WITH_LIBXML2 + resources.push_back("libxml2"); +#endif #ifdef NO_LOGS std::cout << "Test utility cannot work without logging support." \ diff --git a/test/test-cases/regression/action-ctl_request_body_processor.json b/test/test-cases/regression/action-ctl_request_body_processor.json index d36a79e0..d2b6bd7d 100644 --- a/test/test-cases/regression/action-ctl_request_body_processor.json +++ b/test/test-cases/regression/action-ctl_request_body_processor.json @@ -2,6 +2,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing CtlRequestBodyProcessor=XML (1)", "expected":{ "debug_log": "Registered XML namespace href \"http://schemas.xmlsoap.org/soap/envelope/\" prefix \"soap\"" @@ -71,6 +72,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing CtlRequestBodyProcessor=XML (2)", "expected":{ "debug_log": "Rule returned 0" @@ -139,6 +141,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing CtlRequestBodyProcessor=XML (3)", "expected":{ "debug_log": "XML: Failed parsing document." diff --git a/test/test-cases/regression/action-xmlns.json b/test/test-cases/regression/action-xmlns.json index f85a1d22..df612f20 100644 --- a/test/test-cases/regression/action-xmlns.json +++ b/test/test-cases/regression/action-xmlns.json @@ -38,6 +38,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser (validate ok)", "expected":{ "debug_log": "Target value: \"39.95\" \\(Variable: XML:\/bookstore\/book\/price\\[text\\(\\)\\]\\)" diff --git a/test/test-cases/regression/config-body_limits.json b/test/test-cases/regression/config-body_limits.json index ebc047db..c7ce75f9 100644 --- a/test/test-cases/regression/config-body_limits.json +++ b/test/test-cases/regression/config-body_limits.json @@ -578,6 +578,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"SecRequestBodyNoFilesLimit - xml, limit exceeded", "client":{ "ip":"200.249.12.31", @@ -626,6 +627,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"SecRequestBodyNoFilesLimit - xml, limit not exceeded", "client":{ "ip":"200.249.12.31", diff --git a/test/test-cases/regression/config-xml_external_entity.json b/test/test-cases/regression/config-xml_external_entity.json index fa0b405f..1f5cf098 100644 --- a/test/test-cases/regression/config-xml_external_entity.json +++ b/test/test-cases/regression/config-xml_external_entity.json @@ -2,6 +2,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing SecXMLExternalEntity/XXE 1", "expected":{ "debug_log": "Target value: \" jo smith\"" @@ -47,6 +48,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing SecXMLExternalEntity/XXE 2", "expected":{ "debug_log": "XML: Failed to load DTD: test-cases/data/SoapEnvelope.dtd", @@ -94,6 +96,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing SecXMLExternalEntity/XXE 3", "expected":{ "debug_log": "XML Error: No declaration for element bookstore", diff --git a/test/test-cases/regression/request-body-parser-xml-validade-dtd.json b/test/test-cases/regression/request-body-parser-xml-validade-dtd.json index c01c8c75..db071aef 100644 --- a/test/test-cases/regression/request-body-parser-xml-validade-dtd.json +++ b/test/test-cases/regression/request-body-parser-xml-validade-dtd.json @@ -2,6 +2,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser - validateDTD (validate ok)", "expected":{ "debug_log": "XML: Successfully validated payload against DTD: test-cases/data/SoapEnvelope.dtd" @@ -47,6 +48,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser - validateDTD (validation failed)", "expected":{ "debug_log": "XML Error: No declaration for element xBody", @@ -93,6 +95,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser - validateDTD (bad XML)", "expected":{ "debug_log": "XML: DTD validation failed because content is not well formed", @@ -139,6 +142,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser - validateDTD (bad DTD)", "expected":{ "debug_log": "Failed to load DTD: test-cases/data/SoapEnvelope-bad.dtd", diff --git a/test/test-cases/regression/request-body-parser-xml.json b/test/test-cases/regression/request-body-parser-xml.json index 072912d4..9b07c2ca 100644 --- a/test/test-cases/regression/request-body-parser-xml.json +++ b/test/test-cases/regression/request-body-parser-xml.json @@ -2,6 +2,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser (validate ok)", "expected":{ "debug_log": "XML: Successfully validated payload against Schema:" @@ -51,6 +52,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser (validate attribute value failed)", "expected":{ "debug_log": "'badval' is not a valid value of the local atomic type", @@ -101,6 +103,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser (validate failed)", "expected":{ "debug_log": "This element is not expected. Expected is one of", @@ -151,6 +154,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser (bad XML)", "expected":{ "debug_log": "XML Error: Element '{http://schemas.xmlsoap.org/soap/envelope/}xBody'", @@ -201,6 +205,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XML request body parser (bad schema)", "expected":{ "debug_log": "XML: Failed to load Schema: test-cases/data/SoapEnvelope-bad.xsd. XML Error: Failed to parse the XML resource 'test-cases/data/SoapEnvelope-bad.xsd", diff --git a/test/test-cases/regression/variable-REQBODY_PROCESSOR_ERROR.json b/test/test-cases/regression/variable-REQBODY_PROCESSOR_ERROR.json index e470362d..8cc4a157 100644 --- a/test/test-cases/regression/variable-REQBODY_PROCESSOR_ERROR.json +++ b/test/test-cases/regression/variable-REQBODY_PROCESSOR_ERROR.json @@ -2,6 +2,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing Variables :: REQBODY_PROCESSOR_ERROR_MSG (1/2)", "client":{ "ip":"200.249.12.31", diff --git a/test/test-cases/regression/variable-XML.json b/test/test-cases/regression/variable-XML.json index c5ca889c..dda38221 100644 --- a/test/test-cases/regression/variable-XML.json +++ b/test/test-cases/regression/variable-XML.json @@ -2,6 +2,7 @@ { "enabled":1, "version_min":300000, + "resource":"libxml2", "title":"Testing XPath expression with equals sign", "expected":{ "http_code": 403 From 636cf43d5e6ba1561e76d32e20e4785e9e43d8ab Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 5 May 2024 13:25:46 -0300 Subject: [PATCH 41/66] Separate workflow to run check-static (cppcheck) build step --- .github/workflows/ci.yml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2a870a58..5918fab9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: - name: Setup Dependencies run: | sudo apt-get update -y -qq - sudo apt-get install -y libfuzzy-dev libyajl-dev libgeoip-dev liblua5.2-dev liblmdb-dev cppcheck libmaxminddb-dev libcurl4-openssl-dev libpcre2-dev pcre2-utils + sudo apt-get install -y libfuzzy-dev libyajl-dev libgeoip-dev liblua5.2-dev liblmdb-dev libmaxminddb-dev libcurl4-openssl-dev libpcre2-dev pcre2-utils - uses: actions/checkout@v2 with: submodules: true @@ -38,8 +38,6 @@ jobs: run: make -j `nproc` - name: check run: make check - - name: check-static - run: make check-static build-macos: runs-on: ${{ matrix.os }} @@ -125,3 +123,21 @@ jobs: working-directory: build\win32\build run: | ctest -C ${{ matrix.configuration }} --output-on-failure + + cppcheck: + runs-on: [ubuntu-22.04] + steps: + - name: Setup Dependencies + run: | + sudo apt-get update -y -qq + sudo apt-get install -y cppcheck + - name: Get libModSecurity v3 source + uses: actions/checkout@v4 + with: + submodules: true + - name: Configure libModSecurity + run: | + ./build.sh + ./configure + - name: Run cppcheck on libModSecurity + run: make check-static \ No newline at end of file From d0108efbc33fa5ec290ae7d19301924327a630ce Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Wed, 15 May 2024 06:54:13 -0700 Subject: [PATCH 42/66] Update actions/checkout version to avoid deprecation warnings on GH workflow --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5918fab9..c82ecfc6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: run: | sudo apt-get update -y -qq sudo apt-get install -y libfuzzy-dev libyajl-dev libgeoip-dev liblua5.2-dev liblmdb-dev libmaxminddb-dev libcurl4-openssl-dev libpcre2-dev pcre2-utils - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 with: submodules: true - name: build.sh @@ -58,7 +58,7 @@ jobs: - name: Setup Dependencies run: | brew install autoconf automake cppcheck lmdb libyaml lua ssdeep libmaxminddb bison - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 with: submodules: true - name: build.sh From fbaf052a0af52f54b126c2f007d9a2efa55cc43c Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 19 May 2024 21:10:25 +0000 Subject: [PATCH 43/66] Update Windows build information after PR #3132 --- README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/README.md b/README.md index d41e19d2..99a664a7 100644 --- a/README.md +++ b/README.md @@ -71,8 +71,7 @@ Details on distribution specific builds can be found in our Wiki: ### Windows -Windows build is not ready yet. - +Windows build information can be found [here](build/win32/README.md). ## Dependencies From 9e44964dc713f3014c010dc4929dd25376636db6 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sun, 19 May 2024 21:12:34 +0000 Subject: [PATCH 44/66] Use SRC_DIR argument --- build/win32/docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/win32/docker/Dockerfile b/build/win32/docker/Dockerfile index 1dc60482..4a033f9d 100644 --- a/build/win32/docker/Dockerfile +++ b/build/win32/docker/Dockerfile @@ -56,7 +56,7 @@ WORKDIR C:\ RUN cmd.exe /C md %SRC_DIR% # libModSecurity -WORKDIR C:\src +WORKDIR ${SCR_DIR} ARG MOD_SECURITY_TAG=v3/master RUN git clone -c advice.detachedHead=false --depth 1 --branch %MOD_SECURITY_TAG% https://github.com/owasp-modsecurity/ModSecurity.git From 5a543d9c0b99c86aca408b68a696f2627b3491ba Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Thu, 23 May 2024 01:38:15 +0000 Subject: [PATCH 45/66] Updated .gitignore to ignore files generated in builds - build/win32/* files from Windows builds, other files from Unix builds --- .gitignore | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.gitignore b/.gitignore index 390c0e60..be0de155 100644 --- a/.gitignore +++ b/.gitignore @@ -11,13 +11,18 @@ build/ltoptions.m4 build/ltsugar.m4 build/ltversion.m4 build/lt~obsolete.m4 +build/win32/build +build/win32/CMakeUserPresets.json compile config.guess config.log config.status config.sub +config.h.in~ configure +configure~ depcomp +modsecurity.pc .deps .libs .dirstamp From d9255d85caf135b74974f2d6bbe017230a5633a1 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Wed, 15 May 2024 06:39:14 -0700 Subject: [PATCH 46/66] Updated GH Unix build configurations - Added support to build 32-bit versions of libModSecurity on Linux - Added support to build libModSecurity using clang on Linux (both 64-bit and 32-bit versions) - Fixed macOS dependencies to include yajl, not only because it is a required dependency, but because tests were not being run on macOS builds without it. - Added build 'without libxml' to Linux & macOS configurations. - Added build 'without ssdeep' to Linux configurations (already in macOS configuration) - Added build 'with lmdb' to Linux & macOS configurations, replacing the existing one 'without lmdb' because by default LMDB is disabled if not explicitly turn on in configure. - Removed 'without yajl' build because it's a required 3rd party dependency. - Added bison & flex dependencies to enable parser generation. --- .github/workflows/ci.yml | 96 ++++++++++++++++++++++++++++++---------- 1 file changed, 72 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c82ecfc6..b081fb93 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,33 +6,66 @@ on: jobs: build-linux: + name: Linux (${{ matrix.platform.label }}, ${{ matrix.compiler.label }}, ${{ matrix.configure.label }}) runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-22.04] - platform: [x32, x64] - compiler: [gcc, clang] + platform: + - {label: "x64", arch: "amd64", configure: ""} + - {label: "x32", arch: "i386", configure: "PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32"} + compiler: + - {label: "gcc", cc: "gcc", cxx: "g++"} + - {label: "clang", cc: "clang", cxx: "clang++"} configure: - {label: "with parser generation", opt: "--enable-parser-generation" } - {label: "wo curl", opt: "--without-curl" } - - {label: "wo yajl", opt: "--without-yajl" } - - {label: "wo geoip", opt: "--without-geoip" } - - {label: "wo lmdb", opt: "--without-lmdb" } - - {label: "with pcre2", opt: "--with-pcre2" } - {label: "wo lua", opt: "--without-lua" } - - {label: "without maxmind", opt: "--without-maxmind" } + - {label: "wo maxmind", opt: "--without-maxmind" } + - {label: "wo libxml", opt: "--without-libxml" } + - {label: "wo geoip", opt: "--without-geoip" } + - {label: "wo ssdeep", opt: "--without-ssdeep" } + - {label: "with lmdb", opt: "--with-lmdb" } + - {label: "with pcre2", opt: "--with-pcre2" } + exclude: + - platform: {label: "x32"} + configure: {label: "wo geoip"} + - platform: {label: "x32"} + configure: {label: "wo ssdeep"} steps: - - name: Setup Dependencies + - name: Setup Dependencies (common) run: | + sudo dpkg --add-architecture ${{ matrix.platform.arch }} sudo apt-get update -y -qq - sudo apt-get install -y libfuzzy-dev libyajl-dev libgeoip-dev liblua5.2-dev liblmdb-dev libmaxminddb-dev libcurl4-openssl-dev libpcre2-dev pcre2-utils + sudo apt-get install -y libyajl-dev:${{ matrix.platform.arch }} \ + libcurl4-openssl-dev:${{ matrix.platform.arch }} \ + liblmdb-dev:${{ matrix.platform.arch }} \ + liblua5.2-dev:${{ matrix.platform.arch }} \ + libmaxminddb-dev:${{ matrix.platform.arch }} \ + libpcre2-dev:${{ matrix.platform.arch }} \ + pcre2-utils:${{ matrix.platform.arch }} \ + bison flex + - name: Setup Dependencies (x32) + if: ${{ matrix.platform.label == 'x32' }} + run: | + sudo apt-get install g++-multilib + sudo apt-get install -y libxml2-dev:${{ matrix.platform.arch }} \ + libpcre3-dev:${{ matrix.platform.arch }} + - name: Setup Dependencies (x64) + if: ${{ matrix.platform.label == 'x64' }} + run: | + sudo apt-get install -y libgeoip-dev:${{ matrix.platform.arch }} \ + libfuzzy-dev:${{ matrix.platform.arch }} - uses: actions/checkout@v4 with: submodules: true - name: build.sh run: ./build.sh - - name: configure ${{ matrix.configure.label }} - run: ./configure ${{ matrix.configure.opt }} + - name: configure + env: + CC: ${{ matrix.compiler.cc }} + CXX: ${{ matrix.compiler.cxx }} + run: ./configure ${{ matrix.platform.configure }} ${{ matrix.configure.opt }} - uses: ammaraskar/gcc-problem-matcher@master - name: make run: make -j `nproc` @@ -40,30 +73,43 @@ jobs: run: make check build-macos: + name: macOS (${{ matrix.configure.label }}) runs-on: ${{ matrix.os }} strategy: matrix: os: [macos-12] - compiler: [clang] configure: - {label: "with parser generation", opt: "--enable-parser-generation" } - {label: "wo curl", opt: "--without-curl" } - - {label: "wo yajl", opt: "--without-yajl" } - - {label: "wo geoip", opt: "--without-geoip" } - - {label: "wo lmdb", opt: "--without-lmdb" } - - {label: "wo ssdeep", opt: "--without-ssdeep" } - {label: "wo lua", opt: "--without-lua" } - {label: "wo maxmind", opt: "--without-maxmind" } + - {label: "wo libxml", opt: "--without-libxml" } + - {label: "wo geoip", opt: "--without-geoip" } + - {label: "wo ssdeep", opt: "--without-ssdeep" } + - {label: "with lmdb", opt: "--with-lmdb" } + - {label: "with pcre2", opt: "--with-pcre2" } steps: - name: Setup Dependencies + # autoconf, curl, pcre2 not installed because they're already + # included in the image run: | - brew install autoconf automake cppcheck lmdb libyaml lua ssdeep libmaxminddb bison + brew install automake \ + yajl \ + lmdb \ + lua \ + libmaxminddb \ + libxml2 \ + geoip \ + ssdeep \ + pcre \ + bison \ + flex - uses: actions/checkout@v4 with: submodules: true - name: build.sh run: ./build.sh - - name: configure ${{ matrix.configure.label }} + - name: configure run: ./configure ${{ matrix.configure.opt }} - uses: ammaraskar/gcc-problem-matcher@master - name: make @@ -72,19 +118,21 @@ jobs: run: make check build-windows: + name: Windows (${{ matrix.platform.label }}, ${{ matrix.configure.label }}) runs-on: ${{ matrix.os }} strategy: matrix: os: [windows-2022] - platform: [x86_64] + platform: + - {label: "x64", arch: "x86_64"} configuration: [Release] configure: - {label: "full", opt: "" } + - {label: "wo curl", opt: "-DWITHOUT_CURL=ON" } - {label: "wo lmdb", opt: "-DWITHOUT_LMDB=ON" } - {label: "wo lua", opt: "-DWITHOUT_LUA=ON" } - - {label: "wo libxml2", opt: "-WITHOUT_LIBXML2=ON" } - {label: "wo maxmind", opt: "-DWITHOUT_MAXMIND=ON" } - - {label: "wo curl", opt: "-DWITHOUT_CURL=ON" } + - {label: "wo libxml", opt: "-WITHOUT_LIBXML2=ON" } steps: - uses: actions/checkout@v4 with: @@ -94,9 +142,9 @@ jobs: pip3 install conan --upgrade conan profile detect - uses: ammaraskar/msvc-problem-matcher@master - - name: Build ${{ matrix.configuration }} ${{ matrix.platform }} ${{ matrix.configure.label }} + - name: Build ${{ matrix.configuration }} ${{ matrix.platform.arch }} ${{ matrix.configure.label }} shell: cmd - run: vcbuild.bat ${{ matrix.configuration }} ${{ matrix.platform }} NO_ASAN "${{ matrix.configure.opt }}" + run: vcbuild.bat ${{ matrix.configuration }} ${{ matrix.platform.arch }} NO_ASAN "${{ matrix.configure.opt }}" - name: Set up test environment working-directory: build\win32\build\${{ matrix.configuration }} env: @@ -140,4 +188,4 @@ jobs: ./build.sh ./configure - name: Run cppcheck on libModSecurity - run: make check-static \ No newline at end of file + run: make check-static From 98c672ddb4cebc0e2b9c7dead7c25231c6beeee8 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Thu, 30 May 2024 09:45:02 -0300 Subject: [PATCH 47/66] chore: add PR template Signed-off-by: Felipe Zipitria --- .github/PULL_REQUEST_TEMPLATE.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/PULL_REQUEST_TEMPLATE.md diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 00000000..4d274644 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,24 @@ + + + +## what + + + +## why + + + +## references + + From 7732b5e8f319c85d05e840cef661f0aab9149f56 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Fri, 24 May 2024 10:46:11 -0300 Subject: [PATCH 48/66] Update libinjection to version v3.9.2-92-gb9fcaaf --- .github/workflows/ci.yml | 21 +++++++++++++++------ build/win32/CMakeLists.txt | 16 +++++++++++++++- configure.ac | 1 + others/Makefile.am | 4 ++++ others/libinjection | 2 +- src/operators/detect_sqli.cc | 2 +- src/operators/detect_xss.cc | 2 +- test/cppcheck_suppressions.txt | 10 +--------- 8 files changed, 39 insertions(+), 19 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b081fb93..c0990487 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,8 +57,11 @@ jobs: sudo apt-get install -y libgeoip-dev:${{ matrix.platform.arch }} \ libfuzzy-dev:${{ matrix.platform.arch }} - uses: actions/checkout@v4 - with: - submodules: true + - name: get submodules + # get submodules manually for git describe to work during build + run: | + git submodule init + git submodule update - name: build.sh run: ./build.sh - name: configure @@ -105,8 +108,11 @@ jobs: bison \ flex - uses: actions/checkout@v4 - with: - submodules: true + - name: get submodules + # get submodules manually for git describe to work during build + run: | + git submodule init + git submodule update - name: build.sh run: ./build.sh - name: configure @@ -135,8 +141,11 @@ jobs: - {label: "wo libxml", opt: "-WITHOUT_LIBXML2=ON" } steps: - uses: actions/checkout@v4 - with: - submodules: true + - name: Get submodules + # get submodules manually for git describe to work during build + run: | + git submodule init + git submodule update - name: Install Conan run: | pip3 install conan --upgrade diff --git a/build/win32/CMakeLists.txt b/build/win32/CMakeLists.txt index 20cba66c..82fd49f2 100644 --- a/build/win32/CMakeLists.txt +++ b/build/win32/CMakeLists.txt @@ -30,7 +30,21 @@ endif() project(libinjection C) -add_library(libinjection STATIC ${BASE_DIR}/others/libinjection/src/libinjection_sqli.c ${BASE_DIR}/others/libinjection/src/libinjection_xss.c ${BASE_DIR}/others/libinjection/src/libinjection_html5.c) +set(LIBINJECTION_DIR ${BASE_DIR}/others/libinjection) + +add_library(libinjection STATIC ${LIBINJECTION_DIR}/src/libinjection_sqli.c ${LIBINJECTION_DIR}/src/libinjection_xss.c ${LIBINJECTION_DIR}/src/libinjection_html5.c) + +# get libinjection version with git describe +execute_process( + COMMAND git describe + WORKING_DIRECTORY ${LIBINJECTION_DIR} + OUTPUT_VARIABLE LIBINJECTION_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE +) + +message("-- Detecting libinjection version - ${LIBINJECTION_VERSION}") + +target_compile_definitions(libinjection PRIVATE LIBINJECTION_VERSION="${LIBINJECTION_VERSION}") # mbedtls diff --git a/configure.ac b/configure.ac index d8636036..d6c29bf6 100644 --- a/configure.ac +++ b/configure.ac @@ -75,6 +75,7 @@ AC_MSG_ERROR([\ fi # Libinjection version AC_DEFUN([LIBINJECTION_VERSION], m4_esyscmd_s(cd "others/libinjection" && git describe && cd ../..)) +AC_SUBST([LIBINJECTION_VERSION]) # SecLang test version AC_DEFUN([SECLANG_TEST_VERSION], m4_esyscmd_s(cd "test/test-cases/secrules-language-tests" && git log -1 --format="%h" --abbrev-commit && cd ../../..)) diff --git a/others/Makefile.am b/others/Makefile.am index 7501d558..abf22b52 100644 --- a/others/Makefile.am +++ b/others/Makefile.am @@ -1,10 +1,14 @@ noinst_LTLIBRARIES = libinjection.la libmbedtls.la + libinjection_la_SOURCES = \ libinjection/src/libinjection_html5.c \ libinjection/src/libinjection_sqli.c \ libinjection/src/libinjection_xss.c +libinjection_la_CFLAGS = -D LIBINJECTION_VERSION=\"${LIBINJECTION_VERSION}\" +libinjection_la_LIBADD = + noinst_HEADERS = \ libinjection/src/libinjection.h \ libinjection/src/libinjection_html5.h \ diff --git a/others/libinjection b/others/libinjection index bfba51f5..b9fcaaf9 160000 --- a/others/libinjection +++ b/others/libinjection @@ -1 +1 @@ -Subproject commit bfba51f5af8f1f6cf5d6c4bf862f1e2474e018e3 +Subproject commit b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9 diff --git a/src/operators/detect_sqli.cc b/src/operators/detect_sqli.cc index 793d5644..2c734d85 100644 --- a/src/operators/detect_sqli.cc +++ b/src/operators/detect_sqli.cc @@ -19,7 +19,7 @@ #include #include "src/operators/operator.h" -#include "others/libinjection/src/libinjection.h" +#include "libinjection/src/libinjection.h" namespace modsecurity { namespace operators { diff --git a/src/operators/detect_xss.cc b/src/operators/detect_xss.cc index 6c89ef72..cf4b7861 100644 --- a/src/operators/detect_xss.cc +++ b/src/operators/detect_xss.cc @@ -18,7 +18,7 @@ #include #include "src/operators/operator.h" -#include "others/libinjection/src/libinjection.h" +#include "libinjection/src/libinjection.h" namespace modsecurity { diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index bff688d8..fa300a34 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -1,15 +1,7 @@ // // Ignore libinjection related stuff. // -*:others/libinjection/src/libinjection_html5.c -*:others/libinjection/src/libinjection_sqli.c -*:others/libinjection/src/libinjection_xss.c -*:others/libinjection/src/reader.c -*:others/libinjection/src/sqli_cli.c -*:others/libinjection/src/testdriver.c -*:others/libinjection/src/test_speed_sqli.c -*:others/libinjection/src/test_speed_xss.c - +*:others/libinjection/src/* // // Lets ignore mbedtls. From a3f40ef03c853a51d7cc5f58df6190439cdcf8d0 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Fri, 24 May 2024 01:53:24 +0000 Subject: [PATCH 49/66] Replace Mbed TLS source code in repository with a submodule - Updated to latest Mbed TLS version (v3.6.0) --- .gitmodules | 3 + Makefile.am | 2 +- build/win32/CMakeLists.txt | 26 +- configure.ac | 23 + others/Makefile.am | 21 +- others/mbedtls | 1 + others/mbedtls/base64.c | 289 ---- others/mbedtls/base64.h | 88 -- others/mbedtls/check_config.h | 540 ------- others/mbedtls/mbed-tls-config.h | 2511 ------------------------------ others/mbedtls/md5.c | 404 ----- others/mbedtls/md5.h | 136 -- others/mbedtls/platform.h | 214 --- others/mbedtls/sha1.c | 448 ------ others/mbedtls/sha1.h | 136 -- src/Makefile.am | 1 + src/utils/md5.cc | 2 +- src/utils/sha1.cc | 2 +- test/cppcheck_suppressions.txt | 4 +- 19 files changed, 62 insertions(+), 4789 deletions(-) create mode 160000 others/mbedtls delete mode 100644 others/mbedtls/base64.c delete mode 100644 others/mbedtls/base64.h delete mode 100644 others/mbedtls/check_config.h delete mode 100644 others/mbedtls/mbed-tls-config.h delete mode 100644 others/mbedtls/md5.c delete mode 100644 others/mbedtls/md5.h delete mode 100644 others/mbedtls/platform.h delete mode 100644 others/mbedtls/sha1.c delete mode 100644 others/mbedtls/sha1.h diff --git a/.gitmodules b/.gitmodules index 9a5c7116..05927d49 100644 --- a/.gitmodules +++ b/.gitmodules @@ -7,3 +7,6 @@ [submodule "bindings/python"] path = bindings/python url = https://github.com/owasp-modsecurity/ModSecurity-Python-bindings.git +[submodule "others/mbedtls"] + path = others/mbedtls + url = https://github.com/Mbed-TLS/mbedtls.git diff --git a/Makefile.am b/Makefile.am index 5983c7c4..ab22102d 100644 --- a/Makefile.am +++ b/Makefile.am @@ -63,7 +63,7 @@ cppcheck: --enable=warning,style,performance,portability,unusedFunction,missingInclude \ --inconclusive \ --template="warning: {file},{line},{severity},{id},{message}" \ - -I headers -I . -I others -I src -I others/mbedtls -I src/parser \ + -I headers -I . -I others -I src -I others/mbedtls/include -I src/parser \ --error-exitcode=1 \ -i "src/parser/seclang-parser.cc" -i "src/parser/seclang-scanner.cc" \ --force --verbose . diff --git a/build/win32/CMakeLists.txt b/build/win32/CMakeLists.txt index 82fd49f2..bdb9a45f 100644 --- a/build/win32/CMakeLists.txt +++ b/build/win32/CMakeLists.txt @@ -14,7 +14,7 @@ option(USE_ASAN "Build with Address Sanitizer" OFF) # NOTE: MBEDTLS_CONFIG_FILE is not only required to compile the mbedtls subset in others, but also # when their headers are included while compiling libModSecurity -add_compile_definitions(WIN32 _CRT_SECURE_NO_WARNINGS MBEDTLS_CONFIG_FILE="mbed-tls-config.h") +add_compile_definitions(WIN32 _CRT_SECURE_NO_WARNINGS MBEDTLS_CONFIG_FILE="mbedtls/mbedtls_config.h") # set standards conformance preprocessor & compiler to align with cross-compiled codebase # NOTE: otherwise visual c++'s default compiler/preprocessor behaviour generates C4067 warnings @@ -46,13 +46,25 @@ message("-- Detecting libinjection version - ${LIBINJECTION_VERSION}") target_compile_definitions(libinjection PRIVATE LIBINJECTION_VERSION="${LIBINJECTION_VERSION}") -# mbedtls +# mbedtls (mbedcrypto) -project(mbedtls C) +project(mbedcrypto C) -add_library(mbedtls STATIC ${BASE_DIR}/others/mbedtls/base64.c ${BASE_DIR}/others/mbedtls/sha1.c ${BASE_DIR}/others/mbedtls/md5.c) +set(MBEDTLS_DIR ${BASE_DIR}/others/mbedtls) -target_include_directories(mbedtls PRIVATE ${BASE_DIR}/others) +add_library(mbedcrypto STATIC ${MBEDTLS_DIR}/library/base64.c ${MBEDTLS_DIR}/library/sha1.c ${MBEDTLS_DIR}/library/md5.c ${MBEDTLS_DIR}/library/platform_util.c ${MBEDTLS_DIR}/library/constant_time.c) + +target_include_directories(mbedcrypto PRIVATE ${MBEDTLS_DIR}/include) + +# get mbedtls version with git describe +execute_process( + COMMAND git describe + WORKING_DIRECTORY ${MBEDTLS_DIR} + OUTPUT_VARIABLE MBEDTLS_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE +) + +message("-- Detecting Mbed TLS version - ${MBEDTLS_VERSION}") # # libModSecurity @@ -126,8 +138,8 @@ file(GLOB_RECURSE libModSecuritySources ${BASE_DIR}/src/*.cc) add_library(libModSecurity SHARED ${libModSecuritySources}) target_compile_definitions(libModSecurity PRIVATE WITH_PCRE2) -target_include_directories(libModSecurity PRIVATE ${BASE_DIR} ${BASE_DIR}/headers ${BASE_DIR}/others) -target_link_libraries(libModSecurity PRIVATE pcre2::pcre2 pthreads4w::pthreads4w libinjection mbedtls Poco::Poco Iphlpapi.lib) +target_include_directories(libModSecurity PRIVATE ${BASE_DIR} ${BASE_DIR}/headers ${BASE_DIR}/others ${MBEDTLS_DIR}/include) +target_link_libraries(libModSecurity PRIVATE pcre2::pcre2 pthreads4w::pthreads4w libinjection mbedcrypto Poco::Poco Iphlpapi.lib) macro(add_package_dependency project compile_definition link_library flag) if(${flag}) diff --git a/configure.ac b/configure.ac index d6c29bf6..f69c5c61 100644 --- a/configure.ac +++ b/configure.ac @@ -77,6 +77,27 @@ fi AC_DEFUN([LIBINJECTION_VERSION], m4_esyscmd_s(cd "others/libinjection" && git describe && cd ../..)) AC_SUBST([LIBINJECTION_VERSION]) +# Check for Mbed TLS +if ! test -f "${srcdir}/others/mbedtls/library/base64.c"; then +AC_MSG_ERROR([\ + + + Mbed TLS was not found within ModSecurity source directory. + + Mbed TLS code is available as part of ModSecurity source code in a format + of a git-submodule. git-submodule allow us to specify the correct version of + Mbed TLS and still uses the Mbed TLS repository to download it. + + You can download Mbed TLS using git: + + $ git submodule init + $ git submodule update + + ]) +fi +# Mbed TLS version +AC_DEFUN([MBEDTLS_VERSION], m4_esyscmd_s(cd "others/mbedtls" && git describe && cd ../..)) + # SecLang test version AC_DEFUN([SECLANG_TEST_VERSION], m4_esyscmd_s(cd "test/test-cases/secrules-language-tests" && git log -1 --format="%h" --abbrev-commit && cd ../../..)) @@ -426,6 +447,8 @@ echo " " echo " Mandatory dependencies" AS_ECHO_N(" + libInjection ....") echo LIBINJECTION_VERSION +AS_ECHO_N(" + Mbed TLS ....") +echo MBEDTLS_VERSION AS_ECHO_N(" + SecLang tests ....") echo SECLANG_TEST_VERSION diff --git a/others/Makefile.am b/others/Makefile.am index abf22b52..956c8d90 100644 --- a/others/Makefile.am +++ b/others/Makefile.am @@ -15,18 +15,19 @@ noinst_HEADERS = \ libinjection/src/libinjection_sqli.h \ libinjection/src/libinjection_sqli_data.h \ libinjection/src/libinjection_xss.h \ - mbedtls/base64.h \ - mbedtls/check_config.h \ - mbedtls/mbed-tls-config.h \ - mbedtls/md5.h \ - mbedtls/platform.h \ - mbedtls/sha1.h + mbedtls/include/mbedtls/base64.h \ + mbedtls/include/mbedtls/check_config.h \ + mbedtls/include/mbedtls/mbedtls_config.h \ + mbedtls/include/mbedtls/md5.h \ + mbedtls/include/mbedtls/platform.h \ + mbedtls/include/mbedtls/sha1.h libmbedtls_la_SOURCES = \ - mbedtls/base64.c \ - mbedtls/md5.c \ - mbedtls/sha1.c + mbedtls/library/base64.c \ + mbedtls/library/md5.c \ + mbedtls/library/sha1.c \ + mbedtls/library/platform_util.c -libmbedtls_la_CFLAGS = -D MBEDTLS_CONFIG_FILE=\"mbed-tls-config.h\" -Iothers +libmbedtls_la_CFLAGS = -DMBEDTLS_CONFIG_FILE=\"mbedtls/mbedtls_config.h\" -Imbedtls/include libmbedtls_la_CPPFLAGS = libmbedtls_la_LIBADD = diff --git a/others/mbedtls b/others/mbedtls new file mode 160000 index 00000000..2ca6c285 --- /dev/null +++ b/others/mbedtls @@ -0,0 +1 @@ +Subproject commit 2ca6c285a0dd3f33982dd57299012dacab1ff206 diff --git a/others/mbedtls/base64.c b/others/mbedtls/base64.c deleted file mode 100644 index db8c2307..00000000 --- a/others/mbedtls/base64.c +++ /dev/null @@ -1,289 +0,0 @@ -/* - * RFC 1521 base64 encoding/decoding - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ - -#if !defined(MBEDTLS_CONFIG_FILE) -#include "mbedtls/config.h" -#else -#include MBEDTLS_CONFIG_FILE -#endif - -#if defined(MBEDTLS_BASE64_C) - -#include "mbedtls/base64.h" - -#include - -#if defined(MBEDTLS_SELF_TEST) -#include -#if defined(MBEDTLS_PLATFORM_C) -#include "mbedtls/platform.h" -#else -#include -#define mbedtls_printf printf -#endif /* MBEDTLS_PLATFORM_C */ -#endif /* MBEDTLS_SELF_TEST */ - -static const unsigned char base64_enc_map[64] = -{ - 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', - 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', - 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', - 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', - 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', - 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', - '8', '9', '+', '/' -}; - -static const unsigned char base64_dec_map[128] = -{ - 127, 127, 127, 127, 127, 127, 127, 127, 127, 127, - 127, 127, 127, 127, 127, 127, 127, 127, 127, 127, - 127, 127, 127, 127, 127, 127, 127, 127, 127, 127, - 127, 127, 127, 127, 127, 127, 127, 127, 127, 127, - 127, 127, 127, 62, 127, 127, 127, 63, 52, 53, - 54, 55, 56, 57, 58, 59, 60, 61, 127, 127, - 127, 64, 127, 127, 127, 0, 1, 2, 3, 4, - 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, - 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, - 25, 127, 127, 127, 127, 127, 127, 26, 27, 28, - 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, - 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, - 49, 50, 51, 127, 127, 127, 127, 127 -}; - -#define BASE64_SIZE_T_MAX ( (size_t) -1 ) /* SIZE_T_MAX is not standard */ - -/* - * Encode a buffer into base64 format - */ -int mbedtls_base64_encode( unsigned char *dst, size_t dlen, size_t *olen, - const unsigned char *src, size_t slen ) -{ - size_t i, n; - int C1, C2, C3; - unsigned char *p; - - if( slen == 0 ) - { - *olen = 0; - return( 0 ); - } - - n = slen / 3 + ( slen % 3 != 0 ); - - if( n > ( BASE64_SIZE_T_MAX - 1 ) / 4 ) - { - *olen = BASE64_SIZE_T_MAX; - return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL ); - } - - n *= 4; - - if( dlen < n + 1 ) - { - *olen = n + 1; - return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL ); - } - - n = ( slen / 3 ) * 3; - - for( i = 0, p = dst; i < n; i += 3 ) - { - C1 = *src++; - C2 = *src++; - C3 = *src++; - - *p++ = base64_enc_map[(C1 >> 2) & 0x3F]; - *p++ = base64_enc_map[(((C1 & 3) << 4) + (C2 >> 4)) & 0x3F]; - *p++ = base64_enc_map[(((C2 & 15) << 2) + (C3 >> 6)) & 0x3F]; - *p++ = base64_enc_map[C3 & 0x3F]; - } - - if( i < slen ) - { - C1 = *src++; - C2 = ( ( i + 1 ) < slen ) ? *src++ : 0; - - *p++ = base64_enc_map[(C1 >> 2) & 0x3F]; - *p++ = base64_enc_map[(((C1 & 3) << 4) + (C2 >> 4)) & 0x3F]; - - if( ( i + 1 ) < slen ) - *p++ = base64_enc_map[((C2 & 15) << 2) & 0x3F]; - else *p++ = '='; - - *p++ = '='; - } - - *olen = p - dst; - *p = 0; - - return( 0 ); -} - -/* - * Decode a base64-formatted buffer - */ -int mbedtls_base64_decode( unsigned char *dst, size_t dlen, size_t *olen, - const unsigned char *src, size_t slen ) -{ - size_t i, n; - uint32_t j, x; - unsigned char *p; - - /* First pass: check for validity and get output length */ - for( i = n = j = 0; i < slen; i++ ) - { - /* Skip spaces before checking for EOL */ - x = 0; - while( i < slen && src[i] == ' ' ) - { - ++i; - ++x; - } - - /* Spaces at end of buffer are OK */ - if( i == slen ) - break; - - if( ( slen - i ) >= 2 && - src[i] == '\r' && src[i + 1] == '\n' ) - continue; - - if( src[i] == '\n' ) - continue; - - /* Space inside a line is an error */ - if( x != 0 ) - return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER ); - - if( src[i] == '=' && ++j > 2 ) - return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER ); - - if( src[i] > 127 || base64_dec_map[src[i]] == 127 ) - return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER ); - - if( base64_dec_map[src[i]] < 64 && j != 0 ) - return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER ); - - n++; - } - - if( n == 0 ) - { - *olen = 0; - return( 0 ); - } - - n = ( ( n * 6 ) + 7 ) >> 3; - n -= j; - - if( dst == NULL || dlen < n ) - { - *olen = n; - return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL ); - } - - for( j = 3, n = x = 0, p = dst; i > 0; i--, src++ ) - { - if( *src == '\r' || *src == '\n' || *src == ' ' ) - continue; - - j -= ( base64_dec_map[*src] == 64 ); - x = ( x << 6 ) | ( base64_dec_map[*src] & 0x3F ); - - if( ++n == 4 ) - { - n = 0; - if( j > 0 ) *p++ = (unsigned char)( x >> 16 ); - if( j > 1 ) *p++ = (unsigned char)( x >> 8 ); - if( j > 2 ) *p++ = (unsigned char)( x ); - } - } - - *olen = p - dst; - - return( 0 ); -} - -#if defined(MBEDTLS_SELF_TEST) - -static const unsigned char base64_test_dec[64] = -{ - 0x24, 0x48, 0x6E, 0x56, 0x87, 0x62, 0x5A, 0xBD, - 0xBF, 0x17, 0xD9, 0xA2, 0xC4, 0x17, 0x1A, 0x01, - 0x94, 0xED, 0x8F, 0x1E, 0x11, 0xB3, 0xD7, 0x09, - 0x0C, 0xB6, 0xE9, 0x10, 0x6F, 0x22, 0xEE, 0x13, - 0xCA, 0xB3, 0x07, 0x05, 0x76, 0xC9, 0xFA, 0x31, - 0x6C, 0x08, 0x34, 0xFF, 0x8D, 0xC2, 0x6C, 0x38, - 0x00, 0x43, 0xE9, 0x54, 0x97, 0xAF, 0x50, 0x4B, - 0xD1, 0x41, 0xBA, 0x95, 0x31, 0x5A, 0x0B, 0x97 -}; - -static const unsigned char base64_test_enc[] = - "JEhuVodiWr2/F9mixBcaAZTtjx4Rs9cJDLbpEG8i7hPK" - "swcFdsn6MWwINP+Nwmw4AEPpVJevUEvRQbqVMVoLlw=="; - -/* - * Checkup routine - */ -int mbedtls_base64_self_test( int verbose ) -{ - size_t len; - const unsigned char *src; - unsigned char buffer[128]; - - if( verbose != 0 ) - mbedtls_printf( " Base64 encoding test: " ); - - src = base64_test_dec; - - if( mbedtls_base64_encode( buffer, sizeof( buffer ), &len, src, 64 ) != 0 || - memcmp( base64_test_enc, buffer, 88 ) != 0 ) - { - if( verbose != 0 ) - mbedtls_printf( "failed\n" ); - - return( 1 ); - } - - if( verbose != 0 ) - mbedtls_printf( "passed\n Base64 decoding test: " ); - - src = base64_test_enc; - - if( mbedtls_base64_decode( buffer, sizeof( buffer ), &len, src, 88 ) != 0 || - memcmp( base64_test_dec, buffer, 64 ) != 0 ) - { - if( verbose != 0 ) - mbedtls_printf( "failed\n" ); - - return( 1 ); - } - - if( verbose != 0 ) - mbedtls_printf( "passed\n\n" ); - - return( 0 ); -} - -#endif /* MBEDTLS_SELF_TEST */ - -#endif /* MBEDTLS_BASE64_C */ \ No newline at end of file diff --git a/others/mbedtls/base64.h b/others/mbedtls/base64.h deleted file mode 100644 index ef227871..00000000 --- a/others/mbedtls/base64.h +++ /dev/null @@ -1,88 +0,0 @@ -/** - * \file base64.h - * - * \brief RFC 1521 base64 encoding/decoding - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ -#ifndef MBEDTLS_BASE64_H -#define MBEDTLS_BASE64_H - -#include - -#define MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL -0x002A /**< Output buffer too small. */ -#define MBEDTLS_ERR_BASE64_INVALID_CHARACTER -0x002C /**< Invalid character in input. */ - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * \brief Encode a buffer into base64 format - * - * \param dst destination buffer - * \param dlen size of the destination buffer - * \param olen number of bytes written - * \param src source buffer - * \param slen amount of data to be encoded - * - * \return 0 if successful, or MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL. - * *olen is always updated to reflect the amount - * of data that has (or would have) been written. - * If that length cannot be represented, then no data is - * written to the buffer and *olen is set to the maximum - * length representable as a size_t. - * - * \note Call this function with dlen = 0 to obtain the - * required buffer size in *olen - */ -int mbedtls_base64_encode( unsigned char *dst, size_t dlen, size_t *olen, - const unsigned char *src, size_t slen ); - -/** - * \brief Decode a base64-formatted buffer - * - * \param dst destination buffer (can be NULL for checking size) - * \param dlen size of the destination buffer - * \param olen number of bytes written - * \param src source buffer - * \param slen amount of data to be decoded - * - * \return 0 if successful, MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL, or - * MBEDTLS_ERR_BASE64_INVALID_CHARACTER if the input data is - * not correct. *olen is always updated to reflect the amount - * of data that has (or would have) been written. - * - * \note Call this function with *dst = NULL or dlen = 0 to obtain - * the required buffer size in *olen - */ -int mbedtls_base64_decode( unsigned char *dst, size_t dlen, size_t *olen, - const unsigned char *src, size_t slen ); - -/** - * \brief Checkup routine - * - * \return 0 if successful, or 1 if the test failed - */ -int mbedtls_base64_self_test( int verbose ); - -#ifdef __cplusplus -} -#endif - -#endif /* base64.h */ \ No newline at end of file diff --git a/others/mbedtls/check_config.h b/others/mbedtls/check_config.h deleted file mode 100644 index b6448ece..00000000 --- a/others/mbedtls/check_config.h +++ /dev/null @@ -1,540 +0,0 @@ -/** - * \file check_config.h - * - * \brief Consistency checks for configuration options - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ - -/* - * It is recommended to include this file from your config.h - * in order to catch dependency issues early. - */ - -#ifndef MBEDTLS_CHECK_CONFIG_H -#define MBEDTLS_CHECK_CONFIG_H - -/* - * We assume CHAR_BIT is 8 in many places. In practice, this is true on our - * target platforms, so not an issue, but let's just be extra sure. - */ -#include -#if CHAR_BIT != 8 -#error "mbed TLS requires a platform with 8-bit chars" -#endif - -#if defined(_WIN32) -#if !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_C is required on Windows" -#endif - -/* Fix the config here. Not convenient to put an #ifdef _WIN32 in config.h as - * it would confuse config.pl. */ -#if !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && \ - !defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) -#define MBEDTLS_PLATFORM_SNPRINTF_ALT -#endif -#endif /* _WIN32 */ - -#if defined(TARGET_LIKE_MBED) && \ - ( defined(MBEDTLS_NET_C) || defined(MBEDTLS_TIMING_C) ) -#error "The NET and TIMING modules are not available for mbed OS - please use the network and timing functions provided by mbed OS" -#endif - -#if defined(MBEDTLS_DEPRECATED_WARNING) && \ - !defined(__GNUC__) && !defined(__clang__) -#error "MBEDTLS_DEPRECATED_WARNING only works with GCC and Clang" -#endif - -#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_HAVE_TIME) -#error "MBEDTLS_HAVE_TIME_DATE without MBEDTLS_HAVE_TIME does not make sense" -#endif - -#if defined(MBEDTLS_AESNI_C) && !defined(MBEDTLS_HAVE_ASM) -#error "MBEDTLS_AESNI_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_CTR_DRBG_C) && !defined(MBEDTLS_AES_C) -#error "MBEDTLS_CTR_DRBG_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_DHM_C) && !defined(MBEDTLS_BIGNUM_C) -#error "MBEDTLS_DHM_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_ECP_C) -#error "MBEDTLS_ECDH_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_ECDSA_C) && \ - ( !defined(MBEDTLS_ECP_C) || \ - !defined(MBEDTLS_ASN1_PARSE_C) || \ - !defined(MBEDTLS_ASN1_WRITE_C) ) -#error "MBEDTLS_ECDSA_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_ECJPAKE_C) && \ - ( !defined(MBEDTLS_ECP_C) || !defined(MBEDTLS_MD_C) ) -#error "MBEDTLS_ECJPAKE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_ECDSA_DETERMINISTIC) && !defined(MBEDTLS_HMAC_DRBG_C) -#error "MBEDTLS_ECDSA_DETERMINISTIC defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \ - !defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) && \ - !defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) ) ) -#error "MBEDTLS_ECP_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_ENTROPY_C) && (!defined(MBEDTLS_SHA512_C) && \ - !defined(MBEDTLS_SHA256_C)) -#error "MBEDTLS_ENTROPY_C defined, but not all prerequisites" -#endif -#if defined(MBEDTLS_ENTROPY_C) && defined(MBEDTLS_SHA512_C) && \ - defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 64) -#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" -#endif -#if defined(MBEDTLS_ENTROPY_C) && \ - ( !defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_ENTROPY_FORCE_SHA256) ) \ - && defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 32) -#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" -#endif -#if defined(MBEDTLS_ENTROPY_C) && \ - defined(MBEDTLS_ENTROPY_FORCE_SHA256) && !defined(MBEDTLS_SHA256_C) -#error "MBEDTLS_ENTROPY_FORCE_SHA256 defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_GCM_C) && ( \ - !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) ) -#error "MBEDTLS_GCM_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_HAVEGE_C) && !defined(MBEDTLS_TIMING_C) -#error "MBEDTLS_HAVEGE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_HMAC_DRBG_C) && !defined(MBEDTLS_MD_C) -#error "MBEDTLS_HMAC_DRBG_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) && \ - ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) ) -#error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \ - ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) ) -#error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) && !defined(MBEDTLS_DHM_C) -#error "MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \ - !defined(MBEDTLS_ECDH_C) -#error "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ - ( !defined(MBEDTLS_DHM_C) || !defined(MBEDTLS_RSA_C) || \ - !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) -#error "MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ - ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_RSA_C) || \ - !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) -#error "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ - ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_ECDSA_C) || \ - !defined(MBEDTLS_X509_CRT_PARSE_C) ) -#error "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \ - ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ - !defined(MBEDTLS_PKCS1_V15) ) -#error "MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ - ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ - !defined(MBEDTLS_PKCS1_V15) ) -#error "MBEDTLS_KEY_EXCHANGE_RSA_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \ - ( !defined(MBEDTLS_ECJPAKE_C) || !defined(MBEDTLS_SHA256_C) || \ - !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ) -#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && \ - ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) -#error "MBEDTLS_MEMORY_BUFFER_ALLOC_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PADLOCK_C) && !defined(MBEDTLS_HAVE_ASM) -#error "MBEDTLS_PADLOCK_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PEM_PARSE_C) && !defined(MBEDTLS_BASE64_C) -#error "MBEDTLS_PEM_PARSE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PEM_WRITE_C) && !defined(MBEDTLS_BASE64_C) -#error "MBEDTLS_PEM_WRITE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PK_C) && \ - ( !defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_ECP_C) ) -#error "MBEDTLS_PK_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_PK_C) -#error "MBEDTLS_PK_PARSE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PK_WRITE_C) && !defined(MBEDTLS_PK_C) -#error "MBEDTLS_PK_WRITE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PKCS11_C) && !defined(MBEDTLS_PK_C) -#error "MBEDTLS_PKCS11_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_EXIT_MACRO defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) &&\ - ( defined(MBEDTLS_PLATFORM_STD_EXIT) ||\ - defined(MBEDTLS_PLATFORM_EXIT_ALT) ) -#error "MBEDTLS_PLATFORM_EXIT_MACRO and MBEDTLS_PLATFORM_STD_EXIT/MBEDTLS_PLATFORM_EXIT_ALT cannot be defined simultaneously" -#endif - -#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_FPRINTF_ALT defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_FPRINTF_MACRO defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) &&\ - ( defined(MBEDTLS_PLATFORM_STD_FPRINTF) ||\ - defined(MBEDTLS_PLATFORM_FPRINTF_ALT) ) -#error "MBEDTLS_PLATFORM_FPRINTF_MACRO and MBEDTLS_PLATFORM_STD_FPRINTF/MBEDTLS_PLATFORM_FPRINTF_ALT cannot be defined simultaneously" -#endif - -#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ - ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) -#error "MBEDTLS_PLATFORM_FREE_MACRO defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ - defined(MBEDTLS_PLATFORM_STD_FREE) -#error "MBEDTLS_PLATFORM_FREE_MACRO and MBEDTLS_PLATFORM_STD_FREE cannot be defined simultaneously" -#endif - -#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && !defined(MBEDTLS_PLATFORM_CALLOC_MACRO) -#error "MBEDTLS_PLATFORM_CALLOC_MACRO must be defined if MBEDTLS_PLATFORM_FREE_MACRO is" -#endif - -#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ - ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) -#error "MBEDTLS_PLATFORM_CALLOC_MACRO defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ - defined(MBEDTLS_PLATFORM_STD_CALLOC) -#error "MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_STD_CALLOC cannot be defined simultaneously" -#endif - -#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) && !defined(MBEDTLS_PLATFORM_FREE_MACRO) -#error "MBEDTLS_PLATFORM_FREE_MACRO must be defined if MBEDTLS_PLATFORM_CALLOC_MACRO is" -#endif - -#if defined(MBEDTLS_PLATFORM_MEMORY) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_MEMORY defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_PRINTF_ALT defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_PRINTF_MACRO defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) &&\ - ( defined(MBEDTLS_PLATFORM_STD_PRINTF) ||\ - defined(MBEDTLS_PLATFORM_PRINTF_ALT) ) -#error "MBEDTLS_PLATFORM_PRINTF_MACRO and MBEDTLS_PLATFORM_STD_PRINTF/MBEDTLS_PLATFORM_PRINTF_ALT cannot be defined simultaneously" -#endif - -#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_SNPRINTF_ALT defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) -#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) &&\ - ( defined(MBEDTLS_PLATFORM_STD_SNPRINTF) ||\ - defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) ) -#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO and MBEDTLS_PLATFORM_STD_SNPRINTF/MBEDTLS_PLATFORM_SNPRINTF_ALT cannot be defined simultaneously" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) &&\ - !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) -#error "MBEDTLS_PLATFORM_STD_MEM_HDR defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_CALLOC) && !defined(MBEDTLS_PLATFORM_MEMORY) -#error "MBEDTLS_PLATFORM_STD_CALLOC defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_CALLOC) && !defined(MBEDTLS_PLATFORM_MEMORY) -#error "MBEDTLS_PLATFORM_STD_CALLOC defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_FREE) && !defined(MBEDTLS_PLATFORM_MEMORY) -#error "MBEDTLS_PLATFORM_STD_FREE defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_EXIT) &&\ - !defined(MBEDTLS_PLATFORM_EXIT_ALT) -#error "MBEDTLS_PLATFORM_STD_EXIT defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_FPRINTF) &&\ - !defined(MBEDTLS_PLATFORM_FPRINTF_ALT) -#error "MBEDTLS_PLATFORM_STD_FPRINTF defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_PRINTF) &&\ - !defined(MBEDTLS_PLATFORM_PRINTF_ALT) -#error "MBEDTLS_PLATFORM_STD_PRINTF defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_PLATFORM_STD_SNPRINTF) &&\ - !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) -#error "MBEDTLS_PLATFORM_STD_SNPRINTF defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ - !defined(MBEDTLS_OID_C) ) -#error "MBEDTLS_RSA_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \ - ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_PKCS1_V21) ) -#error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_PROTO_SSL3) && ( !defined(MBEDTLS_MD5_C) || \ - !defined(MBEDTLS_SHA1_C) ) -#error "MBEDTLS_SSL_PROTO_SSL3 defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_PROTO_TLS1) && ( !defined(MBEDTLS_MD5_C) || \ - !defined(MBEDTLS_SHA1_C) ) -#error "MBEDTLS_SSL_PROTO_TLS1 defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_PROTO_TLS1_1) && ( !defined(MBEDTLS_MD5_C) || \ - !defined(MBEDTLS_SHA1_C) ) -#error "MBEDTLS_SSL_PROTO_TLS1_1 defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && ( !defined(MBEDTLS_SHA1_C) && \ - !defined(MBEDTLS_SHA256_C) && !defined(MBEDTLS_SHA512_C) ) -#error "MBEDTLS_SSL_PROTO_TLS1_2 defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_PROTO_DTLS) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1_2) -#error "MBEDTLS_SSL_PROTO_DTLS defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_TLS_C) -#error "MBEDTLS_SSL_CLI_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_TLS_C) && ( !defined(MBEDTLS_CIPHER_C) || \ - !defined(MBEDTLS_MD_C) ) -#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_TLS_C) -#error "MBEDTLS_SSL_SRV_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_TLS_C) && (!defined(MBEDTLS_SSL_PROTO_SSL3) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1) && !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1_2)) -#error "MBEDTLS_SSL_TLS_C defined, but no protocols are active" -#endif - -#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \ - defined(MBEDTLS_SSL_PROTO_TLS1_1) && !defined(MBEDTLS_SSL_PROTO_TLS1)) -#error "Illegal protocol selection" -#endif - -#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_TLS1) && \ - defined(MBEDTLS_SSL_PROTO_TLS1_2) && !defined(MBEDTLS_SSL_PROTO_TLS1_1)) -#error "Illegal protocol selection" -#endif - -#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \ - defined(MBEDTLS_SSL_PROTO_TLS1_2) && (!defined(MBEDTLS_SSL_PROTO_TLS1) || \ - !defined(MBEDTLS_SSL_PROTO_TLS1_1))) -#error "Illegal protocol selection" -#endif - -#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && !defined(MBEDTLS_SSL_PROTO_DTLS) -#error "MBEDTLS_SSL_DTLS_HELLO_VERIFY defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && \ - !defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) -#error "MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \ - ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) -#error "MBEDTLS_SSL_DTLS_ANTI_REPLAY defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \ - ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) -#error "MBEDTLS_SSL_DTLS_BADMAC_LIMIT defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1_2) -#error "MBEDTLS_SSL_ENCRYPT_THEN_MAC defined, but not all prerequsites" -#endif - -#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ - !defined(MBEDTLS_SSL_PROTO_TLS1_2) -#error "MBEDTLS_SSL_EXTENDED_MASTER_SECRET defined, but not all prerequsites" -#endif - -#if defined(MBEDTLS_SSL_TICKET_C) && !defined(MBEDTLS_CIPHER_C) -#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) && \ - !defined(MBEDTLS_SSL_PROTO_SSL3) && !defined(MBEDTLS_SSL_PROTO_TLS1) -#error "MBEDTLS_SSL_CBC_RECORD_SPLITTING defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \ - !defined(MBEDTLS_X509_CRT_PARSE_C) -#error "MBEDTLS_SSL_SERVER_NAME_INDICATION defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_THREADING_PTHREAD) -#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) -#error "MBEDTLS_THREADING_PTHREAD defined, but not all prerequisites" -#endif -#define MBEDTLS_THREADING_IMPL -#endif - -#if defined(MBEDTLS_THREADING_ALT) -#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) -#error "MBEDTLS_THREADING_ALT defined, but not all prerequisites" -#endif -#define MBEDTLS_THREADING_IMPL -#endif - -#if defined(MBEDTLS_THREADING_C) && !defined(MBEDTLS_THREADING_IMPL) -#error "MBEDTLS_THREADING_C defined, single threading implementation required" -#endif -#undef MBEDTLS_THREADING_IMPL - -#if defined(MBEDTLS_VERSION_FEATURES) && !defined(MBEDTLS_VERSION_C) -#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_USE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ - !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_PARSE_C) || \ - !defined(MBEDTLS_PK_PARSE_C) ) -#error "MBEDTLS_X509_USE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_CREATE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ - !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_WRITE_C) || \ - !defined(MBEDTLS_PK_WRITE_C) ) -#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_CRT_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) -#error "MBEDTLS_X509_CRT_PARSE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_CRL_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) -#error "MBEDTLS_X509_CRL_PARSE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_CSR_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) -#error "MBEDTLS_X509_CSR_PARSE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_CRT_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) -#error "MBEDTLS_X509_CRT_WRITE_C defined, but not all prerequisites" -#endif - -#if defined(MBEDTLS_X509_CSR_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) -#error "MBEDTLS_X509_CSR_WRITE_C defined, but not all prerequisites" -#endif - -/* - * Avoid warning from -pedantic. This is a convenient place for this - * workaround since this is included by every single file before the - * #if defined(MBEDTLS_xxx_C) that results in emtpy translation units. - */ -typedef int mbedtls_iso_c_forbids_empty_translation_units; - -#endif /* MBEDTLS_CHECK_CONFIG_H */ diff --git a/others/mbedtls/mbed-tls-config.h b/others/mbedtls/mbed-tls-config.h deleted file mode 100644 index ad564cfc..00000000 --- a/others/mbedtls/mbed-tls-config.h +++ /dev/null @@ -1,2511 +0,0 @@ -/** - * \file config.h - * - * \brief Configuration options (set of defines) - * - * This set of compile-time options may be used to enable - * or disable features selectively, and reduce the global - * memory footprint. - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ - -#ifndef MBEDTLS_CONFIG_H -#define MBEDTLS_CONFIG_H - -#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) -#define _CRT_SECURE_NO_DEPRECATE 1 -#endif - -/** - * \name SECTION: System support - * - * This section sets system specific settings. - * \{ - */ - -/** - * \def MBEDTLS_HAVE_ASM - * - * The compiler has support for asm(). - * - * Requires support for asm() in compiler. - * - * Used in: - * library/timing.c - * library/padlock.c - * include/mbedtls/bn_mul.h - * - * Comment to disable the use of assembly code. - */ -#define MBEDTLS_HAVE_ASM - -/** - * \def MBEDTLS_HAVE_SSE2 - * - * CPU supports SSE2 instruction set. - * - * Uncomment if the CPU supports SSE2 (IA-32 specific). - */ -//#define MBEDTLS_HAVE_SSE2 - -/** - * \def MBEDTLS_HAVE_TIME - * - * System has time.h and time(). - * The time does not need to be correct, only time differences are used, - * by contrast with MBEDTLS_HAVE_TIME_DATE - * - * Comment if your system does not support time functions - */ -#define MBEDTLS_HAVE_TIME - -/** - * \def MBEDTLS_HAVE_TIME_DATE - * - * System has time.h and time(), gmtime() and the clock is correct. - * The time needs to be correct (not necesarily very accurate, but at least - * the date should be correct). This is used to verify the validity period of - * X.509 certificates. - * - * Comment if your system does not have a correct clock. - */ -#define MBEDTLS_HAVE_TIME_DATE - -/** - * \def MBEDTLS_PLATFORM_MEMORY - * - * Enable the memory allocation layer. - * - * By default mbed TLS uses the system-provided calloc() and free(). - * This allows different allocators (self-implemented or provided) to be - * provided to the platform abstraction layer. - * - * Enabling MBEDTLS_PLATFORM_MEMORY without the - * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide - * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and - * free() function pointer at runtime. - * - * Enabling MBEDTLS_PLATFORM_MEMORY and specifying - * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the - * alternate function at compile time. - * - * Requires: MBEDTLS_PLATFORM_C - * - * Enable this layer to allow use of alternative memory allocators. - */ -//#define MBEDTLS_PLATFORM_MEMORY - -/** - * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS - * - * Do not assign standard functions in the platform layer (e.g. calloc() to - * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) - * - * This makes sure there are no linking errors on platforms that do not support - * these functions. You will HAVE to provide alternatives, either at runtime - * via the platform_set_xxx() functions or at compile time by setting - * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a - * MBEDTLS_PLATFORM_XXX_MACRO. - * - * Requires: MBEDTLS_PLATFORM_C - * - * Uncomment to prevent default assignment of standard functions in the - * platform layer. - */ -//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS - -/** - * \def MBEDTLS_PLATFORM_EXIT_ALT - * - * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the - * function in the platform abstraction layer. - * - * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will - * provide a function "mbedtls_platform_set_printf()" that allows you to set an - * alternative printf function pointer. - * - * All these define require MBEDTLS_PLATFORM_C to be defined! - * - * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows; - * it will be enabled automatically by check_config.h - * - * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as - * MBEDTLS_PLATFORM_XXX_MACRO! - * - * Uncomment a macro to enable alternate implementation of specific base - * platform function - */ -//#define MBEDTLS_PLATFORM_EXIT_ALT -//#define MBEDTLS_PLATFORM_FPRINTF_ALT -//#define MBEDTLS_PLATFORM_PRINTF_ALT -//#define MBEDTLS_PLATFORM_SNPRINTF_ALT - -/** - * \def MBEDTLS_DEPRECATED_WARNING - * - * Mark deprecated functions so that they generate a warning if used. - * Functions deprecated in one version will usually be removed in the next - * version. You can enable this to help you prepare the transition to a new - * major version by making sure your code is not using these functions. - * - * This only works with GCC and Clang. With other compilers, you may want to - * use MBEDTLS_DEPRECATED_REMOVED - * - * Uncomment to get warnings on using deprecated functions. - */ -//#define MBEDTLS_DEPRECATED_WARNING - -/** - * \def MBEDTLS_DEPRECATED_REMOVED - * - * Remove deprecated functions so that they generate an error if used. - * Functions deprecated in one version will usually be removed in the next - * version. You can enable this to help you prepare the transition to a new - * major version by making sure your code is not using these functions. - * - * Uncomment to get errors on using deprecated functions. - */ -//#define MBEDTLS_DEPRECATED_REMOVED - -/* \} name SECTION: System support */ - -/** - * \name SECTION: mbed TLS feature support - * - * This section sets support for features that are or are not needed - * within the modules that are enabled. - * \{ - */ - -/** - * \def MBEDTLS_TIMING_ALT - * - * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(), - * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() - * - * Only works if you have MBEDTLS_TIMING_C enabled. - * - * You will need to provide a header "timing_alt.h" and an implementation at - * compile time. - */ -//#define MBEDTLS_TIMING_ALT - -/** - * \def MBEDTLS_AES_ALT - * - * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your - * alternate core implementation of a symmetric crypto or hash module (e.g. - * platform specific assembly optimized implementations). Keep in mind that - * the function prototypes should remain the same. - * - * This replaces the whole module. If you only want to replace one of the - * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. - * - * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer - * provide the "struct mbedtls_aes_context" definition and omit the base function - * declarations and implementations. "aes_alt.h" will be included from - * "aes.h" to include the new function definitions. - * - * Uncomment a macro to enable alternate implementation of the corresponding - * module. - */ -//#define MBEDTLS_AES_ALT -//#define MBEDTLS_ARC4_ALT -//#define MBEDTLS_BLOWFISH_ALT -//#define MBEDTLS_CAMELLIA_ALT -//#define MBEDTLS_DES_ALT -//#define MBEDTLS_XTEA_ALT -//#define MBEDTLS_MD2_ALT -//#define MBEDTLS_MD4_ALT -//#define MBEDTLS_MD5_ALT -//#define MBEDTLS_RIPEMD160_ALT -//#define MBEDTLS_SHA1_ALT -//#define MBEDTLS_SHA256_ALT -//#define MBEDTLS_SHA512_ALT - -/** - * \def MBEDTLS_MD2_PROCESS_ALT - * - * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you - * alternate core implementation of symmetric crypto or hash function. Keep in - * mind that function prototypes should remain the same. - * - * This replaces only one function. The header file from mbed TLS is still - * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. - * - * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will - * no longer provide the mbedtls_sha1_process() function, but it will still provide - * the other function (using your mbedtls_sha1_process() function) and the definition - * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible - * with this definition. - * - * Note: if you use the AES_xxx_ALT macros, then is is recommended to also set - * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES - * tables. - * - * Uncomment a macro to enable alternate implementation of the corresponding - * function. - */ -//#define MBEDTLS_MD2_PROCESS_ALT -//#define MBEDTLS_MD4_PROCESS_ALT -//#define MBEDTLS_MD5_PROCESS_ALT -//#define MBEDTLS_RIPEMD160_PROCESS_ALT -//#define MBEDTLS_SHA1_PROCESS_ALT -//#define MBEDTLS_SHA256_PROCESS_ALT -//#define MBEDTLS_SHA512_PROCESS_ALT -//#define MBEDTLS_DES_SETKEY_ALT -//#define MBEDTLS_DES_CRYPT_ECB_ALT -//#define MBEDTLS_DES3_CRYPT_ECB_ALT -//#define MBEDTLS_AES_SETKEY_ENC_ALT -//#define MBEDTLS_AES_SETKEY_DEC_ALT -//#define MBEDTLS_AES_ENCRYPT_ALT -//#define MBEDTLS_AES_DECRYPT_ALT - -/** - * \def MBEDTLS_ENTROPY_HARDWARE_ALT - * - * Uncomment this macro to let mbed TLS use your own implementation of a - * hardware entropy collector. - * - * Your function must be called \c mbedtls_hardware_poll(), have the same - * prototype as declared in entropy_poll.h, and accept NULL as first argument. - * - * Uncomment to use your own hardware entropy collector. - */ -//#define MBEDTLS_ENTROPY_HARDWARE_ALT - -/** - * \def MBEDTLS_AES_ROM_TABLES - * - * Store the AES tables in ROM. - * - * Uncomment this macro to store the AES tables in ROM. - */ -//#define MBEDTLS_AES_ROM_TABLES - -/** - * \def MBEDTLS_CAMELLIA_SMALL_MEMORY - * - * Use less ROM for the Camellia implementation (saves about 768 bytes). - * - * Uncomment this macro to use less memory for Camellia. - */ -//#define MBEDTLS_CAMELLIA_SMALL_MEMORY - -/** - * \def MBEDTLS_CIPHER_MODE_CBC - * - * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. - */ -#define MBEDTLS_CIPHER_MODE_CBC - -/** - * \def MBEDTLS_CIPHER_MODE_CFB - * - * Enable Cipher Feedback mode (CFB) for symmetric ciphers. - */ -#define MBEDTLS_CIPHER_MODE_CFB - -/** - * \def MBEDTLS_CIPHER_MODE_CTR - * - * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. - */ -#define MBEDTLS_CIPHER_MODE_CTR - -/** - * \def MBEDTLS_CIPHER_NULL_CIPHER - * - * Enable NULL cipher. - * Warning: Only do so when you know what you are doing. This allows for - * encryption or channels without any security! - * - * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable - * the following ciphersuites: - * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA - * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 - * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 - * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 - * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA - * MBEDTLS_TLS_RSA_WITH_NULL_SHA256 - * MBEDTLS_TLS_RSA_WITH_NULL_SHA - * MBEDTLS_TLS_RSA_WITH_NULL_MD5 - * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA - * MBEDTLS_TLS_PSK_WITH_NULL_SHA384 - * MBEDTLS_TLS_PSK_WITH_NULL_SHA256 - * MBEDTLS_TLS_PSK_WITH_NULL_SHA - * - * Uncomment this macro to enable the NULL cipher and ciphersuites - */ -//#define MBEDTLS_CIPHER_NULL_CIPHER - -/** - * \def MBEDTLS_CIPHER_PADDING_PKCS7 - * - * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for - * specific padding modes in the cipher layer with cipher modes that support - * padding (e.g. CBC) - * - * If you disable all padding modes, only full blocks can be used with CBC. - * - * Enable padding modes in the cipher layer. - */ -#define MBEDTLS_CIPHER_PADDING_PKCS7 -#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS -#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN -#define MBEDTLS_CIPHER_PADDING_ZEROS - -/** - * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES - * - * Enable weak ciphersuites in SSL / TLS. - * Warning: Only do so when you know what you are doing. This allows for - * channels with virtually no security at all! - * - * This enables the following ciphersuites: - * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA - * - * Uncomment this macro to enable weak ciphersuites - */ -//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES - -/** - * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES - * - * Remove RC4 ciphersuites by default in SSL / TLS. - * This flag removes the ciphersuites based on RC4 from the default list as - * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to - * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them - * explicitly. - * - * Uncomment this macro to remove RC4 ciphersuites by default. - */ -#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES - -/** - * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED - * - * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve - * module. By default all supported curves are enabled. - * - * Comment macros to disable the curve and functions for it - */ -#define MBEDTLS_ECP_DP_SECP192R1_ENABLED -#define MBEDTLS_ECP_DP_SECP224R1_ENABLED -#define MBEDTLS_ECP_DP_SECP256R1_ENABLED -#define MBEDTLS_ECP_DP_SECP384R1_ENABLED -#define MBEDTLS_ECP_DP_SECP521R1_ENABLED -#define MBEDTLS_ECP_DP_SECP192K1_ENABLED -#define MBEDTLS_ECP_DP_SECP224K1_ENABLED -#define MBEDTLS_ECP_DP_SECP256K1_ENABLED -#define MBEDTLS_ECP_DP_BP256R1_ENABLED -#define MBEDTLS_ECP_DP_BP384R1_ENABLED -#define MBEDTLS_ECP_DP_BP512R1_ENABLED -#define MBEDTLS_ECP_DP_CURVE25519_ENABLED - -/** - * \def MBEDTLS_ECP_NIST_OPTIM - * - * Enable specific 'modulo p' routines for each NIST prime. - * Depending on the prime and architecture, makes operations 4 to 8 times - * faster on the corresponding curve. - * - * Comment this macro to disable NIST curves optimisation. - */ -#define MBEDTLS_ECP_NIST_OPTIM - -/** - * \def MBEDTLS_ECDSA_DETERMINISTIC - * - * Enable deterministic ECDSA (RFC 6979). - * Standard ECDSA is "fragile" in the sense that lack of entropy when signing - * may result in a compromise of the long-term signing key. This is avoided by - * the deterministic variant. - * - * Requires: MBEDTLS_HMAC_DRBG_C - * - * Comment this macro to disable deterministic ECDSA. - */ -#define MBEDTLS_ECDSA_DETERMINISTIC - -/** - * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED - * - * Enable the PSK based ciphersuite modes in SSL / TLS. - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA - */ -#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED - * - * Enable the DHE-PSK based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_DHM_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA - */ -#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED - * - * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_ECDH_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA - */ -#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED - * - * Enable the RSA-PSK based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, - * MBEDTLS_X509_CRT_PARSE_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA - */ -#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED - * - * Enable the RSA-only based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, - * MBEDTLS_X509_CRT_PARSE_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 - */ -#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED - * - * Enable the DHE-RSA based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, - * MBEDTLS_X509_CRT_PARSE_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - */ -#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED - * - * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, - * MBEDTLS_X509_CRT_PARSE_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA - */ -#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - * - * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C, - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA - */ -#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED - * - * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 - */ -#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED - * - * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. - * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 - */ -#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED - -/** - * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED - * - * Enable the ECJPAKE based ciphersuite modes in SSL / TLS. - * - * \warning This is currently experimental. EC J-PAKE support is based on the - * Thread v1.0.0 specification; incompatible changes to the specification - * might still happen. For this reason, this is disabled by default. - * - * Requires: MBEDTLS_ECJPAKE_C - * MBEDTLS_SHA256_C - * MBEDTLS_ECP_DP_SECP256R1_ENABLED - * - * This enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 - */ -//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED - -/** - * \def MBEDTLS_PK_PARSE_EC_EXTENDED - * - * Enhance support for reading EC keys using variants of SEC1 not allowed by - * RFC 5915 and RFC 5480. - * - * Currently this means parsing the SpecifiedECDomain choice of EC - * parameters (only known groups are supported, not arbitrary domains, to - * avoid validation issues). - * - * Disable if you only need to support RFC 5915 + 5480 key formats. - */ -#define MBEDTLS_PK_PARSE_EC_EXTENDED - -/** - * \def MBEDTLS_ERROR_STRERROR_DUMMY - * - * Enable a dummy error function to make use of mbedtls_strerror() in - * third party libraries easier when MBEDTLS_ERROR_C is disabled - * (no effect when MBEDTLS_ERROR_C is enabled). - * - * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're - * not using mbedtls_strerror() or error_strerror() in your application. - * - * Disable if you run into name conflicts and want to really remove the - * mbedtls_strerror() - */ -#define MBEDTLS_ERROR_STRERROR_DUMMY - -/** - * \def MBEDTLS_GENPRIME - * - * Enable the prime-number generation code. - * - * Requires: MBEDTLS_BIGNUM_C - */ -#define MBEDTLS_GENPRIME - -/** - * \def MBEDTLS_FS_IO - * - * Enable functions that use the filesystem. - */ -#define MBEDTLS_FS_IO - -/** - * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES - * - * Do not add default entropy sources. These are the platform specific, - * mbedtls_timing_hardclock and HAVEGE based poll functions. - * - * This is useful to have more control over the added entropy sources in an - * application. - * - * Uncomment this macro to prevent loading of default entropy functions. - */ -//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES - -/** - * \def MBEDTLS_NO_PLATFORM_ENTROPY - * - * Do not use built-in platform entropy functions. - * This is useful if your platform does not support - * standards like the /dev/urandom or Windows CryptoAPI. - * - * Uncomment this macro to disable the built-in platform entropy functions. - */ -//#define MBEDTLS_NO_PLATFORM_ENTROPY - -/** - * \def MBEDTLS_ENTROPY_FORCE_SHA256 - * - * Force the entropy accumulator to use a SHA-256 accumulator instead of the - * default SHA-512 based one (if both are available). - * - * Requires: MBEDTLS_SHA256_C - * - * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option - * if you have performance concerns. - * - * This option is only useful if both MBEDTLS_SHA256_C and - * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. - */ -//#define MBEDTLS_ENTROPY_FORCE_SHA256 - -/** - * \def MBEDTLS_MEMORY_DEBUG - * - * Enable debugging of buffer allocator memory issues. Automatically prints - * (to stderr) all (fatal) messages on memory allocation issues. Enables - * function for 'debug output' of allocated memory. - * - * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C - * - * Uncomment this macro to let the buffer allocator print out error messages. - */ -//#define MBEDTLS_MEMORY_DEBUG - -/** - * \def MBEDTLS_MEMORY_BACKTRACE - * - * Include backtrace information with each allocated block. - * - * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C - * GLIBC-compatible backtrace() an backtrace_symbols() support - * - * Uncomment this macro to include backtrace information - */ -//#define MBEDTLS_MEMORY_BACKTRACE - -/** - * \def MBEDTLS_PK_RSA_ALT_SUPPORT - * - * Support external private RSA keys (eg from a HSM) in the PK layer. - * - * Comment this macro to disable support for external private RSA keys. - */ -#define MBEDTLS_PK_RSA_ALT_SUPPORT - -/** - * \def MBEDTLS_PKCS1_V15 - * - * Enable support for PKCS#1 v1.5 encoding. - * - * Requires: MBEDTLS_RSA_C - * - * This enables support for PKCS#1 v1.5 operations. - */ -#define MBEDTLS_PKCS1_V15 - -/** - * \def MBEDTLS_PKCS1_V21 - * - * Enable support for PKCS#1 v2.1 encoding. - * - * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C - * - * This enables support for RSAES-OAEP and RSASSA-PSS operations. - */ -#define MBEDTLS_PKCS1_V21 - -/** - * \def MBEDTLS_RSA_NO_CRT - * - * Do not use the Chinese Remainder Theorem for the RSA private operation. - * - * Uncomment this macro to disable the use of CRT in RSA. - * - */ -//#define MBEDTLS_RSA_NO_CRT - -/** - * \def MBEDTLS_SELF_TEST - * - * Enable the checkup functions (*_self_test). - */ -//#define MBEDTLS_SELF_TEST - -/** - * \def MBEDTLS_SHA256_SMALLER - * - * Enable an implementation of SHA-256 that has lower ROM footprint but also - * lower performance. - * - * The default implementation is meant to be a reasonnable compromise between - * performance and size. This version optimizes more aggressively for size at - * the expense of performance. Eg on Cortex-M4 it reduces the size of - * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about - * 30%. - * - * Uncomment to enable the smaller implementation of SHA256. - */ -//#define MBEDTLS_SHA256_SMALLER - -/** - * \def MBEDTLS_SSL_AEAD_RANDOM_IV - * - * Generate a random IV rather than using the record sequence number as a - * nonce for ciphersuites using and AEAD algorithm (GCM or CCM). - * - * Using the sequence number is generally recommended. - * - * Uncomment this macro to always use random IVs with AEAD ciphersuites. - */ -//#define MBEDTLS_SSL_AEAD_RANDOM_IV - -/** - * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES - * - * Enable sending of alert messages in case of encountered errors as per RFC. - * If you choose not to send the alert messages, mbed TLS can still communicate - * with other servers, only debugging of failures is harder. - * - * The advantage of not sending alert messages, is that no information is given - * about reasons for failures thus preventing adversaries of gaining intel. - * - * Enable sending of all alert messages - */ -#define MBEDTLS_SSL_ALL_ALERT_MESSAGES - -/** - * \def MBEDTLS_SSL_DEBUG_ALL - * - * Enable the debug messages in SSL module for all issues. - * Debug messages have been disabled in some places to prevent timing - * attacks due to (unbalanced) debugging function calls. - * - * If you need all error reporting you should enable this during debugging, - * but remove this for production servers that should log as well. - * - * Uncomment this macro to report all debug messages on errors introducing - * a timing side-channel. - * - */ -//#define MBEDTLS_SSL_DEBUG_ALL - -/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC - * - * Enable support for Encrypt-then-MAC, RFC 7366. - * - * This allows peers that both support it to use a more robust protection for - * ciphersuites using CBC, providing deep resistance against timing attacks - * on the padding or underlying cipher. - * - * This only affects CBC ciphersuites, and is useless if none is defined. - * - * Requires: MBEDTLS_SSL_PROTO_TLS1 or - * MBEDTLS_SSL_PROTO_TLS1_1 or - * MBEDTLS_SSL_PROTO_TLS1_2 - * - * Comment this macro to disable support for Encrypt-then-MAC - */ -#define MBEDTLS_SSL_ENCRYPT_THEN_MAC - -/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET - * - * Enable support for Extended Master Secret, aka Session Hash - * (draft-ietf-tls-session-hash-02). - * - * This was introduced as "the proper fix" to the Triple Handshake familiy of - * attacks, but it is recommended to always use it (even if you disable - * renegotiation), since it actually fixes a more fundamental issue in the - * original SSL/TLS design, and has implications beyond Triple Handshake. - * - * Requires: MBEDTLS_SSL_PROTO_TLS1 or - * MBEDTLS_SSL_PROTO_TLS1_1 or - * MBEDTLS_SSL_PROTO_TLS1_2 - * - * Comment this macro to disable support for Extended Master Secret. - */ -#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET - -/** - * \def MBEDTLS_SSL_FALLBACK_SCSV - * - * Enable support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv-00). - * - * For servers, it is recommended to always enable this, unless you support - * only one version of TLS, or know for sure that none of your clients - * implements a fallback strategy. - * - * For clients, you only need this if you're using a fallback strategy, which - * is not recommended in the first place, unless you absolutely need it to - * interoperate with buggy (version-intolerant) servers. - * - * Comment this macro to disable support for FALLBACK_SCSV - */ -#define MBEDTLS_SSL_FALLBACK_SCSV - -/** - * \def MBEDTLS_SSL_HW_RECORD_ACCEL - * - * Enable hooking functions in SSL module for hardware acceleration of - * individual records. - * - * Uncomment this macro to enable hooking functions. - */ -//#define MBEDTLS_SSL_HW_RECORD_ACCEL - -/** - * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING - * - * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. - * - * This is a countermeasure to the BEAST attack, which also minimizes the risk - * of interoperability issues compared to sending 0-length records. - * - * Comment this macro to disable 1/n-1 record splitting. - */ -#define MBEDTLS_SSL_CBC_RECORD_SPLITTING - -/** - * \def MBEDTLS_SSL_RENEGOTIATION - * - * Disable support for TLS renegotiation. - * - * The two main uses of renegotiation are (1) refresh keys on long-lived - * connections and (2) client authentication after the initial handshake. - * If you don't need renegotiation, it's probably better to disable it, since - * it has been associated with security issues in the past and is easy to - * misuse/misunderstand. - * - * Comment this to disable support for renegotiation. - */ -#define MBEDTLS_SSL_RENEGOTIATION - -/** - * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO - * - * Enable support for receiving and parsing SSLv2 Client Hello messages for the - * SSL Server module (MBEDTLS_SSL_SRV_C). - * - * Uncomment this macro to enable support for SSLv2 Client Hello messages. - */ -//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO - -/** - * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE - * - * Pick the ciphersuite according to the client's preferences rather than ours - * in the SSL Server module (MBEDTLS_SSL_SRV_C). - * - * Uncomment this macro to respect client's ciphersuite order - */ -//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE - -/** - * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH - * - * Enable support for RFC 6066 max_fragment_length extension in SSL. - * - * Comment this macro to disable support for the max_fragment_length extension - */ -#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH - -/** - * \def MBEDTLS_SSL_PROTO_SSL3 - * - * Enable support for SSL 3.0. - * - * Requires: MBEDTLS_MD5_C - * MBEDTLS_SHA1_C - * - * Comment this macro to disable support for SSL 3.0 - */ -#define MBEDTLS_SSL_PROTO_SSL3 - -/** - * \def MBEDTLS_SSL_PROTO_TLS1 - * - * Enable support for TLS 1.0. - * - * Requires: MBEDTLS_MD5_C - * MBEDTLS_SHA1_C - * - * Comment this macro to disable support for TLS 1.0 - */ -#define MBEDTLS_SSL_PROTO_TLS1 - -/** - * \def MBEDTLS_SSL_PROTO_TLS1_1 - * - * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). - * - * Requires: MBEDTLS_MD5_C - * MBEDTLS_SHA1_C - * - * Comment this macro to disable support for TLS 1.1 / DTLS 1.0 - */ -#define MBEDTLS_SSL_PROTO_TLS1_1 - -/** - * \def MBEDTLS_SSL_PROTO_TLS1_2 - * - * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). - * - * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C - * (Depends on ciphersuites) - * - * Comment this macro to disable support for TLS 1.2 / DTLS 1.2 - */ -#define MBEDTLS_SSL_PROTO_TLS1_2 - -/** - * \def MBEDTLS_SSL_PROTO_DTLS - * - * Enable support for DTLS (all available versions). - * - * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, - * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. - * - * Requires: MBEDTLS_SSL_PROTO_TLS1_1 - * or MBEDTLS_SSL_PROTO_TLS1_2 - * - * Comment this macro to disable support for DTLS - */ -#define MBEDTLS_SSL_PROTO_DTLS - -/** - * \def MBEDTLS_SSL_ALPN - * - * Enable support for RFC 7301 Application Layer Protocol Negotiation. - * - * Comment this macro to disable support for ALPN. - */ -#define MBEDTLS_SSL_ALPN - -/** - * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY - * - * Enable support for the anti-replay mechanism in DTLS. - * - * Requires: MBEDTLS_SSL_TLS_C - * MBEDTLS_SSL_PROTO_DTLS - * - * \warning Disabling this is often a security risk! - * See mbedtls_ssl_conf_dtls_anti_replay() for details. - * - * Comment this to disable anti-replay in DTLS. - */ -#define MBEDTLS_SSL_DTLS_ANTI_REPLAY - -/** - * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY - * - * Enable support for HelloVerifyRequest on DTLS servers. - * - * This feature is highly recommended to prevent DTLS servers being used as - * amplifiers in DoS attacks against other hosts. It should always be enabled - * unless you know for sure amplification cannot be a problem in the - * environment in which your server operates. - * - * \warning Disabling this can ba a security risk! (see above) - * - * Requires: MBEDTLS_SSL_PROTO_DTLS - * - * Comment this to disable support for HelloVerifyRequest. - */ -#define MBEDTLS_SSL_DTLS_HELLO_VERIFY - -/** - * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE - * - * Enable server-side support for clients that reconnect from the same port. - * - * Some clients unexpectedly close the connection and try to reconnect using the - * same source port. This needs special support from the server to handle the - * new connection securely, as described in section 4.2.8 of RFC 6347. This - * flag enables that support. - * - * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY - * - * Comment this to disable support for clients reusing the source port. - */ -#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE - -/** - * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT - * - * Enable support for a limit of records with bad MAC. - * - * See mbedtls_ssl_conf_dtls_badmac_limit(). - * - * Requires: MBEDTLS_SSL_PROTO_DTLS - */ -#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT - -/** - * \def MBEDTLS_SSL_SESSION_TICKETS - * - * Enable support for RFC 5077 session tickets in SSL. - * Client-side, provides full support for session tickets (maintainance of a - * session store remains the responsibility of the application, though). - * Server-side, you also need to provide callbacks for writing and parsing - * tickets, including authenticated encryption and key management. Example - * callbacks are provided by MBEDTLS_SSL_TICKET_C. - * - * Comment this macro to disable support for SSL session tickets - */ -#define MBEDTLS_SSL_SESSION_TICKETS - -/** - * \def MBEDTLS_SSL_EXPORT_KEYS - * - * Enable support for exporting key block and master secret. - * This is required for certain users of TLS, e.g. EAP-TLS. - * - * Comment this macro to disable support for key export - */ -#define MBEDTLS_SSL_EXPORT_KEYS - -/** - * \def MBEDTLS_SSL_SERVER_NAME_INDICATION - * - * Enable support for RFC 6066 server name indication (SNI) in SSL. - * - * Requires: MBEDTLS_X509_CRT_PARSE_C - * - * Comment this macro to disable support for server name indication in SSL - */ -#define MBEDTLS_SSL_SERVER_NAME_INDICATION - -/** - * \def MBEDTLS_SSL_TRUNCATED_HMAC - * - * Enable support for RFC 6066 truncated HMAC in SSL. - * - * Comment this macro to disable support for truncated HMAC in SSL - */ -#define MBEDTLS_SSL_TRUNCATED_HMAC - -/** - * \def MBEDTLS_THREADING_ALT - * - * Provide your own alternate threading implementation. - * - * Requires: MBEDTLS_THREADING_C - * - * Uncomment this to allow your own alternate threading implementation. - */ -//#define MBEDTLS_THREADING_ALT - -/** - * \def MBEDTLS_THREADING_PTHREAD - * - * Enable the pthread wrapper layer for the threading layer. - * - * Requires: MBEDTLS_THREADING_C - * - * Uncomment this to enable pthread mutexes. - */ -//#define MBEDTLS_THREADING_PTHREAD - -/** - * \def MBEDTLS_VERSION_FEATURES - * - * Allow run-time checking of compile-time enabled features. Thus allowing users - * to check at run-time if the library is for instance compiled with threading - * support via mbedtls_version_check_feature(). - * - * Requires: MBEDTLS_VERSION_C - * - * Comment this to disable run-time checking and save ROM space - */ -#define MBEDTLS_VERSION_FEATURES - -/** - * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 - * - * If set, the X509 parser will not break-off when parsing an X509 certificate - * and encountering an extension in a v1 or v2 certificate. - * - * Uncomment to prevent an error. - */ -//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 - -/** - * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION - * - * If set, the X509 parser will not break-off when parsing an X509 certificate - * and encountering an unknown critical extension. - * - * \warning Depending on your PKI use, enabling this can be a security risk! - * - * Uncomment to prevent an error. - */ -//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION - -/** - * \def MBEDTLS_X509_CHECK_KEY_USAGE - * - * Enable verification of the keyUsage extension (CA and leaf certificates). - * - * Disabling this avoids problems with mis-issued and/or misused - * (intermediate) CA and leaf certificates. - * - * \warning Depending on your PKI use, disabling this can be a security risk! - * - * Comment to skip keyUsage checking for both CA and leaf certificates. - */ -#define MBEDTLS_X509_CHECK_KEY_USAGE - -/** - * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE - * - * Enable verification of the extendedKeyUsage extension (leaf certificates). - * - * Disabling this avoids problems with mis-issued and/or misused certificates. - * - * \warning Depending on your PKI use, disabling this can be a security risk! - * - * Comment to skip extendedKeyUsage checking for certificates. - */ -#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE - -/** - * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT - * - * Enable parsing and verification of X.509 certificates, CRLs and CSRS - * signed with RSASSA-PSS (aka PKCS#1 v2.1). - * - * Comment this macro to disallow using RSASSA-PSS in certificates. - */ -#define MBEDTLS_X509_RSASSA_PSS_SUPPORT - -/** - * \def MBEDTLS_ZLIB_SUPPORT - * - * If set, the SSL/TLS module uses ZLIB to support compression and - * decompression of packet data. - * - * \warning TLS-level compression MAY REDUCE SECURITY! See for example the - * CRIME attack. Before enabling this option, you should examine with care if - * CRIME or similar exploits may be a applicable to your use case. - * - * \note Currently compression can't be used with DTLS. - * - * Used in: library/ssl_tls.c - * library/ssl_cli.c - * library/ssl_srv.c - * - * This feature requires zlib library and headers to be present. - * - * Uncomment to enable use of ZLIB - */ -//#define MBEDTLS_ZLIB_SUPPORT -/* \} name SECTION: mbed TLS feature support */ - -/** - * \name SECTION: mbed TLS modules - * - * This section enables or disables entire modules in mbed TLS - * \{ - */ - -/** - * \def MBEDTLS_AESNI_C - * - * Enable AES-NI support on x86-64. - * - * Module: library/aesni.c - * Caller: library/aes.c - * - * Requires: MBEDTLS_HAVE_ASM - * - * This modules adds support for the AES-NI instructions on x86-64 - */ -#define MBEDTLS_AESNI_C - -/** - * \def MBEDTLS_AES_C - * - * Enable the AES block cipher. - * - * Module: library/aes.c - * Caller: library/ssl_tls.c - * library/pem.c - * library/ctr_drbg.c - * - * This module enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA - * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 - * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 - * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA - * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 - * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 - * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA - * - * PEM_PARSE uses AES for decrypting encrypted keys. - */ -#define MBEDTLS_AES_C - -/** - * \def MBEDTLS_ARC4_C - * - * Enable the ARCFOUR stream cipher. - * - * Module: library/arc4.c - * Caller: library/ssl_tls.c - * - * This module enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA - * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA - * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 - * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA - * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA - */ -#define MBEDTLS_ARC4_C - -/** - * \def MBEDTLS_ASN1_PARSE_C - * - * Enable the generic ASN1 parser. - * - * Module: library/asn1.c - * Caller: library/x509.c - * library/dhm.c - * library/pkcs12.c - * library/pkcs5.c - * library/pkparse.c - */ -#define MBEDTLS_ASN1_PARSE_C - -/** - * \def MBEDTLS_ASN1_WRITE_C - * - * Enable the generic ASN1 writer. - * - * Module: library/asn1write.c - * Caller: library/ecdsa.c - * library/pkwrite.c - * library/x509_create.c - * library/x509write_crt.c - * library/mbedtls_x509write_csr.c - */ -#define MBEDTLS_ASN1_WRITE_C - -/** - * \def MBEDTLS_BASE64_C - * - * Enable the Base64 module. - * - * Module: library/base64.c - * Caller: library/pem.c - * - * This module is required for PEM support (required by X.509). - */ -#define MBEDTLS_BASE64_C - -/** - * \def MBEDTLS_BIGNUM_C - * - * Enable the multi-precision integer library. - * - * Module: library/bignum.c - * Caller: library/dhm.c - * library/ecp.c - * library/ecdsa.c - * library/rsa.c - * library/ssl_tls.c - * - * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support. - */ -#define MBEDTLS_BIGNUM_C - -/** - * \def MBEDTLS_BLOWFISH_C - * - * Enable the Blowfish block cipher. - * - * Module: library/blowfish.c - */ -#define MBEDTLS_BLOWFISH_C - -/** - * \def MBEDTLS_CAMELLIA_C - * - * Enable the Camellia block cipher. - * - * Module: library/camellia.c - * Caller: library/ssl_tls.c - * - * This module enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 - * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 - */ -#define MBEDTLS_CAMELLIA_C - -/** - * \def MBEDTLS_CCM_C - * - * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. - * - * Module: library/ccm.c - * - * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C - * - * This module enables the AES-CCM ciphersuites, if other requisites are - * enabled as well. - */ -#define MBEDTLS_CCM_C - -/** - * \def MBEDTLS_CERTS_C - * - * Enable the test certificates. - * - * Module: library/certs.c - * Caller: - * - * This module is used for testing (ssl_client/server). - */ -#define MBEDTLS_CERTS_C - -/** - * \def MBEDTLS_CIPHER_C - * - * Enable the generic cipher layer. - * - * Module: library/cipher.c - * Caller: library/ssl_tls.c - * - * Uncomment to enable generic cipher wrappers. - */ -#define MBEDTLS_CIPHER_C - -/** - * \def MBEDTLS_CTR_DRBG_C - * - * Enable the CTR_DRBG AES-256-based random generator. - * - * Module: library/ctr_drbg.c - * Caller: - * - * Requires: MBEDTLS_AES_C - * - * This module provides the CTR_DRBG AES-256 random number generator. - */ -#define MBEDTLS_CTR_DRBG_C - -/** - * \def MBEDTLS_DEBUG_C - * - * Enable the debug functions. - * - * Module: library/debug.c - * Caller: library/ssl_cli.c - * library/ssl_srv.c - * library/ssl_tls.c - * - * This module provides debugging functions. - */ -#define MBEDTLS_DEBUG_C - -/** - * \def MBEDTLS_DES_C - * - * Enable the DES block cipher. - * - * Module: library/des.c - * Caller: library/pem.c - * library/ssl_tls.c - * - * This module enables the following ciphersuites (if other requisites are - * enabled as well): - * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA - * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA - * - * PEM_PARSE uses DES/3DES for decrypting encrypted keys. - */ -#define MBEDTLS_DES_C - -/** - * \def MBEDTLS_DHM_C - * - * Enable the Diffie-Hellman-Merkle module. - * - * Module: library/dhm.c - * Caller: library/ssl_cli.c - * library/ssl_srv.c - * - * This module is used by the following key exchanges: - * DHE-RSA, DHE-PSK - */ -#define MBEDTLS_DHM_C - -/** - * \def MBEDTLS_ECDH_C - * - * Enable the elliptic curve Diffie-Hellman library. - * - * Module: library/ecdh.c - * Caller: library/ssl_cli.c - * library/ssl_srv.c - * - * This module is used by the following key exchanges: - * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK - * - * Requires: MBEDTLS_ECP_C - */ -#define MBEDTLS_ECDH_C - -/** - * \def MBEDTLS_ECDSA_C - * - * Enable the elliptic curve DSA library. - * - * Module: library/ecdsa.c - * Caller: - * - * This module is used by the following key exchanges: - * ECDHE-ECDSA - * - * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C - */ -#define MBEDTLS_ECDSA_C - -/** - * \def MBEDTLS_ECJPAKE_C - * - * Enable the elliptic curve J-PAKE library. - * - * \warning This is currently experimental. EC J-PAKE support is based on the - * Thread v1.0.0 specification; incompatible changes to the specification - * might still happen. For this reason, this is disabled by default. - * - * Module: library/ecjpake.c - * Caller: - * - * This module is used by the following key exchanges: - * ECJPAKE - * - * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C - */ -//#define MBEDTLS_ECJPAKE_C - -/** - * \def MBEDTLS_ECP_C - * - * Enable the elliptic curve over GF(p) library. - * - * Module: library/ecp.c - * Caller: library/ecdh.c - * library/ecdsa.c - * library/ecjpake.c - * - * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED - */ -#define MBEDTLS_ECP_C - -/** - * \def MBEDTLS_ENTROPY_C - * - * Enable the platform-specific entropy code. - * - * Module: library/entropy.c - * Caller: - * - * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C - * - * This module provides a generic entropy pool - */ -#define MBEDTLS_ENTROPY_C - -/** - * \def MBEDTLS_ERROR_C - * - * Enable error code to error string conversion. - * - * Module: library/error.c - * Caller: - * - * This module enables mbedtls_strerror(). - */ -#define MBEDTLS_ERROR_C - -/** - * \def MBEDTLS_GCM_C - * - * Enable the Galois/Counter Mode (GCM) for AES. - * - * Module: library/gcm.c - * - * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C - * - * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other - * requisites are enabled as well. - */ -#define MBEDTLS_GCM_C - -/** - * \def MBEDTLS_HAVEGE_C - * - * Enable the HAVEGE random generator. - * - * Warning: the HAVEGE random generator is not suitable for virtualized - * environments - * - * Warning: the HAVEGE random generator is dependent on timing and specific - * processor traits. It is therefore not advised to use HAVEGE as - * your applications primary random generator or primary entropy pool - * input. As a secondary input to your entropy pool, it IS able add - * the (limited) extra entropy it provides. - * - * Module: library/havege.c - * Caller: - * - * Requires: MBEDTLS_TIMING_C - * - * Uncomment to enable the HAVEGE random generator. - */ -//#define MBEDTLS_HAVEGE_C - -/** - * \def MBEDTLS_HMAC_DRBG_C - * - * Enable the HMAC_DRBG random generator. - * - * Module: library/hmac_drbg.c - * Caller: - * - * Requires: MBEDTLS_MD_C - * - * Uncomment to enable the HMAC_DRBG random number geerator. - */ -#define MBEDTLS_HMAC_DRBG_C - -/** - * \def MBEDTLS_MD_C - * - * Enable the generic message digest layer. - * - * Module: library/mbedtls_md.c - * Caller: - * - * Uncomment to enable generic message digest wrappers. - */ -#define MBEDTLS_MD_C - -/** - * \def MBEDTLS_MD2_C - * - * Enable the MD2 hash algorithm. - * - * Module: library/mbedtls_md2.c - * Caller: - * - * Uncomment to enable support for (rare) MD2-signed X.509 certs. - */ -//#define MBEDTLS_MD2_C - -/** - * \def MBEDTLS_MD4_C - * - * Enable the MD4 hash algorithm. - * - * Module: library/mbedtls_md4.c - * Caller: - * - * Uncomment to enable support for (rare) MD4-signed X.509 certs. - */ -//#define MBEDTLS_MD4_C - -/** - * \def MBEDTLS_MD5_C - * - * Enable the MD5 hash algorithm. - * - * Module: library/mbedtls_md5.c - * Caller: library/mbedtls_md.c - * library/pem.c - * library/ssl_tls.c - * - * This module is required for SSL/TLS and X.509. - * PEM_PARSE uses MD5 for decrypting encrypted keys. - */ -#define MBEDTLS_MD5_C - -/** - * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C - * - * Enable the buffer allocator implementation that makes use of a (stack) - * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() - * calls) - * - * Module: library/memory_buffer_alloc.c - * - * Requires: MBEDTLS_PLATFORM_C - * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) - * - * Enable this module to enable the buffer memory allocator. - */ -//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C - -/** - * \def MBEDTLS_NET_C - * - * Enable the TCP/IP networking routines. - * - * Module: library/net.c - * - * This module provides TCP/IP networking routines. - */ -#define MBEDTLS_NET_C - -/** - * \def MBEDTLS_OID_C - * - * Enable the OID database. - * - * Module: library/oid.c - * Caller: library/asn1write.c - * library/pkcs5.c - * library/pkparse.c - * library/pkwrite.c - * library/rsa.c - * library/x509.c - * library/x509_create.c - * library/mbedtls_x509_crl.c - * library/mbedtls_x509_crt.c - * library/mbedtls_x509_csr.c - * library/x509write_crt.c - * library/mbedtls_x509write_csr.c - * - * This modules translates between OIDs and internal values. - */ -#define MBEDTLS_OID_C - -/** - * \def MBEDTLS_PADLOCK_C - * - * Enable VIA Padlock support on x86. - * - * Module: library/padlock.c - * Caller: library/aes.c - * - * Requires: MBEDTLS_HAVE_ASM - * - * This modules adds support for the VIA PadLock on x86. - */ -#define MBEDTLS_PADLOCK_C - -/** - * \def MBEDTLS_PEM_PARSE_C - * - * Enable PEM decoding / parsing. - * - * Module: library/pem.c - * Caller: library/dhm.c - * library/pkparse.c - * library/mbedtls_x509_crl.c - * library/mbedtls_x509_crt.c - * library/mbedtls_x509_csr.c - * - * Requires: MBEDTLS_BASE64_C - * - * This modules adds support for decoding / parsing PEM files. - */ -#define MBEDTLS_PEM_PARSE_C - -/** - * \def MBEDTLS_PEM_WRITE_C - * - * Enable PEM encoding / writing. - * - * Module: library/pem.c - * Caller: library/pkwrite.c - * library/x509write_crt.c - * library/mbedtls_x509write_csr.c - * - * Requires: MBEDTLS_BASE64_C - * - * This modules adds support for encoding / writing PEM files. - */ -#define MBEDTLS_PEM_WRITE_C - -/** - * \def MBEDTLS_PK_C - * - * Enable the generic public (asymetric) key layer. - * - * Module: library/pk.c - * Caller: library/ssl_tls.c - * library/ssl_cli.c - * library/ssl_srv.c - * - * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C - * - * Uncomment to enable generic public key wrappers. - */ -#define MBEDTLS_PK_C - -/** - * \def MBEDTLS_PK_PARSE_C - * - * Enable the generic public (asymetric) key parser. - * - * Module: library/pkparse.c - * Caller: library/mbedtls_x509_crt.c - * library/mbedtls_x509_csr.c - * - * Requires: MBEDTLS_PK_C - * - * Uncomment to enable generic public key parse functions. - */ -#define MBEDTLS_PK_PARSE_C - -/** - * \def MBEDTLS_PK_WRITE_C - * - * Enable the generic public (asymetric) key writer. - * - * Module: library/pkwrite.c - * Caller: library/x509write.c - * - * Requires: MBEDTLS_PK_C - * - * Uncomment to enable generic public key write functions. - */ -#define MBEDTLS_PK_WRITE_C - -/** - * \def MBEDTLS_PKCS5_C - * - * Enable PKCS#5 functions. - * - * Module: library/pkcs5.c - * - * Requires: MBEDTLS_MD_C - * - * This module adds support for the PKCS#5 functions. - */ -#define MBEDTLS_PKCS5_C - -/** - * \def MBEDTLS_PKCS11_C - * - * Enable wrapper for PKCS#11 smartcard support. - * - * Module: library/pkcs11.c - * Caller: library/pk.c - * - * Requires: MBEDTLS_PK_C - * - * This module enables SSL/TLS PKCS #11 smartcard support. - * Requires the presence of the PKCS#11 helper library (libpkcs11-helper) - */ -//#define MBEDTLS_PKCS11_C - -/** - * \def MBEDTLS_PKCS12_C - * - * Enable PKCS#12 PBE functions. - * Adds algorithms for parsing PKCS#8 encrypted private keys - * - * Module: library/pkcs12.c - * Caller: library/pkparse.c - * - * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C - * Can use: MBEDTLS_ARC4_C - * - * This module enables PKCS#12 functions. - */ -#define MBEDTLS_PKCS12_C - -/** - * \def MBEDTLS_PLATFORM_C - * - * Enable the platform abstraction layer that allows you to re-assign - * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). - * - * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT - * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned - * above to be specified at runtime or compile time respectively. - * - * \note This abstraction layer must be enabled on Windows (including MSYS2) - * as other module rely on it for a fixed snprintf implementation. - * - * Module: library/platform.c - * Caller: Most other .c files - * - * This module enables abstraction of common (libc) functions. - */ -#define MBEDTLS_PLATFORM_C - -/** - * \def MBEDTLS_RIPEMD160_C - * - * Enable the RIPEMD-160 hash algorithm. - * - * Module: library/mbedtls_ripemd160.c - * Caller: library/mbedtls_md.c - * - */ -#define MBEDTLS_RIPEMD160_C - -/** - * \def MBEDTLS_RSA_C - * - * Enable the RSA public-key cryptosystem. - * - * Module: library/rsa.c - * Caller: library/ssl_cli.c - * library/ssl_srv.c - * library/ssl_tls.c - * library/x509.c - * - * This module is used by the following key exchanges: - * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK - * - * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C - */ -#define MBEDTLS_RSA_C - -/** - * \def MBEDTLS_SHA1_C - * - * Enable the SHA1 cryptographic hash algorithm. - * - * Module: library/mbedtls_sha1.c - * Caller: library/mbedtls_md.c - * library/ssl_cli.c - * library/ssl_srv.c - * library/ssl_tls.c - * library/x509write_crt.c - * - * This module is required for SSL/TLS and SHA1-signed certificates. - */ -#define MBEDTLS_SHA1_C - -/** - * \def MBEDTLS_SHA256_C - * - * Enable the SHA-224 and SHA-256 cryptographic hash algorithms. - * - * Module: library/mbedtls_sha256.c - * Caller: library/entropy.c - * library/mbedtls_md.c - * library/ssl_cli.c - * library/ssl_srv.c - * library/ssl_tls.c - * - * This module adds support for SHA-224 and SHA-256. - * This module is required for the SSL/TLS 1.2 PRF function. - */ -#define MBEDTLS_SHA256_C - -/** - * \def MBEDTLS_SHA512_C - * - * Enable the SHA-384 and SHA-512 cryptographic hash algorithms. - * - * Module: library/mbedtls_sha512.c - * Caller: library/entropy.c - * library/mbedtls_md.c - * library/ssl_cli.c - * library/ssl_srv.c - * - * This module adds support for SHA-384 and SHA-512. - */ -#define MBEDTLS_SHA512_C - -/** - * \def MBEDTLS_SSL_CACHE_C - * - * Enable simple SSL cache implementation. - * - * Module: library/ssl_cache.c - * Caller: - * - * Requires: MBEDTLS_SSL_CACHE_C - */ -#define MBEDTLS_SSL_CACHE_C - -/** - * \def MBEDTLS_SSL_COOKIE_C - * - * Enable basic implementation of DTLS cookies for hello verification. - * - * Module: library/ssl_cookie.c - * Caller: - */ -#define MBEDTLS_SSL_COOKIE_C - -/** - * \def MBEDTLS_SSL_TICKET_C - * - * Enable an implementation of TLS server-side callbacks for session tickets. - * - * Module: library/ssl_ticket.c - * Caller: - * - * Requires: MBEDTLS_CIPHER_C - */ -#define MBEDTLS_SSL_TICKET_C - -/** - * \def MBEDTLS_SSL_CLI_C - * - * Enable the SSL/TLS client code. - * - * Module: library/ssl_cli.c - * Caller: - * - * Requires: MBEDTLS_SSL_TLS_C - * - * This module is required for SSL/TLS client support. - */ -#define MBEDTLS_SSL_CLI_C - -/** - * \def MBEDTLS_SSL_SRV_C - * - * Enable the SSL/TLS server code. - * - * Module: library/ssl_srv.c - * Caller: - * - * Requires: MBEDTLS_SSL_TLS_C - * - * This module is required for SSL/TLS server support. - */ -#define MBEDTLS_SSL_SRV_C - -/** - * \def MBEDTLS_SSL_TLS_C - * - * Enable the generic SSL/TLS code. - * - * Module: library/ssl_tls.c - * Caller: library/ssl_cli.c - * library/ssl_srv.c - * - * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C - * and at least one of the MBEDTLS_SSL_PROTO_XXX defines - * - * This module is required for SSL/TLS. - */ -#define MBEDTLS_SSL_TLS_C - -/** - * \def MBEDTLS_THREADING_C - * - * Enable the threading abstraction layer. - * By default mbed TLS assumes it is used in a non-threaded environment or that - * contexts are not shared between threads. If you do intend to use contexts - * between threads, you will need to enable this layer to prevent race - * conditions. - * - * Module: library/threading.c - * - * This allows different threading implementations (self-implemented or - * provided). - * - * You will have to enable either MBEDTLS_THREADING_ALT or - * MBEDTLS_THREADING_PTHREAD. - * - * Enable this layer to allow use of mutexes within mbed TLS - */ -//#define MBEDTLS_THREADING_C - -/** - * \def MBEDTLS_TIMING_C - * - * Enable the portable timing interface. - * - * Module: library/timing.c - * Caller: library/havege.c - * - * This module is used by the HAVEGE random number generator. - */ -#define MBEDTLS_TIMING_C - -/** - * \def MBEDTLS_VERSION_C - * - * Enable run-time version information. - * - * Module: library/version.c - * - * This module provides run-time version information. - */ -#define MBEDTLS_VERSION_C - -/** - * \def MBEDTLS_X509_USE_C - * - * Enable X.509 core for using certificates. - * - * Module: library/x509.c - * Caller: library/mbedtls_x509_crl.c - * library/mbedtls_x509_crt.c - * library/mbedtls_x509_csr.c - * - * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, - * MBEDTLS_PK_PARSE_C - * - * This module is required for the X.509 parsing modules. - */ -#define MBEDTLS_X509_USE_C - -/** - * \def MBEDTLS_X509_CRT_PARSE_C - * - * Enable X.509 certificate parsing. - * - * Module: library/mbedtls_x509_crt.c - * Caller: library/ssl_cli.c - * library/ssl_srv.c - * library/ssl_tls.c - * - * Requires: MBEDTLS_X509_USE_C - * - * This module is required for X.509 certificate parsing. - */ -#define MBEDTLS_X509_CRT_PARSE_C - -/** - * \def MBEDTLS_X509_CRL_PARSE_C - * - * Enable X.509 CRL parsing. - * - * Module: library/mbedtls_x509_crl.c - * Caller: library/mbedtls_x509_crt.c - * - * Requires: MBEDTLS_X509_USE_C - * - * This module is required for X.509 CRL parsing. - */ -#define MBEDTLS_X509_CRL_PARSE_C - -/** - * \def MBEDTLS_X509_CSR_PARSE_C - * - * Enable X.509 Certificate Signing Request (CSR) parsing. - * - * Module: library/mbedtls_x509_csr.c - * Caller: library/x509_crt_write.c - * - * Requires: MBEDTLS_X509_USE_C - * - * This module is used for reading X.509 certificate request. - */ -#define MBEDTLS_X509_CSR_PARSE_C - -/** - * \def MBEDTLS_X509_CREATE_C - * - * Enable X.509 core for creating certificates. - * - * Module: library/x509_create.c - * - * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C - * - * This module is the basis for creating X.509 certificates and CSRs. - */ -#define MBEDTLS_X509_CREATE_C - -/** - * \def MBEDTLS_X509_CRT_WRITE_C - * - * Enable creating X.509 certificates. - * - * Module: library/x509_crt_write.c - * - * Requires: MBEDTLS_X509_CREATE_C - * - * This module is required for X.509 certificate creation. - */ -#define MBEDTLS_X509_CRT_WRITE_C - -/** - * \def MBEDTLS_X509_CSR_WRITE_C - * - * Enable creating X.509 Certificate Signing Requests (CSR). - * - * Module: library/x509_csr_write.c - * - * Requires: MBEDTLS_X509_CREATE_C - * - * This module is required for X.509 certificate request writing. - */ -#define MBEDTLS_X509_CSR_WRITE_C - -/** - * \def MBEDTLS_XTEA_C - * - * Enable the XTEA block cipher. - * - * Module: library/xtea.c - * Caller: - */ -#define MBEDTLS_XTEA_C - -/* \} name SECTION: mbed TLS modules */ - -/** - * \name SECTION: Module configuration options - * - * This section allows for the setting of module specific sizes and - * configuration options. The default values are already present in the - * relevant header files and should suffice for the regular use cases. - * - * Our advice is to enable options and change their values here - * only if you have a good reason and know the consequences. - * - * Please check the respective header file for documentation on these - * parameters (to prevent duplicate documentation). - * \{ - */ - -/* MPI / BIGNUM options */ -//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */ -//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ - -/* CTR_DRBG options */ -//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */ -//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ -//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ -//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ -//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ - -/* HMAC_DRBG options */ -//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ -//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ -//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ -//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ - -/* ECP options */ -//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups */ -//#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */ -//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */ - -/* Entropy options */ -//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ -//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ - -/* Memory buffer allocator options */ -//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ - -/* Platform options */ -//#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ -//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */ -/* Note: your snprintf must correclty zero-terminate the buffer! */ -//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */ - -/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ -/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ -//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */ -/* Note: your snprintf must correclty zero-terminate the buffer! */ -//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */ - -/* SSL Cache options */ -//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ -//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */ - -/* SSL options */ -//#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 /**< Maxium fragment length in bytes, determines the size of each of the two internal I/O buffers */ -//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */ -//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */ -//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ - -/** - * Complete list of ciphersuites to use, in order of preference. - * - * \warning No dependency checking is done on that field! This option can only - * be used to restrict the set of available ciphersuites. It is your - * responsibility to make sure the needed modules are active. - * - * Use this to save a few hundred bytes of ROM (default ordering of all - * available ciphersuites) and a few to a few hundred bytes of RAM. - * - * The value below is only an example, not the default. - */ -//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - -/* X509 options */ -//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ - -/* \} name SECTION: Module configuration options */ - -#if defined(TARGET_LIKE_MBED) -#include "mbedtls/target_config.h" -#endif - -/* - * Allow user to override any previous default. - * - * Use two macro names for that, as: - * - with yotta the prefix YOTTA_CFG_ is forced - * - without yotta is looks weird to have a YOTTA prefix. - */ -#if defined(YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE) -#include YOTTA_CFG_MBEDTLS_USER_CONFIG_FILE -#elif defined(MBEDTLS_USER_CONFIG_FILE) -#include MBEDTLS_USER_CONFIG_FILE -#endif - -#include "check_config.h" - -#endif /* MBEDTLS_CONFIG_H */ diff --git a/others/mbedtls/md5.c b/others/mbedtls/md5.c deleted file mode 100644 index 3fb6531c..00000000 --- a/others/mbedtls/md5.c +++ /dev/null @@ -1,404 +0,0 @@ -/* - * RFC 1321 compliant MD5 implementation - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ -/* - * The MD5 algorithm was designed by Ron Rivest in 1991. - * - * http://www.ietf.org/rfc/rfc1321.txt - */ - -#if !defined(MBEDTLS_CONFIG_FILE) -#include "mbedtls/config.h" -#else -#include MBEDTLS_CONFIG_FILE -#endif - -#if defined(MBEDTLS_MD5_C) - -#include "mbedtls/md5.h" - -#include - -#if defined(MBEDTLS_SELF_TEST) -#if defined(MBEDTLS_PLATFORM_C) -#include "mbedtls/platform.h" -#else -#include -#define mbedtls_printf printf -#endif /* MBEDTLS_PLATFORM_C */ -#endif /* MBEDTLS_SELF_TEST */ - -#if !defined(MBEDTLS_MD5_ALT) - -/* Implementation that should never be optimized out by the compiler */ -static void mbedtls_zeroize( void *v, size_t n ) { - volatile unsigned char *p = v; while( n-- ) *p++ = 0; -} - -/* - * 32-bit integer manipulation macros (little endian) - */ -#ifndef GET_UINT32_LE -#define GET_UINT32_LE(n,b,i) \ -{ \ - (n) = ( (uint32_t) (b)[(i) ] ) \ - | ( (uint32_t) (b)[(i) + 1] << 8 ) \ - | ( (uint32_t) (b)[(i) + 2] << 16 ) \ - | ( (uint32_t) (b)[(i) + 3] << 24 ); \ -} -#endif - -#ifndef PUT_UINT32_LE -#define PUT_UINT32_LE(n,b,i) \ -{ \ - (b)[(i) ] = (unsigned char) ( ( (n) ) & 0xFF ); \ - (b)[(i) + 1] = (unsigned char) ( ( (n) >> 8 ) & 0xFF ); \ - (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF ); \ - (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF ); \ -} -#endif - -void mbedtls_md5_init( mbedtls_md5_context *ctx ) -{ - memset( ctx, 0, sizeof( mbedtls_md5_context ) ); -} - -void mbedtls_md5_free( mbedtls_md5_context *ctx ) -{ - if( ctx == NULL ) - return; - - mbedtls_zeroize( ctx, sizeof( mbedtls_md5_context ) ); -} - -void mbedtls_md5_clone( mbedtls_md5_context *dst, - const mbedtls_md5_context *src ) -{ - *dst = *src; -} - -/* - * MD5 context setup - */ -void mbedtls_md5_starts( mbedtls_md5_context *ctx ) -{ - ctx->total[0] = 0; - ctx->total[1] = 0; - - ctx->state[0] = 0x67452301; - ctx->state[1] = 0xEFCDAB89; - ctx->state[2] = 0x98BADCFE; - ctx->state[3] = 0x10325476; -} - -#if !defined(MBEDTLS_MD5_PROCESS_ALT) -void mbedtls_md5_process( mbedtls_md5_context *ctx, const unsigned char data[64] ) -{ - uint32_t X[16], A, B, C, D; - - GET_UINT32_LE( X[ 0], data, 0 ); - GET_UINT32_LE( X[ 1], data, 4 ); - GET_UINT32_LE( X[ 2], data, 8 ); - GET_UINT32_LE( X[ 3], data, 12 ); - GET_UINT32_LE( X[ 4], data, 16 ); - GET_UINT32_LE( X[ 5], data, 20 ); - GET_UINT32_LE( X[ 6], data, 24 ); - GET_UINT32_LE( X[ 7], data, 28 ); - GET_UINT32_LE( X[ 8], data, 32 ); - GET_UINT32_LE( X[ 9], data, 36 ); - GET_UINT32_LE( X[10], data, 40 ); - GET_UINT32_LE( X[11], data, 44 ); - GET_UINT32_LE( X[12], data, 48 ); - GET_UINT32_LE( X[13], data, 52 ); - GET_UINT32_LE( X[14], data, 56 ); - GET_UINT32_LE( X[15], data, 60 ); - -#define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n))) - -#define P(a,b,c,d,k,s,t) \ -{ \ - a += F(b,c,d) + X[k] + t; a = S(a,s) + b; \ -} - - A = ctx->state[0]; - B = ctx->state[1]; - C = ctx->state[2]; - D = ctx->state[3]; - -#define F(x,y,z) (z ^ (x & (y ^ z))) - - P( A, B, C, D, 0, 7, 0xD76AA478 ); - P( D, A, B, C, 1, 12, 0xE8C7B756 ); - P( C, D, A, B, 2, 17, 0x242070DB ); - P( B, C, D, A, 3, 22, 0xC1BDCEEE ); - P( A, B, C, D, 4, 7, 0xF57C0FAF ); - P( D, A, B, C, 5, 12, 0x4787C62A ); - P( C, D, A, B, 6, 17, 0xA8304613 ); - P( B, C, D, A, 7, 22, 0xFD469501 ); - P( A, B, C, D, 8, 7, 0x698098D8 ); - P( D, A, B, C, 9, 12, 0x8B44F7AF ); - P( C, D, A, B, 10, 17, 0xFFFF5BB1 ); - P( B, C, D, A, 11, 22, 0x895CD7BE ); - P( A, B, C, D, 12, 7, 0x6B901122 ); - P( D, A, B, C, 13, 12, 0xFD987193 ); - P( C, D, A, B, 14, 17, 0xA679438E ); - P( B, C, D, A, 15, 22, 0x49B40821 ); - -#undef F - -#define F(x,y,z) (y ^ (z & (x ^ y))) - - P( A, B, C, D, 1, 5, 0xF61E2562 ); - P( D, A, B, C, 6, 9, 0xC040B340 ); - P( C, D, A, B, 11, 14, 0x265E5A51 ); - P( B, C, D, A, 0, 20, 0xE9B6C7AA ); - P( A, B, C, D, 5, 5, 0xD62F105D ); - P( D, A, B, C, 10, 9, 0x02441453 ); - P( C, D, A, B, 15, 14, 0xD8A1E681 ); - P( B, C, D, A, 4, 20, 0xE7D3FBC8 ); - P( A, B, C, D, 9, 5, 0x21E1CDE6 ); - P( D, A, B, C, 14, 9, 0xC33707D6 ); - P( C, D, A, B, 3, 14, 0xF4D50D87 ); - P( B, C, D, A, 8, 20, 0x455A14ED ); - P( A, B, C, D, 13, 5, 0xA9E3E905 ); - P( D, A, B, C, 2, 9, 0xFCEFA3F8 ); - P( C, D, A, B, 7, 14, 0x676F02D9 ); - P( B, C, D, A, 12, 20, 0x8D2A4C8A ); - -#undef F - -#define F(x,y,z) (x ^ y ^ z) - - P( A, B, C, D, 5, 4, 0xFFFA3942 ); - P( D, A, B, C, 8, 11, 0x8771F681 ); - P( C, D, A, B, 11, 16, 0x6D9D6122 ); - P( B, C, D, A, 14, 23, 0xFDE5380C ); - P( A, B, C, D, 1, 4, 0xA4BEEA44 ); - P( D, A, B, C, 4, 11, 0x4BDECFA9 ); - P( C, D, A, B, 7, 16, 0xF6BB4B60 ); - P( B, C, D, A, 10, 23, 0xBEBFBC70 ); - P( A, B, C, D, 13, 4, 0x289B7EC6 ); - P( D, A, B, C, 0, 11, 0xEAA127FA ); - P( C, D, A, B, 3, 16, 0xD4EF3085 ); - P( B, C, D, A, 6, 23, 0x04881D05 ); - P( A, B, C, D, 9, 4, 0xD9D4D039 ); - P( D, A, B, C, 12, 11, 0xE6DB99E5 ); - P( C, D, A, B, 15, 16, 0x1FA27CF8 ); - P( B, C, D, A, 2, 23, 0xC4AC5665 ); - -#undef F - -#define F(x,y,z) (y ^ (x | ~z)) - - P( A, B, C, D, 0, 6, 0xF4292244 ); - P( D, A, B, C, 7, 10, 0x432AFF97 ); - P( C, D, A, B, 14, 15, 0xAB9423A7 ); - P( B, C, D, A, 5, 21, 0xFC93A039 ); - P( A, B, C, D, 12, 6, 0x655B59C3 ); - P( D, A, B, C, 3, 10, 0x8F0CCC92 ); - P( C, D, A, B, 10, 15, 0xFFEFF47D ); - P( B, C, D, A, 1, 21, 0x85845DD1 ); - P( A, B, C, D, 8, 6, 0x6FA87E4F ); - P( D, A, B, C, 15, 10, 0xFE2CE6E0 ); - P( C, D, A, B, 6, 15, 0xA3014314 ); - P( B, C, D, A, 13, 21, 0x4E0811A1 ); - P( A, B, C, D, 4, 6, 0xF7537E82 ); - P( D, A, B, C, 11, 10, 0xBD3AF235 ); - P( C, D, A, B, 2, 15, 0x2AD7D2BB ); - P( B, C, D, A, 9, 21, 0xEB86D391 ); - -#undef F - - ctx->state[0] += A; - ctx->state[1] += B; - ctx->state[2] += C; - ctx->state[3] += D; -} -#endif /* !MBEDTLS_MD5_PROCESS_ALT */ - -/* - * MD5 process buffer - */ -void mbedtls_md5_update( mbedtls_md5_context *ctx, const unsigned char *input, size_t ilen ) -{ - size_t fill; - uint32_t left; - - if( ilen == 0 ) - return; - - left = ctx->total[0] & 0x3F; - fill = 64 - left; - - ctx->total[0] += (uint32_t) ilen; - ctx->total[0] &= 0xFFFFFFFF; - - if( ctx->total[0] < (uint32_t) ilen ) - ctx->total[1]++; - - if( left && ilen >= fill ) - { - memcpy( (void *) (ctx->buffer + left), input, fill ); - mbedtls_md5_process( ctx, ctx->buffer ); - input += fill; - ilen -= fill; - left = 0; - } - - while( ilen >= 64 ) - { - mbedtls_md5_process( ctx, input ); - input += 64; - ilen -= 64; - } - - if( ilen > 0 ) - { - memcpy( (void *) (ctx->buffer + left), input, ilen ); - } -} - -static const unsigned char md5_padding[64] = -{ - 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 -}; - -/* - * MD5 final digest - */ -void mbedtls_md5_finish( mbedtls_md5_context *ctx, unsigned char output[16] ) -{ - uint32_t last, padn; - uint32_t high, low; - unsigned char msglen[8]; - - high = ( ctx->total[0] >> 29 ) - | ( ctx->total[1] << 3 ); - low = ( ctx->total[0] << 3 ); - - PUT_UINT32_LE( low, msglen, 0 ); - PUT_UINT32_LE( high, msglen, 4 ); - - last = ctx->total[0] & 0x3F; - padn = ( last < 56 ) ? ( 56 - last ) : ( 120 - last ); - - mbedtls_md5_update( ctx, md5_padding, padn ); - mbedtls_md5_update( ctx, msglen, 8 ); - - PUT_UINT32_LE( ctx->state[0], output, 0 ); - PUT_UINT32_LE( ctx->state[1], output, 4 ); - PUT_UINT32_LE( ctx->state[2], output, 8 ); - PUT_UINT32_LE( ctx->state[3], output, 12 ); -} - -#endif /* !MBEDTLS_MD5_ALT */ - -/* - * output = MD5( input buffer ) - */ -void mbedtls_md5( const unsigned char *input, size_t ilen, unsigned char output[16] ) -{ - mbedtls_md5_context ctx; - - mbedtls_md5_init( &ctx ); - mbedtls_md5_starts( &ctx ); - mbedtls_md5_update( &ctx, input, ilen ); - mbedtls_md5_finish( &ctx, output ); - mbedtls_md5_free( &ctx ); -} - -#if defined(MBEDTLS_SELF_TEST) -/* - * RFC 1321 test vectors - */ -static const unsigned char md5_test_buf[7][81] = -{ - { "" }, - { "a" }, - { "abc" }, - { "message digest" }, - { "abcdefghijklmnopqrstuvwxyz" }, - { "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" }, - { "12345678901234567890123456789012345678901234567890123456789012" \ - "345678901234567890" } -}; - -static const int md5_test_buflen[7] = -{ - 0, 1, 3, 14, 26, 62, 80 -}; - -static const unsigned char md5_test_sum[7][16] = -{ - { 0xD4, 0x1D, 0x8C, 0xD9, 0x8F, 0x00, 0xB2, 0x04, - 0xE9, 0x80, 0x09, 0x98, 0xEC, 0xF8, 0x42, 0x7E }, - { 0x0C, 0xC1, 0x75, 0xB9, 0xC0, 0xF1, 0xB6, 0xA8, - 0x31, 0xC3, 0x99, 0xE2, 0x69, 0x77, 0x26, 0x61 }, - { 0x90, 0x01, 0x50, 0x98, 0x3C, 0xD2, 0x4F, 0xB0, - 0xD6, 0x96, 0x3F, 0x7D, 0x28, 0xE1, 0x7F, 0x72 }, - { 0xF9, 0x6B, 0x69, 0x7D, 0x7C, 0xB7, 0x93, 0x8D, - 0x52, 0x5A, 0x2F, 0x31, 0xAA, 0xF1, 0x61, 0xD0 }, - { 0xC3, 0xFC, 0xD3, 0xD7, 0x61, 0x92, 0xE4, 0x00, - 0x7D, 0xFB, 0x49, 0x6C, 0xCA, 0x67, 0xE1, 0x3B }, - { 0xD1, 0x74, 0xAB, 0x98, 0xD2, 0x77, 0xD9, 0xF5, - 0xA5, 0x61, 0x1C, 0x2C, 0x9F, 0x41, 0x9D, 0x9F }, - { 0x57, 0xED, 0xF4, 0xA2, 0x2B, 0xE3, 0xC9, 0x55, - 0xAC, 0x49, 0xDA, 0x2E, 0x21, 0x07, 0xB6, 0x7A } -}; - -/* - * Checkup routine - */ -int mbedtls_md5_self_test( int verbose ) -{ - int i; - unsigned char md5sum[16]; - - for( i = 0; i < 7; i++ ) - { - if( verbose != 0 ) - mbedtls_printf( " MD5 test #%d: ", i + 1 ); - - mbedtls_md5( md5_test_buf[i], md5_test_buflen[i], md5sum ); - - if( memcmp( md5sum, md5_test_sum[i], 16 ) != 0 ) - { - if( verbose != 0 ) - mbedtls_printf( "failed\n" ); - - return( 1 ); - } - - if( verbose != 0 ) - mbedtls_printf( "passed\n" ); - } - - if( verbose != 0 ) - mbedtls_printf( "\n" ); - - return( 0 ); -} - -#endif /* MBEDTLS_SELF_TEST */ - -#endif /* MBEDTLS_MD5_C */ \ No newline at end of file diff --git a/others/mbedtls/md5.h b/others/mbedtls/md5.h deleted file mode 100644 index f3ef80f8..00000000 --- a/others/mbedtls/md5.h +++ /dev/null @@ -1,136 +0,0 @@ -/** - * \file md5.h - * - * \brief MD5 message digest algorithm (hash function) - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ -#ifndef MBEDTLS_MD5_H -#define MBEDTLS_MD5_H - -#if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" -#else -#include MBEDTLS_CONFIG_FILE -#endif - -#include -#include - -#if !defined(MBEDTLS_MD5_ALT) -// Regular implementation -// - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * \brief MD5 context structure - */ -typedef struct -{ - uint32_t total[2]; /*!< number of bytes processed */ - uint32_t state[4]; /*!< intermediate digest state */ - unsigned char buffer[64]; /*!< data block being processed */ -} -mbedtls_md5_context; - -/** - * \brief Initialize MD5 context - * - * \param ctx MD5 context to be initialized - */ -void mbedtls_md5_init( mbedtls_md5_context *ctx ); - -/** - * \brief Clear MD5 context - * - * \param ctx MD5 context to be cleared - */ -void mbedtls_md5_free( mbedtls_md5_context *ctx ); - -/** - * \brief Clone (the state of) an MD5 context - * - * \param dst The destination context - * \param src The context to be cloned - */ -void mbedtls_md5_clone( mbedtls_md5_context *dst, - const mbedtls_md5_context *src ); - -/** - * \brief MD5 context setup - * - * \param ctx context to be initialized - */ -void mbedtls_md5_starts( mbedtls_md5_context *ctx ); - -/** - * \brief MD5 process buffer - * - * \param ctx MD5 context - * \param input buffer holding the data - * \param ilen length of the input data - */ -void mbedtls_md5_update( mbedtls_md5_context *ctx, const unsigned char *input, size_t ilen ); - -/** - * \brief MD5 final digest - * - * \param ctx MD5 context - * \param output MD5 checksum result - */ -void mbedtls_md5_finish( mbedtls_md5_context *ctx, unsigned char output[16] ); - -/* Internal use */ -void mbedtls_md5_process( mbedtls_md5_context *ctx, const unsigned char data[64] ); - -#ifdef __cplusplus -} -#endif - -#else /* MBEDTLS_MD5_ALT */ -#include "md5_alt.h" -#endif /* MBEDTLS_MD5_ALT */ - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * \brief Output = MD5( input buffer ) - * - * \param input buffer holding the data - * \param ilen length of the input data - * \param output MD5 checksum result - */ -void mbedtls_md5( const unsigned char *input, size_t ilen, unsigned char output[16] ); - -/** - * \brief Checkup routine - * - * \return 0 if successful, or 1 if the test failed - */ -int mbedtls_md5_self_test( int verbose ); - -#ifdef __cplusplus -} -#endif - -#endif /* mbedtls_md5.h */ \ No newline at end of file diff --git a/others/mbedtls/platform.h b/others/mbedtls/platform.h deleted file mode 100644 index f71f1b64..00000000 --- a/others/mbedtls/platform.h +++ /dev/null @@ -1,214 +0,0 @@ -/** - * \file platform.h - * - * \brief mbed TLS Platform abstraction layer - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ -#ifndef MBEDTLS_PLATFORM_H -#define MBEDTLS_PLATFORM_H - -#if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" -#else -#include MBEDTLS_CONFIG_FILE -#endif - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * \name SECTION: Module settings - * - * The configuration options you can set for this module are in this section. - * Either change them in config.h or define them on the compiler command line. - * \{ - */ - -#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) -#include -#include -#if !defined(MBEDTLS_PLATFORM_STD_SNPRINTF) -#if defined(_WIN32) -#define MBEDTLS_PLATFORM_STD_SNPRINTF mbedtls_platform_win32_snprintf /**< Default snprintf to use */ -#else -#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use */ -#endif -#endif -#if !defined(MBEDTLS_PLATFORM_STD_PRINTF) -#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use */ -#endif -#if !defined(MBEDTLS_PLATFORM_STD_FPRINTF) -#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use */ -#endif -#if !defined(MBEDTLS_PLATFORM_STD_CALLOC) -#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use */ -#endif -#if !defined(MBEDTLS_PLATFORM_STD_FREE) -#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use */ -#endif -#if !defined(MBEDTLS_PLATFORM_STD_EXIT) -#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default free to use */ -#endif -#else /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ -#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) -#include MBEDTLS_PLATFORM_STD_MEM_HDR -#endif -#endif /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ - -/* \} name SECTION: Module settings */ - -/* - * The function pointers for calloc and free - */ -#if defined(MBEDTLS_PLATFORM_MEMORY) -#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \ - defined(MBEDTLS_PLATFORM_CALLOC_MACRO) -#define mbedtls_free MBEDTLS_PLATFORM_FREE_MACRO -#define mbedtls_calloc MBEDTLS_PLATFORM_CALLOC_MACRO -#else -/* For size_t */ -#include -extern void * (*mbedtls_calloc)( size_t n, size_t size ); -extern void (*mbedtls_free)( void *ptr ); - -/** - * \brief Set your own memory implementation function pointers - * - * \param calloc_func the calloc function implementation - * \param free_func the free function implementation - * - * \return 0 if successful - */ -int mbedtls_platform_set_calloc_free( void * (*calloc_func)( size_t, size_t ), - void (*free_func)( void * ) ); -#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_CALLOC_MACRO */ -#else /* !MBEDTLS_PLATFORM_MEMORY */ -#define mbedtls_free free -#define mbedtls_calloc calloc -#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,CALLOC}_MACRO */ - -/* - * The function pointers for fprintf - */ -#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) -/* We need FILE * */ -#include -extern int (*mbedtls_fprintf)( FILE *stream, const char *format, ... ); - -/** - * \brief Set your own fprintf function pointer - * - * \param fprintf_func the fprintf function implementation - * - * \return 0 - */ -int mbedtls_platform_set_fprintf( int (*fprintf_func)( FILE *stream, const char *, - ... ) ); -#else -#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) -#define mbedtls_fprintf MBEDTLS_PLATFORM_FPRINTF_MACRO -#else -#define mbedtls_fprintf fprintf -#endif /* MBEDTLS_PLATFORM_FPRINTF_MACRO */ -#endif /* MBEDTLS_PLATFORM_FPRINTF_ALT */ - -/* - * The function pointers for printf - */ -#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) -extern int (*mbedtls_printf)( const char *format, ... ); - -/** - * \brief Set your own printf function pointer - * - * \param printf_func the printf function implementation - * - * \return 0 - */ -int mbedtls_platform_set_printf( int (*printf_func)( const char *, ... ) ); -#else /* !MBEDTLS_PLATFORM_PRINTF_ALT */ -#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) -#define mbedtls_printf MBEDTLS_PLATFORM_PRINTF_MACRO -#else -#define mbedtls_printf printf -#endif /* MBEDTLS_PLATFORM_PRINTF_MACRO */ -#endif /* MBEDTLS_PLATFORM_PRINTF_ALT */ - -/* - * The function pointers for snprintf - * - * The snprintf implementation should conform to C99: - * - it *must* always correctly zero-terminate the buffer - * (except when n == 0, then it must leave the buffer untouched) - * - however it is acceptable to return -1 instead of the required length when - * the destination buffer is too short. - */ -#if defined(_WIN32) -/* For Windows (inc. MSYS2), we provide our own fixed implementation */ -int mbedtls_platform_win32_snprintf( char *s, size_t n, const char *fmt, ... ); -#endif - -#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) -extern int (*mbedtls_snprintf)( char * s, size_t n, const char * format, ... ); - -/** - * \brief Set your own snprintf function pointer - * - * \param snprintf_func the snprintf function implementation - * - * \return 0 - */ -int mbedtls_platform_set_snprintf( int (*snprintf_func)( char * s, size_t n, - const char * format, ... ) ); -#else /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ -#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) -#define mbedtls_snprintf MBEDTLS_PLATFORM_SNPRINTF_MACRO -#else -#define mbedtls_snprintf snprintf -#endif /* MBEDTLS_PLATFORM_SNPRINTF_MACRO */ -#endif /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ - -/* - * The function pointers for exit - */ -#if defined(MBEDTLS_PLATFORM_EXIT_ALT) -extern void (*mbedtls_exit)( int status ); - -/** - * \brief Set your own exit function pointer - * - * \param exit_func the exit function implementation - * - * \return 0 - */ -int mbedtls_platform_set_exit( void (*exit_func)( int status ) ); -#else -#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) -#define mbedtls_exit MBEDTLS_PLATFORM_EXIT_MACRO -#else -#define mbedtls_exit exit -#endif /* MBEDTLS_PLATFORM_EXIT_MACRO */ -#endif /* MBEDTLS_PLATFORM_EXIT_ALT */ - -#ifdef __cplusplus -} -#endif - -#endif /* platform.h */ diff --git a/others/mbedtls/sha1.c b/others/mbedtls/sha1.c deleted file mode 100644 index 4fd83522..00000000 --- a/others/mbedtls/sha1.c +++ /dev/null @@ -1,448 +0,0 @@ -/* - * FIPS-180-1 compliant SHA-1 implementation - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ -/* - * The SHA-1 standard was published by NIST in 1993. - * - * http://www.itl.nist.gov/fipspubs/fip180-1.htm - */ - -#if !defined(MBEDTLS_CONFIG_FILE) -#include "mbedtls/config.h" -#else -#include MBEDTLS_CONFIG_FILE -#endif - -#if defined(MBEDTLS_SHA1_C) - -#include "mbedtls/sha1.h" - -#include - -#if defined(MBEDTLS_SELF_TEST) -#if defined(MBEDTLS_PLATFORM_C) -#include "mbedtls/platform.h" -#else -#include -#define mbedtls_printf printf -#endif /* MBEDTLS_PLATFORM_C */ -#endif /* MBEDTLS_SELF_TEST */ - -#if !defined(MBEDTLS_SHA1_ALT) - -/* Implementation that should never be optimized out by the compiler */ -static void mbedtls_zeroize( void *v, size_t n ) { - volatile unsigned char *p = v; while( n-- ) *p++ = 0; -} - -/* - * 32-bit integer manipulation macros (big endian) - */ -#ifndef GET_UINT32_BE -#define GET_UINT32_BE(n,b,i) \ -{ \ - (n) = ( (uint32_t) (b)[(i) ] << 24 ) \ - | ( (uint32_t) (b)[(i) + 1] << 16 ) \ - | ( (uint32_t) (b)[(i) + 2] << 8 ) \ - | ( (uint32_t) (b)[(i) + 3] ); \ -} -#endif - -#ifndef PUT_UINT32_BE -#define PUT_UINT32_BE(n,b,i) \ -{ \ - (b)[(i) ] = (unsigned char) ( (n) >> 24 ); \ - (b)[(i) + 1] = (unsigned char) ( (n) >> 16 ); \ - (b)[(i) + 2] = (unsigned char) ( (n) >> 8 ); \ - (b)[(i) + 3] = (unsigned char) ( (n) ); \ -} -#endif - -void mbedtls_sha1_init( mbedtls_sha1_context *ctx ) -{ - memset( ctx, 0, sizeof( mbedtls_sha1_context ) ); -} - -void mbedtls_sha1_free( mbedtls_sha1_context *ctx ) -{ - if( ctx == NULL ) - return; - - mbedtls_zeroize( ctx, sizeof( mbedtls_sha1_context ) ); -} - -void mbedtls_sha1_clone( mbedtls_sha1_context *dst, - const mbedtls_sha1_context *src ) -{ - *dst = *src; -} - -/* - * SHA-1 context setup - */ -void mbedtls_sha1_starts( mbedtls_sha1_context *ctx ) -{ - ctx->total[0] = 0; - ctx->total[1] = 0; - - ctx->state[0] = 0x67452301; - ctx->state[1] = 0xEFCDAB89; - ctx->state[2] = 0x98BADCFE; - ctx->state[3] = 0x10325476; - ctx->state[4] = 0xC3D2E1F0; -} - -#if !defined(MBEDTLS_SHA1_PROCESS_ALT) -void mbedtls_sha1_process( mbedtls_sha1_context *ctx, const unsigned char data[64] ) -{ - uint32_t temp, W[16], A, B, C, D, E; - - GET_UINT32_BE( W[ 0], data, 0 ); - GET_UINT32_BE( W[ 1], data, 4 ); - GET_UINT32_BE( W[ 2], data, 8 ); - GET_UINT32_BE( W[ 3], data, 12 ); - GET_UINT32_BE( W[ 4], data, 16 ); - GET_UINT32_BE( W[ 5], data, 20 ); - GET_UINT32_BE( W[ 6], data, 24 ); - GET_UINT32_BE( W[ 7], data, 28 ); - GET_UINT32_BE( W[ 8], data, 32 ); - GET_UINT32_BE( W[ 9], data, 36 ); - GET_UINT32_BE( W[10], data, 40 ); - GET_UINT32_BE( W[11], data, 44 ); - GET_UINT32_BE( W[12], data, 48 ); - GET_UINT32_BE( W[13], data, 52 ); - GET_UINT32_BE( W[14], data, 56 ); - GET_UINT32_BE( W[15], data, 60 ); - -#define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n))) - -#define R(t) \ -( \ - temp = W[( t - 3 ) & 0x0F] ^ W[( t - 8 ) & 0x0F] ^ \ - W[( t - 14 ) & 0x0F] ^ W[ t & 0x0F], \ - ( W[t & 0x0F] = S(temp,1) ) \ -) - -#define P(a,b,c,d,e,x) \ -{ \ - e += S(a,5) + F(b,c,d) + K + x; b = S(b,30); \ -} - - A = ctx->state[0]; - B = ctx->state[1]; - C = ctx->state[2]; - D = ctx->state[3]; - E = ctx->state[4]; - -#define F(x,y,z) (z ^ (x & (y ^ z))) -#define K 0x5A827999 - - P( A, B, C, D, E, W[0] ); - P( E, A, B, C, D, W[1] ); - P( D, E, A, B, C, W[2] ); - P( C, D, E, A, B, W[3] ); - P( B, C, D, E, A, W[4] ); - P( A, B, C, D, E, W[5] ); - P( E, A, B, C, D, W[6] ); - P( D, E, A, B, C, W[7] ); - P( C, D, E, A, B, W[8] ); - P( B, C, D, E, A, W[9] ); - P( A, B, C, D, E, W[10] ); - P( E, A, B, C, D, W[11] ); - P( D, E, A, B, C, W[12] ); - P( C, D, E, A, B, W[13] ); - P( B, C, D, E, A, W[14] ); - P( A, B, C, D, E, W[15] ); - P( E, A, B, C, D, R(16) ); - P( D, E, A, B, C, R(17) ); - P( C, D, E, A, B, R(18) ); - P( B, C, D, E, A, R(19) ); - -#undef K -#undef F - -#define F(x,y,z) (x ^ y ^ z) -#define K 0x6ED9EBA1 - - P( A, B, C, D, E, R(20) ); - P( E, A, B, C, D, R(21) ); - P( D, E, A, B, C, R(22) ); - P( C, D, E, A, B, R(23) ); - P( B, C, D, E, A, R(24) ); - P( A, B, C, D, E, R(25) ); - P( E, A, B, C, D, R(26) ); - P( D, E, A, B, C, R(27) ); - P( C, D, E, A, B, R(28) ); - P( B, C, D, E, A, R(29) ); - P( A, B, C, D, E, R(30) ); - P( E, A, B, C, D, R(31) ); - P( D, E, A, B, C, R(32) ); - P( C, D, E, A, B, R(33) ); - P( B, C, D, E, A, R(34) ); - P( A, B, C, D, E, R(35) ); - P( E, A, B, C, D, R(36) ); - P( D, E, A, B, C, R(37) ); - P( C, D, E, A, B, R(38) ); - P( B, C, D, E, A, R(39) ); - -#undef K -#undef F - -#define F(x,y,z) ((x & y) | (z & (x | y))) -#define K 0x8F1BBCDC - - P( A, B, C, D, E, R(40) ); - P( E, A, B, C, D, R(41) ); - P( D, E, A, B, C, R(42) ); - P( C, D, E, A, B, R(43) ); - P( B, C, D, E, A, R(44) ); - P( A, B, C, D, E, R(45) ); - P( E, A, B, C, D, R(46) ); - P( D, E, A, B, C, R(47) ); - P( C, D, E, A, B, R(48) ); - P( B, C, D, E, A, R(49) ); - P( A, B, C, D, E, R(50) ); - P( E, A, B, C, D, R(51) ); - P( D, E, A, B, C, R(52) ); - P( C, D, E, A, B, R(53) ); - P( B, C, D, E, A, R(54) ); - P( A, B, C, D, E, R(55) ); - P( E, A, B, C, D, R(56) ); - P( D, E, A, B, C, R(57) ); - P( C, D, E, A, B, R(58) ); - P( B, C, D, E, A, R(59) ); - -#undef K -#undef F - -#define F(x,y,z) (x ^ y ^ z) -#define K 0xCA62C1D6 - - P( A, B, C, D, E, R(60) ); - P( E, A, B, C, D, R(61) ); - P( D, E, A, B, C, R(62) ); - P( C, D, E, A, B, R(63) ); - P( B, C, D, E, A, R(64) ); - P( A, B, C, D, E, R(65) ); - P( E, A, B, C, D, R(66) ); - P( D, E, A, B, C, R(67) ); - P( C, D, E, A, B, R(68) ); - P( B, C, D, E, A, R(69) ); - P( A, B, C, D, E, R(70) ); - P( E, A, B, C, D, R(71) ); - P( D, E, A, B, C, R(72) ); - P( C, D, E, A, B, R(73) ); - P( B, C, D, E, A, R(74) ); - P( A, B, C, D, E, R(75) ); - P( E, A, B, C, D, R(76) ); - P( D, E, A, B, C, R(77) ); - P( C, D, E, A, B, R(78) ); - P( B, C, D, E, A, R(79) ); - -#undef K -#undef F - - ctx->state[0] += A; - ctx->state[1] += B; - ctx->state[2] += C; - ctx->state[3] += D; - ctx->state[4] += E; -} -#endif /* !MBEDTLS_SHA1_PROCESS_ALT */ - -/* - * SHA-1 process buffer - */ -void mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input, size_t ilen ) -{ - size_t fill; - uint32_t left; - - if( ilen == 0 ) - return; - - left = ctx->total[0] & 0x3F; - fill = 64 - left; - - ctx->total[0] += (uint32_t) ilen; - ctx->total[0] &= 0xFFFFFFFF; - - if( ctx->total[0] < (uint32_t) ilen ) - ctx->total[1]++; - - if( left && ilen >= fill ) - { - memcpy( (void *) (ctx->buffer + left), input, fill ); - mbedtls_sha1_process( ctx, ctx->buffer ); - input += fill; - ilen -= fill; - left = 0; - } - - while( ilen >= 64 ) - { - mbedtls_sha1_process( ctx, input ); - input += 64; - ilen -= 64; - } - - if( ilen > 0 ) - memcpy( (void *) (ctx->buffer + left), input, ilen ); -} - -static const unsigned char sha1_padding[64] = -{ - 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 -}; - -/* - * SHA-1 final digest - */ -void mbedtls_sha1_finish( mbedtls_sha1_context *ctx, unsigned char output[20] ) -{ - uint32_t last, padn; - uint32_t high, low; - unsigned char msglen[8]; - - high = ( ctx->total[0] >> 29 ) - | ( ctx->total[1] << 3 ); - low = ( ctx->total[0] << 3 ); - - PUT_UINT32_BE( high, msglen, 0 ); - PUT_UINT32_BE( low, msglen, 4 ); - - last = ctx->total[0] & 0x3F; - padn = ( last < 56 ) ? ( 56 - last ) : ( 120 - last ); - - mbedtls_sha1_update( ctx, sha1_padding, padn ); - mbedtls_sha1_update( ctx, msglen, 8 ); - - PUT_UINT32_BE( ctx->state[0], output, 0 ); - PUT_UINT32_BE( ctx->state[1], output, 4 ); - PUT_UINT32_BE( ctx->state[2], output, 8 ); - PUT_UINT32_BE( ctx->state[3], output, 12 ); - PUT_UINT32_BE( ctx->state[4], output, 16 ); -} - -#endif /* !MBEDTLS_SHA1_ALT */ - -/* - * output = SHA-1( input buffer ) - */ -void mbedtls_sha1( const unsigned char *input, size_t ilen, unsigned char output[20] ) -{ - mbedtls_sha1_context ctx; - - mbedtls_sha1_init( &ctx ); - mbedtls_sha1_starts( &ctx ); - mbedtls_sha1_update( &ctx, input, ilen ); - mbedtls_sha1_finish( &ctx, output ); - mbedtls_sha1_free( &ctx ); -} - -#if defined(MBEDTLS_SELF_TEST) -/* - * FIPS-180-1 test vectors - */ -static const unsigned char sha1_test_buf[3][57] = -{ - { "abc" }, - { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" }, - { "" } -}; - -static const int sha1_test_buflen[3] = -{ - 3, 56, 1000 -}; - -static const unsigned char sha1_test_sum[3][20] = -{ - { 0xA9, 0x99, 0x3E, 0x36, 0x47, 0x06, 0x81, 0x6A, 0xBA, 0x3E, - 0x25, 0x71, 0x78, 0x50, 0xC2, 0x6C, 0x9C, 0xD0, 0xD8, 0x9D }, - { 0x84, 0x98, 0x3E, 0x44, 0x1C, 0x3B, 0xD2, 0x6E, 0xBA, 0xAE, - 0x4A, 0xA1, 0xF9, 0x51, 0x29, 0xE5, 0xE5, 0x46, 0x70, 0xF1 }, - { 0x34, 0xAA, 0x97, 0x3C, 0xD4, 0xC4, 0xDA, 0xA4, 0xF6, 0x1E, - 0xEB, 0x2B, 0xDB, 0xAD, 0x27, 0x31, 0x65, 0x34, 0x01, 0x6F } -}; - -/* - * Checkup routine - */ -int mbedtls_sha1_self_test( int verbose ) -{ - int i, j, buflen, ret = 0; - unsigned char buf[1024]; - unsigned char sha1sum[20]; - mbedtls_sha1_context ctx; - - mbedtls_sha1_init( &ctx ); - - /* - * SHA-1 - */ - for( i = 0; i < 3; i++ ) - { - if( verbose != 0 ) - mbedtls_printf( " SHA-1 test #%d: ", i + 1 ); - - mbedtls_sha1_starts( &ctx ); - - if( i == 2 ) - { - memset( buf, 'a', buflen = 1000 ); - - for( j = 0; j < 1000; j++ ) - mbedtls_sha1_update( &ctx, buf, buflen ); - } - else - mbedtls_sha1_update( &ctx, sha1_test_buf[i], - sha1_test_buflen[i] ); - - mbedtls_sha1_finish( &ctx, sha1sum ); - - if( memcmp( sha1sum, sha1_test_sum[i], 20 ) != 0 ) - { - if( verbose != 0 ) - mbedtls_printf( "failed\n" ); - - ret = 1; - goto exit; - } - - if( verbose != 0 ) - mbedtls_printf( "passed\n" ); - } - - if( verbose != 0 ) - mbedtls_printf( "\n" ); - -exit: - mbedtls_sha1_free( &ctx ); - - return( ret ); -} - -#endif /* MBEDTLS_SELF_TEST */ - -#endif /* MBEDTLS_SHA1_C */ \ No newline at end of file diff --git a/others/mbedtls/sha1.h b/others/mbedtls/sha1.h deleted file mode 100644 index 22a58597..00000000 --- a/others/mbedtls/sha1.h +++ /dev/null @@ -1,136 +0,0 @@ -/** - * \file sha1.h - * - * \brief SHA-1 cryptographic hash function - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ -#ifndef MBEDTLS_SHA1_H -#define MBEDTLS_SHA1_H - -#if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" -#else -#include MBEDTLS_CONFIG_FILE -#endif - -#include -#include - -#if !defined(MBEDTLS_SHA1_ALT) -// Regular implementation -// - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * \brief SHA-1 context structure - */ -typedef struct -{ - uint32_t total[2]; /*!< number of bytes processed */ - uint32_t state[5]; /*!< intermediate digest state */ - unsigned char buffer[64]; /*!< data block being processed */ -} -mbedtls_sha1_context; - -/** - * \brief Initialize SHA-1 context - * - * \param ctx SHA-1 context to be initialized - */ -void mbedtls_sha1_init( mbedtls_sha1_context *ctx ); - -/** - * \brief Clear SHA-1 context - * - * \param ctx SHA-1 context to be cleared - */ -void mbedtls_sha1_free( mbedtls_sha1_context *ctx ); - -/** - * \brief Clone (the state of) a SHA-1 context - * - * \param dst The destination context - * \param src The context to be cloned - */ -void mbedtls_sha1_clone( mbedtls_sha1_context *dst, - const mbedtls_sha1_context *src ); - -/** - * \brief SHA-1 context setup - * - * \param ctx context to be initialized - */ -void mbedtls_sha1_starts( mbedtls_sha1_context *ctx ); - -/** - * \brief SHA-1 process buffer - * - * \param ctx SHA-1 context - * \param input buffer holding the data - * \param ilen length of the input data - */ -void mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input, size_t ilen ); - -/** - * \brief SHA-1 final digest - * - * \param ctx SHA-1 context - * \param output SHA-1 checksum result - */ -void mbedtls_sha1_finish( mbedtls_sha1_context *ctx, unsigned char output[20] ); - -/* Internal use */ -void mbedtls_sha1_process( mbedtls_sha1_context *ctx, const unsigned char data[64] ); - -#ifdef __cplusplus -} -#endif - -#else /* MBEDTLS_SHA1_ALT */ -#include "sha1_alt.h" -#endif /* MBEDTLS_SHA1_ALT */ - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * \brief Output = SHA-1( input buffer ) - * - * \param input buffer holding the data - * \param ilen length of the input data - * \param output SHA-1 checksum result - */ -void mbedtls_sha1( const unsigned char *input, size_t ilen, unsigned char output[20] ); - -/** - * \brief Checkup routine - * - * \return 0 if successful, or 1 if the test failed - */ -int mbedtls_sha1_self_test( int verbose ); - -#ifdef __cplusplus -} -#endif - -#endif /* mbedtls_sha1.h */ \ No newline at end of file diff --git a/src/Makefile.am b/src/Makefile.am index 39c9dc32..fc67cb6c 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -315,6 +315,7 @@ libmodsecurity_la_CPPFLAGS = \ -I.. \ -g \ -I../others \ + -I../others/mbedtls/include \ -fPIC \ -O3 \ -I../headers \ diff --git a/src/utils/md5.cc b/src/utils/md5.cc index 84746007..99b9d278 100644 --- a/src/utils/md5.cc +++ b/src/utils/md5.cc @@ -1,7 +1,7 @@ #include "src/utils/md5.h" -#include "others/mbedtls/md5.h" +#include "mbedtls/md5.h" namespace modsecurity { namespace Utils { diff --git a/src/utils/sha1.cc b/src/utils/sha1.cc index 116d5107..4c28d4ed 100644 --- a/src/utils/sha1.cc +++ b/src/utils/sha1.cc @@ -15,7 +15,7 @@ #include "src/utils/sha1.h" -#include "others/mbedtls/sha1.h" +#include "mbedtls/sha1.h" #include #include #include diff --git a/test/cppcheck_suppressions.txt b/test/cppcheck_suppressions.txt index fa300a34..81d47b1d 100644 --- a/test/cppcheck_suppressions.txt +++ b/test/cppcheck_suppressions.txt @@ -6,9 +6,7 @@ // // Lets ignore mbedtls. // -*:others/mbedtls/base64.c -*:others/mbedtls/md5.c -*:others/mbedtls/sha1.c +*:others/mbedtls/* // From 30ddc32c6fbc1f84fe34e0a36e2ccf4d9829159f Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Thu, 11 Jul 2024 22:07:16 +0200 Subject: [PATCH 50/66] Update README.md: use submodule and use benchmark tool --- README.md | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 82 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 99a664a7..5e802bc3 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,15 @@ As a dynamic library, don’t forget that libmodsecurity must be installed to a ### Unix (Linux, MacOS, FreeBSD, …) -On unix the project uses autotools to help the compilation process. +On unix the project uses autotools to help the compilation process. Please note that if you work with `git`, do not forget to initialize submodules and update them. Here is a brief howto: +```shell +$ git clone https://github.com/owasp-modsecurity/ModSecurity ModSecurity +$ cd ModSecurity +$ git submodule init +$ git submodule update +``` + +After that, you can start the build process: ```shell $ ./build.sh @@ -235,6 +243,79 @@ $ make $ sudo make install ``` +### Benchmarking + +The source tree has a Benchmark tool which can help to measure the library's performance. The tool is under the `test/benchmark/` directory. The build process also makes the binary here, so after the end of compiling you will have the tool. + +To run, just type: + +```shell +cd test/benchmark +$ ./benchmark +Doing 1000000 transactions... + +``` + +Okay, this is a bit much, but you can pass a lower value: + +```shell +$ ./benchmark 1000 +Doing 1000 transactions... +``` + +To measure the time: +```shell +$ time ./benchmark 1000 +Doing 1000 transactions... + +real 0m0.351s +user 0m0.337s +sys 0m0.022s +``` + +This is very fast because the benchmark uses the minimal `modsecurity.conf.default` configuration, which has not so much rules: + +```shell +$ cat basic_rules.conf + +Include "../../modsecurity.conf-recommended" + +``` + +To measure it with real rules, you should run one of the download scripts in the same directory: + +```shell +$ ./download-owasp-v3-rules.sh +Cloning into 'owasp-v3'... +remote: Enumerating objects: 33007, done. +remote: Counting objects: 100% (2581/2581), done. +remote: Compressing objects: 100% (907/907), done. +remote: Total 33007 (delta 2151), reused 2004 (delta 1638), pack-reused 30426 +Receiving objects: 100% (33007/33007), 9.02 MiB | 16.21 MiB/s, done. +Resolving deltas: 100% (25927/25927), done. +Switched to a new branch 'tag3.0.2' +/path/to/ModSecurity/test/benchmark +Done. + +$ cat basic_rules.conf + +Include "../../modsecurity.conf-recommended" + +Include "owasp-v3/crs-setup.conf.example" +Include "owasp-v3/rules/*.conf" +``` + +Now the command will give much higher value. + +#### How the benchark works + +The tool is a simple embedding application which uses the library. It creates a ModSecurity and a RuleSet instance, then runs a loop with number of you passed. Creates a Transaction (object) and emulates real HTTP transactions. + +A transaction is a HTTP/1.1 GET request with a few GET parameters. Added common headers then the response: headers and an XML body. Between the phases it checks did any intervention happen or not. Every transaction is created with same data. + +Note, that the tool does not call the last phase (logging). + +Please don't forget to reset the `basic_rules.conf` content if you want to try it with another rule set. ## Reporting Issues From 714e531134c32221743e0d5a642789034c7b9f7d Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Fri, 12 Jul 2024 09:15:19 +0200 Subject: [PATCH 51/66] Content improve --- README.md | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 5e802bc3..dd780ac4 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ As a dynamic library, don’t forget that libmodsecurity must be installed to a ### Unix (Linux, MacOS, FreeBSD, …) -On unix the project uses autotools to help the compilation process. Please note that if you work with `git`, do not forget to initialize submodules and update them. Here is a brief howto: +On unix the project uses autotools to help the compilation process. Please note that if you are working with `git`, don't forget to initialize and update the submodules. Here's a quick how-to: ```shell $ git clone https://github.com/owasp-modsecurity/ModSecurity ModSecurity $ cd ModSecurity @@ -65,7 +65,7 @@ $ git submodule init $ git submodule update ``` -After that, you can start the build process: +You can then start the build process: ```shell $ ./build.sh @@ -245,7 +245,9 @@ $ sudo make install ### Benchmarking -The source tree has a Benchmark tool which can help to measure the library's performance. The tool is under the `test/benchmark/` directory. The build process also makes the binary here, so after the end of compiling you will have the tool. +The source tree includes a Benchmark tool that can help measure library performance. The tool is located in the test/benchmark/ directory. The build process also creates the binary here, so you will have the tool after the compilation is finished. + +The source tree includes a Benchmark tool that can help measure library performance. The tool is located in the `test/benchmark/` directory. The build process also creates the binary here, so you will have the tool after the compilation is finished. To run, just type: @@ -273,7 +275,7 @@ user 0m0.337s sys 0m0.022s ``` -This is very fast because the benchmark uses the minimal `modsecurity.conf.default` configuration, which has not so much rules: +This is very fast because the benchmark uses the minimal `modsecurity.conf.default` configuration, which doesn't not too much rules: ```shell $ cat basic_rules.conf @@ -282,7 +284,7 @@ Include "../../modsecurity.conf-recommended" ``` -To measure it with real rules, you should run one of the download scripts in the same directory: +To measure with real rules, run one of the download scripts in the same directory: ```shell $ ./download-owasp-v3-rules.sh @@ -309,13 +311,13 @@ Now the command will give much higher value. #### How the benchark works -The tool is a simple embedding application which uses the library. It creates a ModSecurity and a RuleSet instance, then runs a loop with number of you passed. Creates a Transaction (object) and emulates real HTTP transactions. +The tool is a simple wrapper application that uses the library. Creates a ModSecurity instance and a RuleSet instance, then runs a loop with the passed number. Creates a Transaction (object) and emulates real HTTP transactions. -A transaction is a HTTP/1.1 GET request with a few GET parameters. Added common headers then the response: headers and an XML body. Between the phases it checks did any intervention happen or not. Every transaction is created with same data. +The transaction is an HTTP/1.1 GET request with some GET parameters. Added common headers then the response: headers and an XML body. Between phases it checks whether an intervention has taken place or not. All transactions are created with same data. -Note, that the tool does not call the last phase (logging). +Note that the tool does not call the last phase (logging). -Please don't forget to reset the `basic_rules.conf` content if you want to try it with another rule set. +Please remember to reset `basic_rules.conf` if you want to try with a different ruleset. ## Reporting Issues From baa7e694f937c3b9f586fbb674e06621cfbf1627 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Fri, 12 Jul 2024 11:28:52 +0200 Subject: [PATCH 52/66] Typo fixes --- README.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index dd780ac4..810b483f 100644 --- a/README.md +++ b/README.md @@ -245,8 +245,6 @@ $ sudo make install ### Benchmarking -The source tree includes a Benchmark tool that can help measure library performance. The tool is located in the test/benchmark/ directory. The build process also creates the binary here, so you will have the tool after the compilation is finished. - The source tree includes a Benchmark tool that can help measure library performance. The tool is located in the `test/benchmark/` directory. The build process also creates the binary here, so you will have the tool after the compilation is finished. To run, just type: @@ -258,7 +256,7 @@ Doing 1000000 transactions... ``` -Okay, this is a bit much, but you can pass a lower value: +You can also pass a lower value: ```shell $ ./benchmark 1000 @@ -275,7 +273,7 @@ user 0m0.337s sys 0m0.022s ``` -This is very fast because the benchmark uses the minimal `modsecurity.conf.default` configuration, which doesn't not too much rules: +This is very fast because the benchmark uses the minimal `modsecurity.conf.default` configuration, which doesn't much too much rules: ```shell $ cat basic_rules.conf From 8d06e4c47ba9ca57247117351a3f998fc3be92d1 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Fri, 12 Jul 2024 18:09:33 +0200 Subject: [PATCH 53/66] Typo fixes --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 810b483f..18060b6d 100644 --- a/README.md +++ b/README.md @@ -273,7 +273,7 @@ user 0m0.337s sys 0m0.022s ``` -This is very fast because the benchmark uses the minimal `modsecurity.conf.default` configuration, which doesn't much too much rules: +This is very fast because the benchmark uses the minimal `modsecurity.conf.default` configuration, which doesn't include too many rules: ```shell $ cat basic_rules.conf From dc0a06fc70a1e460637560a39bac2208e7d2c397 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sat, 1 Jun 2024 14:54:49 +0000 Subject: [PATCH 54/66] Improve performance of VariableOrigin instances - The previous approach would create a std::unique_ptr and store it in a std::list in VariableValue (Origins) - The new approach now stores Origins in a std::vector and constructs VariableOrigin elements in-place on insertion. - Instead of having two heap-allocations for every added VariableOrigin instance, this performs only one. - If multiple origins are added, std::vector's growth strategy may even prevent a heap-allocation. There's a cost on growing the size of the vector, because a copy of current elements will be necessary. - Introduced reserveOrigin method to notify that multiple insertions will be made, so that we can use std::vector's reserve and do a single allocation (and copy of previous elements), and then just initialize the new elements in-place. --- .../anchored_set_variable_translation_proxy.h | 9 ++- headers/modsecurity/anchored_variable.h | 2 +- headers/modsecurity/variable_origin.h | 12 ++- headers/modsecurity/variable_value.h | 26 +++++-- src/anchored_set_variable.cc | 14 +--- src/anchored_variable.cc | 28 ++----- src/rule_with_operator.cc | 4 +- src/variables/remote_user.cc | 73 ++++++++----------- src/variables/rule.h | 25 ++----- 9 files changed, 78 insertions(+), 115 deletions(-) diff --git a/headers/modsecurity/anchored_set_variable_translation_proxy.h b/headers/modsecurity/anchored_set_variable_translation_proxy.h index 165e3cad..f36c69b1 100644 --- a/headers/modsecurity/anchored_set_variable_translation_proxy.h +++ b/headers/modsecurity/anchored_set_variable_translation_proxy.h @@ -47,11 +47,12 @@ class AnchoredSetVariableTranslationProxy { VariableValue *newVariableValue = new VariableValue(name, &l->at(i)->getKey(), &l->at(i)->getKey()); const VariableValue *oldVariableValue = l->at(i); l->at(i) = newVariableValue; + newVariableValue->reserveOrigin(oldVariableValue->getOrigin().size()); for (const auto &oldOrigin : oldVariableValue->getOrigin()) { - std::unique_ptr newOrigin(new VariableOrigin); - newOrigin->m_length = oldVariableValue->getKey().size(); - newOrigin->m_offset = oldOrigin->m_offset - oldVariableValue->getKey().size() - 1; - newVariableValue->addOrigin(std::move(newOrigin)); + newVariableValue->addOrigin( + oldVariableValue->getKey().size(), + oldOrigin.m_offset - oldVariableValue->getKey().size() - 1 + ); } delete oldVariableValue; } diff --git a/headers/modsecurity/anchored_variable.h b/headers/modsecurity/anchored_variable.h index 703a4f9d..3d777128 100644 --- a/headers/modsecurity/anchored_variable.h +++ b/headers/modsecurity/anchored_variable.h @@ -63,7 +63,7 @@ class AnchoredVariable { void append(const std::string &a, size_t offset, bool spaceSeparator = false); void append(const std::string &a, size_t offset, - bool spaceSeparator, int size); + bool spaceSeparator, size_t size); void evaluate(std::vector *l); std::string * evaluate(); diff --git a/headers/modsecurity/variable_origin.h b/headers/modsecurity/variable_origin.h index 80ec177b..4bcab143 100644 --- a/headers/modsecurity/variable_origin.h +++ b/headers/modsecurity/variable_origin.h @@ -15,6 +15,7 @@ #ifdef __cplusplus #include +#include #endif #ifndef HEADERS_MODSECURITY_VARIABLE_ORIGIN_H_ @@ -36,14 +37,17 @@ class VariableOrigin { VariableOrigin() : m_length(0), m_offset(0) { } + VariableOrigin(size_t length, size_t offset) + : m_length(length), + m_offset(offset) { } - std::string toText() { - std::string offset = std::to_string(m_offset); - std::string len = std::to_string(m_length); + std::string toText() const { + const auto offset = std::to_string(m_offset); + const auto len = std::to_string(m_length); return "v" + offset + "," + len; } - int m_length; + size_t m_length; size_t m_offset; }; diff --git a/headers/modsecurity/variable_value.h b/headers/modsecurity/variable_value.h index 06cf854a..78f17217 100644 --- a/headers/modsecurity/variable_value.h +++ b/headers/modsecurity/variable_value.h @@ -18,7 +18,7 @@ #include #include #include -#include +#include #include #endif @@ -37,7 +37,7 @@ namespace modsecurity { class Collection; class VariableValue { public: - using Origins = std::list>; + using Origins = std::vector; explicit VariableValue(const std::string *key, const std::string *value = nullptr) @@ -62,11 +62,9 @@ class VariableValue { m_keyWithCollection(o->m_keyWithCollection), m_value(o->m_value) { + reserveOrigin(o->m_orign.size()); for (const auto &i : o->m_orign) { - std::unique_ptr origin(new VariableOrigin()); - origin->m_offset = i->m_offset; - origin->m_length = i->m_length; - m_orign.push_back(std::move(origin)); + addOrigin(i); } } @@ -98,8 +96,14 @@ class VariableValue { } - void addOrigin(std::unique_ptr origin) { - m_orign.push_back(std::move(origin)); + void addOrigin(const VariableOrigin &origin) { + m_orign.emplace_back(origin); + } + + + template + void addOrigin(Args&&... args) { + m_orign.emplace_back(args...); } @@ -107,6 +111,12 @@ class VariableValue { return m_orign; } + + void reserveOrigin(Origins::size_type additionalSize) { + m_orign.reserve(m_orign.size() + additionalSize); + } + + private: Origins m_orign; std::string m_collection; diff --git a/src/anchored_set_variable.cc b/src/anchored_set_variable.cc index ec087775..efc6e574 100644 --- a/src/anchored_set_variable.cc +++ b/src/anchored_set_variable.cc @@ -52,26 +52,16 @@ void AnchoredSetVariable::unset() { void AnchoredSetVariable::set(const std::string &key, const std::string &value, size_t offset, size_t len) { - std::unique_ptr origin(new VariableOrigin()); VariableValue *var = new VariableValue(&m_name, &key, &value); - - origin->m_offset = offset; - origin->m_length = len; - - var->addOrigin(std::move(origin)); + var->addOrigin(len, offset); emplace(key, var); } void AnchoredSetVariable::set(const std::string &key, const std::string &value, size_t offset) { - std::unique_ptr origin(new VariableOrigin()); VariableValue *var = new VariableValue(&m_name, &key, &value); - - origin->m_offset = offset; - origin->m_length = value.size(); - - var->addOrigin(std::move(origin)); + var->addOrigin(value.size(), offset); emplace(key, var); } diff --git a/src/anchored_variable.cc b/src/anchored_variable.cc index 63128bb2..3ead9dbe 100644 --- a/src/anchored_variable.cc +++ b/src/anchored_variable.cc @@ -54,58 +54,40 @@ void AnchoredVariable::unset() { void AnchoredVariable::set(const std::string &a, size_t offset, size_t offsetLen) { - std::unique_ptr origin(new VariableOrigin()); - m_offset = offset; m_value.assign(a.c_str(), a.size()); - origin->m_offset = offset; - origin->m_length = offsetLen; - m_var->addOrigin(std::move(origin)); + m_var->addOrigin(offsetLen, offset); } void AnchoredVariable::set(const std::string &a, size_t offset) { - std::unique_ptr origin(new VariableOrigin()); - m_offset = offset; m_value.assign(a.c_str(), a.size()); - origin->m_offset = offset; - origin->m_length = m_value.size(); - m_var->addOrigin(std::move(origin)); + m_var->addOrigin(m_value.size(), offset); } void AnchoredVariable::append(const std::string &a, size_t offset, bool spaceSeparator) { - std::unique_ptr origin( - new VariableOrigin()); - if (spaceSeparator && !m_value.empty()) { m_value.append(" " + a); } else { m_value.append(a); } m_offset = offset; - origin->m_offset = offset; - origin->m_length = a.size(); - m_var->addOrigin(std::move(origin)); + m_var->addOrigin(a.size(), offset); } void AnchoredVariable::append(const std::string &a, size_t offset, - bool spaceSeparator, int size) { - std::unique_ptr origin( - new VariableOrigin()); - + bool spaceSeparator, size_t size) { if (spaceSeparator && !m_value.empty()) { m_value.append(" " + a); } else { m_value.append(a); } m_offset = offset; - origin->m_offset = offset; - origin->m_length = size; - m_var->addOrigin(std::move(origin)); + m_var->addOrigin({size, offset}); } diff --git a/src/rule_with_operator.cc b/src/rule_with_operator.cc index 5146c6d4..3a5ff385 100644 --- a/src/rule_with_operator.cc +++ b/src/rule_with_operator.cc @@ -317,8 +317,8 @@ bool RuleWithOperator::evaluate(Transaction *trans, if (ret == true) { ruleMessage->m_match = m_operator->resolveMatchMessage(trans, key, value); - for (auto &i : v->getOrigin()) { - ruleMessage->m_reference.append(i->toText()); + for (const auto &i : v->getOrigin()) { + ruleMessage->m_reference.append(i.toText()); } ruleMessage->m_reference.append(*valueTemp.second); diff --git a/src/variables/remote_user.cc b/src/variables/remote_user.cc index cc357aea..23bc6487 100644 --- a/src/variables/remote_user.cc +++ b/src/variables/remote_user.cc @@ -39,50 +39,41 @@ namespace variables { void RemoteUser::evaluate(Transaction *transaction, RuleWithActions *rule, std::vector *l) { - size_t pos; - std::string base64; - VariableValue *var; - std::string header; + std::vector l2; - std::vector *l2 = \ - new std::vector(); - transaction->m_variableRequestHeaders.resolve("authorization", l2); + transaction->m_variableRequestHeaders.resolve("authorization", &l2); - if (l2->size() < 1) { - goto clear; + if (!l2.empty()) { + const auto *v = l2[0]; + + const auto &header = v->getValue(); + + std::string base64; + + if (header.compare(0, 6, "Basic ") == 0) { + base64 = std::string(header, 6, header.length()); + } + + base64 = Utils::Base64::decode(base64); + + const auto pos = base64.find(":"); + if (pos != std::string::npos) { + transaction->m_variableRemoteUser.assign(std::string(base64, 0, pos)); + + auto var = std::make_unique(&v->getKeyWithCollection(), + &transaction->m_variableRemoteUser); + + var->reserveOrigin(v->getOrigin().size()); + for (const auto &i : v->getOrigin()) { + var->addOrigin(i); + } + l->push_back(var.release()); + } + + for (auto &a : l2) { + delete a; + } } - - header = std::string(l2->at(0)->getValue()); - - if (header.compare(0, 6, "Basic ") == 0) { - base64 = std::string(header, 6, header.length()); - } - - base64 = Utils::Base64::decode(base64); - - pos = base64.find(":"); - if (pos == std::string::npos) { - goto clear; - } - transaction->m_variableRemoteUser.assign(std::string(base64, 0, pos)); - - var = new VariableValue(&l2->at(0)->getKeyWithCollection(), - &transaction->m_variableRemoteUser); - - for (const auto &i : l2->at(0)->getOrigin()) { - std::unique_ptr origin(new VariableOrigin()); - origin->m_offset = i->m_offset; - origin->m_length = i->m_length; - var->addOrigin(std::move(origin)); - } - l->push_back(var); - -clear: - for (auto &a : *l2) { - delete a; - } - l2->clear(); - delete l2; } diff --git a/src/variables/rule.h b/src/variables/rule.h index f9e2f989..3d3cbcc0 100644 --- a/src/variables/rule.h +++ b/src/variables/rule.h @@ -49,15 +49,12 @@ class Rule_DictElement : public VariableDictElement { \ if (!r || r->m_ruleId == 0) { return; } - std::unique_ptr origin(new VariableOrigin()); std::string *a = new std::string(std::to_string(r->m_ruleId)); VariableValue *var = new VariableValue(&m_rule, &m_rule_id, a ); delete a; - origin->m_offset = 0; - origin->m_length = 0; - var->addOrigin(std::move(origin)); + var->addOrigin(); l->push_back(var); } @@ -75,15 +72,12 @@ class Rule_DictElement : public VariableDictElement { \ return; } - std::unique_ptr origin(new VariableOrigin()); std::string *a = new std::string(r->m_rev); VariableValue *var = new VariableValue(&m_rule, &m_rule_rev, a ); delete a; - origin->m_offset = 0; - origin->m_length = 0; - var->addOrigin(std::move(origin)); + var->addOrigin(); l->push_back(var); } @@ -98,15 +92,12 @@ class Rule_DictElement : public VariableDictElement { \ } if (r && r->hasSeverity()) { - std::unique_ptr origin(new VariableOrigin()); std::string *a = new std::string(std::to_string(r->severity())); VariableValue *var = new VariableValue(&m_rule, &m_rule_severity, a ); delete a; - origin->m_offset = 0; - origin->m_length = 0; - var->addOrigin(std::move(origin)); + var->addOrigin(); l->push_back(var); } } @@ -122,15 +113,12 @@ class Rule_DictElement : public VariableDictElement { \ } if (r && r->hasLogData()) { - std::unique_ptr origin(new VariableOrigin()); std::string *a = new std::string(r->logData(t)); VariableValue *var = new VariableValue(&m_rule, &m_rule_logdata, a ); delete a; - origin->m_offset = 0; - origin->m_length = 0; - var->addOrigin(std::move(origin)); + var->addOrigin(); l->push_back(var); } } @@ -145,15 +133,12 @@ class Rule_DictElement : public VariableDictElement { \ } if (r && r->hasMsg()) { - std::unique_ptr origin(new VariableOrigin()); std::string *a = new std::string(r->msg(t)); VariableValue *var = new VariableValue(&m_rule, &m_rule_msg, a ); delete a; - origin->m_offset = 0; - origin->m_length = 0; - var->addOrigin(std::move(origin)); + var->addOrigin(); l->push_back(var); } } From 6faf6d7ec07878d1be50edae7722a43c17e73072 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sat, 1 Jun 2024 18:37:37 +0000 Subject: [PATCH 55/66] Removed unnecessary usage of heap-allocated VariableValue (m_var) - Removed unused methods --- headers/modsecurity/anchored_variable.h | 16 +------- src/anchored_variable.cc | 51 ++++--------------------- 2 files changed, 9 insertions(+), 58 deletions(-) diff --git a/headers/modsecurity/anchored_variable.h b/headers/modsecurity/anchored_variable.h index 3d777128..b3cc101b 100644 --- a/headers/modsecurity/anchored_variable.h +++ b/headers/modsecurity/anchored_variable.h @@ -47,23 +47,11 @@ class AnchoredVariable { AnchoredVariable(const AnchoredVariable &a) = delete; AnchoredVariable &operator= (const AnchoredVariable &a) = delete; - /* - : m_transaction(a.m_transaction), - m_offset(a.m_offset), - m_name(a.m_name), - m_value(a.m_value), - m_var(a.m_var) { } - */ - - ~AnchoredVariable(); + ~AnchoredVariable() = default; void unset(); void set(const std::string &a, size_t offset); void set(const std::string &a, size_t offset, size_t offsetLen); - void append(const std::string &a, size_t offset, - bool spaceSeparator = false); - void append(const std::string &a, size_t offset, - bool spaceSeparator, size_t size); void evaluate(std::vector *l); std::string * evaluate(); @@ -75,7 +63,7 @@ class AnchoredVariable { std::string m_value; private: - VariableValue *m_var; + VariableValue m_var; }; } // namespace modsecurity diff --git a/src/anchored_variable.cc b/src/anchored_variable.cc index 3ead9dbe..51860d1f 100644 --- a/src/anchored_variable.cc +++ b/src/anchored_variable.cc @@ -31,19 +31,9 @@ AnchoredVariable::AnchoredVariable(Transaction *t, const std::string &name) : m_transaction(t), m_offset(0), - m_name(""), + m_name(name), m_value(""), - m_var(NULL) { - m_name.append(name); - m_var = new VariableValue(&m_name); -} - - -AnchoredVariable::~AnchoredVariable() { - if (m_var) { - delete (m_var); - m_var = NULL; - } + m_var(&name) { } @@ -56,38 +46,14 @@ void AnchoredVariable::set(const std::string &a, size_t offset, size_t offsetLen) { m_offset = offset; m_value.assign(a.c_str(), a.size()); - m_var->addOrigin(offsetLen, offset); + m_var.addOrigin(offsetLen, offset); } void AnchoredVariable::set(const std::string &a, size_t offset) { m_offset = offset; m_value.assign(a.c_str(), a.size()); - m_var->addOrigin(m_value.size(), offset); -} - - -void AnchoredVariable::append(const std::string &a, size_t offset, - bool spaceSeparator) { - if (spaceSeparator && !m_value.empty()) { - m_value.append(" " + a); - } else { - m_value.append(a); - } - m_offset = offset; - m_var->addOrigin(a.size(), offset); -} - - -void AnchoredVariable::append(const std::string &a, size_t offset, - bool spaceSeparator, size_t size) { - if (spaceSeparator && !m_value.empty()) { - m_value.append(" " + a); - } else { - m_value.append(a); - } - m_offset = offset; - m_var->addOrigin({size, offset}); + m_var.addOrigin(m_value.size(), offset); } @@ -96,9 +62,8 @@ void AnchoredVariable::evaluate(std::vector *l) { return; } - m_var->setValue(m_value); - VariableValue *m_var2 = new VariableValue(m_var); - l->push_back(m_var2); + m_var.setValue(m_value); + l->push_back(new VariableValue(&m_var)); } @@ -111,9 +76,7 @@ std::unique_ptr AnchoredVariable::resolveFirst() { if (m_value.empty()) { return nullptr; } - std::unique_ptr a(new std::string()); - a->append(m_value); - return a; + return std::make_unique(m_value); } From eb62cac7fa354ef904169aed32d1691a6fc306eb Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Sat, 1 Jun 2024 23:11:47 +0000 Subject: [PATCH 56/66] Add script to download OWASP CRS v4 to run benchmark - Simplified clone & checkout of CRS repository - Removed no longer maintained OWASP Core Ruleset v2 --- test/benchmark/basic_rules.conf | 2 - test/benchmark/download-owasp-v2-rules.sh | 56 ----------------------- test/benchmark/download-owasp-v3-rules.sh | 6 +-- test/benchmark/download-owasp-v4-rules.sh | 9 ++++ 4 files changed, 10 insertions(+), 63 deletions(-) delete mode 100755 test/benchmark/download-owasp-v2-rules.sh create mode 100755 test/benchmark/download-owasp-v4-rules.sh diff --git a/test/benchmark/basic_rules.conf b/test/benchmark/basic_rules.conf index d6e13db2..b82a3785 100644 --- a/test/benchmark/basic_rules.conf +++ b/test/benchmark/basic_rules.conf @@ -1,5 +1,3 @@ Include "../../modsecurity.conf-recommended" -Include "owasp-v3/crs-setup.conf.example" -Include "owasp-v3/rules/*.conf" diff --git a/test/benchmark/download-owasp-v2-rules.sh b/test/benchmark/download-owasp-v2-rules.sh deleted file mode 100755 index dd1623e7..00000000 --- a/test/benchmark/download-owasp-v2-rules.sh +++ /dev/null @@ -1,56 +0,0 @@ -#!/bin/bash -# -# - -git clone https://github.com/coreruleset/coreruleset.git owasp-v2 -cd owasp-v2 -git checkout 2.2.9 -b tag2.2.9 -cd - - -echo 'Include "owasp-v2/base_rules/*.conf"' >> basic_rules.conf -echo 'Include "owasp-v2/optional_rules/*.conf"' >> basic_rules.conf -echo 'Include "owasp-v2/experimental_rules/*.conf"' >> basic_rules.conf -echo 'Include "owasp-v2/slr_rules/modsecurity_crs_46_slr_et_xss_attacks.conf"' >> basic_rules.conf -echo 'Include "owasp-v2/slr_rules/modsecurity_crs_46_slr_et_sqli_attacks.conf"' >> basic_rules.conf -echo 'Include "owasp-v2/slr_rules/modsecurity_crs_46_slr_et_rfi_attacks.conf"' >> basic_rules.conf - - -# Content injection not support in modsec v3 -rm owasp-v2/optional_rules/modsecurity_crs_43_csrf_protection.conf - - -# Slow dos is not yet supported -rm owasp-v2/experimental_rules/modsecurity_crs_11_slow_dos_protection.conf - - -# WEBSERVER_ERROR_LOG is not supported in v3. -cat owasp-v2/base_rules/modsecurity_crs_20_protocol_violations.conf | sed 's/SecRule WEBSERVER_ERROR_LOG/#SecRule WEBSERVER_ERROR_LOG/g' > owasp-v2/base_rules/modsecurity_crs_20_protocol_violations.conf.tmp -mv owasp-v2/base_rules/modsecurity_crs_20_protocol_violations.conf.tmp owasp-v2/base_rules/modsecurity_crs_20_protocol_violations.conf - - -# Apache specific configuration. -cat owasp-v2/optional_rules/modsecurity_crs_49_header_tagging.conf | sed 's/RequestHeader/#RequestHeader/g' > owasp-v2/optional_rules/modsecurity_crs_49_header_tagging.conf.tmp -mv owasp-v2/optional_rules/modsecurity_crs_49_header_tagging.conf.tmp owasp-v2/optional_rules/modsecurity_crs_49_header_tagging.conf - -cat owasp-v2/optional_rules/modsecurity_crs_55_application_defects.conf | sed 's/Header edit/#Header edit/g' > owasp-v2/optional_rules/modsecurity_crs_55_application_defects.conf.tmp -mv owasp-v2/optional_rules/modsecurity_crs_55_application_defects.conf.tmp owasp-v2/optional_rules/modsecurity_crs_55_application_defects.conf - -cat owasp-v2/experimental_rules/modsecurity_crs_42_csp_enforcement.conf | sed 's/Header set/#Header set/g' > owasp-v2/experimental_rules/modsecurity_crs_42_csp_enforcement.conf.tmp -mv owasp-v2/experimental_rules/modsecurity_crs_42_csp_enforcement.conf.tmp owasp-v2/experimental_rules/modsecurity_crs_42_csp_enforcement.conf - - -# Disables SecGeoLookupDb -cat owasp-v2/experimental_rules/modsecurity_crs_61_ip_forensics.conf | sed 's/SecGeoLookupDb/#SecGeoLookupDb/g' > owasp-v2/experimental_rules/modsecurity_crs_61_ip_forensics.conf.tmp -mv owasp-v2/experimental_rules/modsecurity_crs_61_ip_forensics.conf.tmp owasp-v2/experimental_rules/modsecurity_crs_61_ip_forensics.conf - -cat owasp-v2/experimental_rules/modsecurity_crs_11_proxy_abuse.conf | sed 's/SecGeoLookupDb/#SecGeoLookupDb/g' > owasp-v2/experimental_rules/modsecurity_crs_11_proxy_abuse.conf.tmp -mv owasp-v2/experimental_rules/modsecurity_crs_11_proxy_abuse.conf.tmp owasp-v2/experimental_rules/modsecurity_crs_11_proxy_abuse.conf - - -# STREAM_OUTPUT_BODY is not supported -cat owasp-v2/experimental_rules/modsecurity_crs_40_appsensor_detection_point_2.9_honeytrap.conf | sed 's/SecRule STREAM_OUTPUT_BODY/#SecRule STREAM_OUTPUT_BODY/g' > owasp-v2/experimental_rules/modsecurity_crs_40_appsensor_detection_point_2.9_honeytrap.conf.tmp -mv owasp-v2/experimental_rules/modsecurity_crs_40_appsensor_detection_point_2.9_honeytrap.conf.tmp owasp-v2/experimental_rules/modsecurity_crs_40_appsensor_detection_point_2.9_honeytrap.conf - - -echo "Done." - diff --git a/test/benchmark/download-owasp-v3-rules.sh b/test/benchmark/download-owasp-v3-rules.sh index d0d9f809..6fdb165c 100755 --- a/test/benchmark/download-owasp-v3-rules.sh +++ b/test/benchmark/download-owasp-v3-rules.sh @@ -1,10 +1,6 @@ #!/bin/bash - -git clone https://github.com/coreruleset/coreruleset.git owasp-v3 -cd owasp-v3 -git checkout v3.0.2 -b tag3.0.2 -cd - +git clone -c advice.detachedHead=false --depth 1 --branch v3.0.2 https://github.com/coreruleset/coreruleset.git owasp-v3 echo 'Include "owasp-v3/crs-setup.conf.example"' >> basic_rules.conf echo 'Include "owasp-v3/rules/*.conf"' >> basic_rules.conf diff --git a/test/benchmark/download-owasp-v4-rules.sh b/test/benchmark/download-owasp-v4-rules.sh new file mode 100755 index 00000000..cff3cf53 --- /dev/null +++ b/test/benchmark/download-owasp-v4-rules.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +git clone -c advice.detachedHead=false --depth 1 --branch v4.3.0 https://github.com/coreruleset/coreruleset.git owasp-v4 + +echo 'Include "owasp-v4/crs-setup.conf.example"' >> basic_rules.conf +echo 'Include "owasp-v4/rules/*.conf"' >> basic_rules.conf + +echo "Done." + From 5fe777aeb84aa63930427d94d24add3a0e7d8354 Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Wed, 17 Jul 2024 23:19:10 +0000 Subject: [PATCH 57/66] simplify submodules checkout (but fetch tags for git describe to work) --- .github/workflows/ci.yml | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c0990487..d745ba44 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,11 +57,9 @@ jobs: sudo apt-get install -y libgeoip-dev:${{ matrix.platform.arch }} \ libfuzzy-dev:${{ matrix.platform.arch }} - uses: actions/checkout@v4 - - name: get submodules - # get submodules manually for git describe to work during build - run: | - git submodule init - git submodule update + with: + submodules: true + fetch-depth: 0 - name: build.sh run: ./build.sh - name: configure @@ -108,11 +106,9 @@ jobs: bison \ flex - uses: actions/checkout@v4 - - name: get submodules - # get submodules manually for git describe to work during build - run: | - git submodule init - git submodule update + with: + submodules: true + fetch-depth: 0 - name: build.sh run: ./build.sh - name: configure @@ -141,11 +137,9 @@ jobs: - {label: "wo libxml", opt: "-WITHOUT_LIBXML2=ON" } steps: - uses: actions/checkout@v4 - - name: Get submodules - # get submodules manually for git describe to work during build - run: | - git submodule init - git submodule update + with: + submodules: true + fetch-depth: 0 - name: Install Conan run: | pip3 install conan --upgrade @@ -188,10 +182,11 @@ jobs: run: | sudo apt-get update -y -qq sudo apt-get install -y cppcheck - - name: Get libModSecurity v3 source + - name: Checkout source uses: actions/checkout@v4 with: submodules: true + fetch-depth: 0 - name: Configure libModSecurity run: | ./build.sh From f4d35383e90b21138e4604788cc95116a7244edd Mon Sep 17 00:00:00 2001 From: Eduardo Arias Date: Wed, 17 Jul 2024 23:22:09 +0000 Subject: [PATCH 58/66] fixed typo --- build/win32/docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/win32/docker/Dockerfile b/build/win32/docker/Dockerfile index 4a033f9d..a33d12f8 100644 --- a/build/win32/docker/Dockerfile +++ b/build/win32/docker/Dockerfile @@ -56,7 +56,7 @@ WORKDIR C:\ RUN cmd.exe /C md %SRC_DIR% # libModSecurity -WORKDIR ${SCR_DIR} +WORKDIR ${SRC_DIR} ARG MOD_SECURITY_TAG=v3/master RUN git clone -c advice.detachedHead=false --depth 1 --branch %MOD_SECURITY_TAG% https://github.com/owasp-modsecurity/ModSecurity.git From 4fce2e3c1d06d912102c08e2322f5f5d5d6efb88 Mon Sep 17 00:00:00 2001 From: Behzad Eslami Tehrani Date: Mon, 22 Jul 2024 10:09:27 +0330 Subject: [PATCH 59/66] Fixing typo in Dockerfile Fixing typo in environment variable SRC_DIR. SCR_DIR -> SRC_DIR --- build/win32/docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/win32/docker/Dockerfile b/build/win32/docker/Dockerfile index 4a033f9d..a33d12f8 100644 --- a/build/win32/docker/Dockerfile +++ b/build/win32/docker/Dockerfile @@ -56,7 +56,7 @@ WORKDIR C:\ RUN cmd.exe /C md %SRC_DIR% # libModSecurity -WORKDIR ${SCR_DIR} +WORKDIR ${SRC_DIR} ARG MOD_SECURITY_TAG=v3/master RUN git clone -c advice.detachedHead=false --depth 1 --branch %MOD_SECURITY_TAG% https://github.com/owasp-modsecurity/ModSecurity.git From 937fc5ae5916eaa5b6ee6d193f0849e36d2d09c2 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Mon, 29 Jul 2024 22:07:26 +0200 Subject: [PATCH 60/66] Provide a function to set 'hostname' field in log --- headers/modsecurity/rule_message.h | 5 ++ headers/modsecurity/transaction.h | 10 ++++ src/rule_message.cc | 4 +- src/transaction.cc | 50 +++++++++++++++++++ test/regression/regression.cc | 4 ++ test/regression/regression_test.cc | 3 ++ test/regression/regression_test.h | 1 + .../test-cases/regression/fn-setHostname.json | 41 +++++++++++++++ 8 files changed, 116 insertions(+), 2 deletions(-) create mode 100644 test/test-cases/regression/fn-setHostname.json diff --git a/headers/modsecurity/rule_message.h b/headers/modsecurity/rule_message.h index 51eca0e8..9e1ef556 100644 --- a/headers/modsecurity/rule_message.h +++ b/headers/modsecurity/rule_message.h @@ -67,6 +67,7 @@ class RuleMessage { m_ruleLine(rule->getLineNumber()), m_saveMessage(true), m_serverIpAddress(trans->m_serverIpAddress), + m_requestHostName(trans->m_requestHostName), m_severity(0), m_uriNoQueryStringDecoded(trans->m_uri_no_query_string_decoded), m_ver(rule->m_ver), @@ -92,6 +93,7 @@ class RuleMessage { m_ruleLine(rule->m_ruleLine), m_saveMessage(rule->m_saveMessage), m_serverIpAddress(rule->m_serverIpAddress), + m_requestHostName(rule->m_requestHostName), m_severity(rule->m_severity), m_uriNoQueryStringDecoded(rule->m_uriNoQueryStringDecoded), m_ver(rule->m_ver), @@ -117,6 +119,7 @@ class RuleMessage { m_ruleLine(ruleMessage.m_ruleLine), m_saveMessage(ruleMessage.m_saveMessage), m_serverIpAddress(ruleMessage.m_serverIpAddress), + m_requestHostName(ruleMessage.m_requestHostName), m_severity(ruleMessage.m_severity), m_uriNoQueryStringDecoded(ruleMessage.m_uriNoQueryStringDecoded), m_ver(ruleMessage.m_ver), @@ -142,6 +145,7 @@ class RuleMessage { m_ruleLine = ruleMessage.m_ruleLine; m_saveMessage = ruleMessage.m_saveMessage; m_serverIpAddress = ruleMessage.m_serverIpAddress; + m_requestHostName = ruleMessage.m_requestHostName; m_severity = ruleMessage.m_severity; m_uriNoQueryStringDecoded = ruleMessage.m_uriNoQueryStringDecoded; m_ver = ruleMessage.m_ver; @@ -201,6 +205,7 @@ class RuleMessage { int m_ruleLine; bool m_saveMessage; std::shared_ptr m_serverIpAddress; + std::shared_ptr m_requestHostName; int m_severity; std::shared_ptr m_uriNoQueryStringDecoded; std::string m_ver; diff --git a/headers/modsecurity/transaction.h b/headers/modsecurity/transaction.h index 811a2c83..9caace2c 100644 --- a/headers/modsecurity/transaction.h +++ b/headers/modsecurity/transaction.h @@ -393,6 +393,8 @@ class Transaction : public TransactionAnchoredVariables, public TransactionSecMa int processLogging(); int updateStatusCode(int status); + int setRequestHostName(const std::string& hostname); + bool intervention(ModSecurityIntervention *it); bool addArgument(const std::string& orig, const std::string& key, @@ -443,6 +445,11 @@ class Transaction : public TransactionAnchoredVariables, public TransactionSecMa */ std::shared_ptr m_serverIpAddress; + /** + * Holds the request's hostname + */ + std::shared_ptr m_requestHostName; + /** * Holds the raw URI that was requested. */ @@ -724,6 +731,9 @@ int msc_process_logging(Transaction *transaction); /** @ingroup ModSecurity_C_API */ int msc_update_status_code(Transaction *transaction, int status); +/** @ingroup ModSecurity_C_API */ +int msc_set_request_hostname(Transaction *transaction, const unsigned char *hostname); + #ifdef __cplusplus } } // namespace modsecurity diff --git a/src/rule_message.cc b/src/rule_message.cc index b88ca5c6..5be23839 100644 --- a/src/rule_message.cc +++ b/src/rule_message.cc @@ -42,8 +42,8 @@ std::string RuleMessage::_details(const RuleMessage *rm) { msg.append(" [tag \"" + utils::string::toHexIfNeeded(a, true) + "\"]"); } - msg.append(" [hostname \"" + *rm->m_serverIpAddress.get() \ - + "\"]"); + msg.append(" [hostname \"" + *rm->m_requestHostName.get() + "\"]"); + msg.append(" [uri \"" + utils::string::limitTo(200, *rm->m_uriNoQueryStringDecoded.get()) + "\"]"); msg.append(" [unique_id \"" + *rm->m_id + "\"]"); msg.append(" [ref \"" + utils::string::limitTo(200, rm->m_reference) + "\"]"); diff --git a/src/transaction.cc b/src/transaction.cc index a0762125..efd1cd1b 100644 --- a/src/transaction.cc +++ b/src/transaction.cc @@ -107,6 +107,7 @@ Transaction::Transaction(ModSecurity *ms, RulesSet *rules, void *logCbData) m_clientIpAddress(std::make_shared("")), m_httpVersion(""), m_serverIpAddress(std::make_shared("")), + m_requestHostName(std::make_shared("")), m_uri(""), m_uri_no_query_string_decoded(std::make_shared("")), m_ARGScombinedSizeDouble(0), @@ -183,6 +184,7 @@ Transaction::Transaction(ModSecurity *ms, RulesSet *rules, char *id, void *logCb m_clientIpAddress(std::make_shared("")), m_httpVersion(""), m_serverIpAddress(std::make_shared("")), + m_requestHostName(std::make_shared("")), m_uri(""), m_uri_no_query_string_decoded(std::make_shared("")), m_ARGScombinedSizeDouble(0), @@ -319,6 +321,7 @@ int Transaction::processConnection(const char *client, int cPort, const char *server, int sPort) { m_clientIpAddress = std::unique_ptr(new std::string(client)); m_serverIpAddress = std::unique_ptr(new std::string(server)); + m_requestHostName = std::unique_ptr(new std::string(server)); this->m_clientPort = cPort; this->m_serverPort = sPort; ms_dbg(4, "Transaction context created."); @@ -2358,5 +2361,52 @@ extern "C" int msc_update_status_code(Transaction *transaction, int status) { } +/** + * @name setRequestHostName + * @brief Set request's host name + * + * With this method it is possible to set the request's hostname. + * + * @note This function expects a NULL terminated string. + * + * @param hostname hostname. + * + * @returns If the operation was successful or not. + * @retval true Operation was successful. + * @retval false Operation failed. + * + */ +int Transaction::setRequestHostName(const std::string& hostname) { + + if (hostname != "") { + m_requestHostName = std::unique_ptr(new std::string(hostname)); + } + + return true; +} + + +/** + * @name msc_set_request_hostname + * @brief Set request's host name + * + * With this method it is possible to set request's hostname. + * + * @note This function expects a NULL terminated string. + * + * @param transaction ModSecurity transaction. + * @param hostname hostname. + * + * @returns If the operation was successful or not. + * @retval 1 Operation was successful. + * @retval 0 Operation failed. + * + */ +extern "C" int msc_set_request_hostname(Transaction *transaction, + const unsigned char *hostname) { + return transaction->setRequestHostName(reinterpret_cast(hostname)); +} + + } // namespace modsecurity diff --git a/test/regression/regression.cc b/test/regression/regression.cc index 759b7dbb..962aff0e 100644 --- a/test/regression/regression.cc +++ b/test/regression/regression.cc @@ -309,6 +309,10 @@ void perform_unit_test(ModSecurityTest *test, modsec_transaction->processConnection(t->clientIp.c_str(), t->clientPort, t->serverIp.c_str(), t->serverPort); + if (t->hostname != "") { + modsec_transaction->setRequestHostName(t->hostname); + } + actions(&r, modsec_transaction, &serverLog); #if 0 if (r.status != 200) { diff --git a/test/regression/regression_test.cc b/test/regression/regression_test.cc index 1580a025..01ad2aac 100644 --- a/test/regression/regression_test.cc +++ b/test/regression/regression_test.cc @@ -134,6 +134,9 @@ RegressionTest *RegressionTest::from_yajl_node(const yajl_val &node) { if (strcmp(key2, "port") == 0) { u->serverPort = YAJL_GET_INTEGER(val2); } + if (strcmp(key2, "hostname") == 0) { + u->hostname = YAJL_GET_STRING(val2); + } } } if (strcmp(key, "request") == 0) { diff --git a/test/regression/regression_test.h b/test/regression/regression_test.h index 5ed93b86..eb379867 100644 --- a/test/regression/regression_test.h +++ b/test/regression/regression_test.h @@ -61,6 +61,7 @@ class RegressionTest { std::string serverIp; int clientPort; int serverPort; + std::string hostname; std::string method; std::string httpVersion; diff --git a/test/test-cases/regression/fn-setHostname.json b/test/test-cases/regression/fn-setHostname.json new file mode 100644 index 00000000..33d90695 --- /dev/null +++ b/test/test-cases/regression/fn-setHostname.json @@ -0,0 +1,41 @@ +[ + { + "enabled":1, + "version_min":300000, + "title":"Testing function :: setRequestHostName", + "client": { + "ip":"200.249.12.31" + }, + "server":{ + "ip":"200.249.12.31", + "port":80, + "hostname":"modsecurity.org" + }, + "request": { + "headers": { + "Host":"www.modsecurity.org" + }, + "uri":"/foo?q=attack", + "http_version": 1.1 + }, + "response":{ + "headers":{ + "Date":"Mon, 13 Jul 2015 20:02:41 GMT", + "Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT", + "Content-Type":"text/plain" + }, + "body":[ + "denystring" + ] + }, + "expected":{ + "http_code": 200, + "debug_log": "[hostname: \"modsecurity.org\"]" + }, + "rules":[ + "SecRuleEngine On", + "SecResponseBodyAccess On", + "SecRule ARGS_GET \"@contains attack\" \"id:1,phase:2,deny\"" + ] + } +] From 644931083103000e791bd15a9b12fb35654c2904 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Wed, 31 Jul 2024 14:23:52 +0200 Subject: [PATCH 61/66] Fix typos --- README.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 18060b6d..36201735 100644 --- a/README.md +++ b/README.md @@ -59,10 +59,8 @@ As a dynamic library, don’t forget that libmodsecurity must be installed to a On unix the project uses autotools to help the compilation process. Please note that if you are working with `git`, don't forget to initialize and update the submodules. Here's a quick how-to: ```shell -$ git clone https://github.com/owasp-modsecurity/ModSecurity ModSecurity +$ git clone --recursive https://github.com/owasp-modsecurity/ModSecurity ModSecurity $ cd ModSecurity -$ git submodule init -$ git submodule update ``` You can then start the build process: @@ -307,11 +305,11 @@ Include "owasp-v3/rules/*.conf" Now the command will give much higher value. -#### How the benchark works +#### How the benchmark works -The tool is a simple wrapper application that uses the library. Creates a ModSecurity instance and a RuleSet instance, then runs a loop with the passed number. Creates a Transaction (object) and emulates real HTTP transactions. +The tool is a straightforward wrapper application that utilizes the library. It creates a ModSecurity instance and a RuleSet instance, then runs a loop based on the specified number. Within this loop, it creates a Transaction object to emulate real HTTP transactions. -The transaction is an HTTP/1.1 GET request with some GET parameters. Added common headers then the response: headers and an XML body. Between phases it checks whether an intervention has taken place or not. All transactions are created with same data. +Each transaction is an HTTP/1.1 GET request with some GET parameters. Common headers are added, followed by the response headers and an XML body. Between phases, the tool checks whether an intervention has occurred. All transactions are created with the same data. Note that the tool does not call the last phase (logging). From b4659959cd2fe9fa38cf95e4065daf06c24a3c59 Mon Sep 17 00:00:00 2001 From: gberkes Date: Sun, 4 Aug 2024 22:04:07 +0200 Subject: [PATCH 62/66] Refactor: Ensure safe error handling by removing isolated throw; statements. - SonarCloud analysis identified standalone `throw;` calls without accompanying `try-catch` blocks, used inconsistently as placeholders or for premature termination under specific conditions. - Removed these `throw;` instances to prevent potential runtime issues in future development phases, where such configurations might inadvertently be created. - Introduced `assert` statements as a more appropriate mechanism for asserting preconditions in the affected class member functions, ensuring clearer intent and safer code behavior during development. - Refactor action_kind processing to use switch() instead of if-else chains; add assertion in default case. - Fix SonarCloud issue: Make this variable a const reference. https://sonarcloud.io/project/issues?resolved=false&pullRequest=3104&id=owasp-modsecurity_ModSecurity&open=AY8Vpgy4f6U6E7VKL4Cn --- headers/modsecurity/transaction.h | 8 ++- src/rule_with_actions.cc | 83 +++++++++++++++++-------------- 2 files changed, 48 insertions(+), 43 deletions(-) diff --git a/headers/modsecurity/transaction.h b/headers/modsecurity/transaction.h index 9caace2c..e35ed6eb 100644 --- a/headers/modsecurity/transaction.h +++ b/headers/modsecurity/transaction.h @@ -14,6 +14,7 @@ */ #ifdef __cplusplus +#include #include #include #include @@ -307,11 +308,8 @@ class TransactionSecMarkerManagement { } std::shared_ptr getCurrentMarker() const { - if (m_marker) { - return m_marker; - } else { - throw; // cppcheck-suppress rethrowNoCurrentException - } + assert((m_marker != nullptr) && "You might have forgotten to call and evaluate isInsideAMarker() before calling getCurrentMarker()."); + return m_marker; } void removeMarker() { diff --git a/src/rule_with_actions.cc b/src/rule_with_actions.cc index 5ae7d407..7314b5c8 100644 --- a/src/rule_with_actions.cc +++ b/src/rule_with_actions.cc @@ -17,6 +17,7 @@ #include +#include #include #include #include @@ -86,45 +87,51 @@ RuleWithActions::RuleWithActions( if (actions) { for (Action *a : *actions) { - if (a->action_kind == Action::ConfigurationKind) { - a->evaluate(this, NULL); - delete a; - - } else if (a->action_kind == Action::RunTimeOnlyIfMatchKind) { - if (dynamic_cast(a)) { - m_containsCaptureAction = true; + switch (a->action_kind) { + case Action::ConfigurationKind: + a->evaluate(this, NULL); delete a; - } else if (dynamic_cast(a)) { - m_containsMultiMatchAction = true; - delete a; - } else if (dynamic_cast(a)) { - m_severity = dynamic_cast(a); - } else if (dynamic_cast(a)) { - m_logData = dynamic_cast(a); - } else if (dynamic_cast(a)) { - m_msg = dynamic_cast(a); - } else if (dynamic_cast(a)) { - m_actionsSetVar.push_back( - dynamic_cast(a)); - } else if (dynamic_cast(a)) { - m_actionsTag.push_back(dynamic_cast(a)); - } else if (dynamic_cast(a)) { - m_actionsRuntimePos.push_back(a); - m_containsStaticBlockAction = true; - } else if (a->isDisruptive() == true) { - if (m_disruptiveAction != nullptr) { - delete m_disruptiveAction; - m_disruptiveAction = nullptr; + break; + case Action::RunTimeOnlyIfMatchKind: + if (dynamic_cast(a)) { + m_containsCaptureAction = true; + delete a; + } else if (dynamic_cast(a)) { + m_containsMultiMatchAction = true; + delete a; + } else if (dynamic_cast(a)) { + m_severity = dynamic_cast(a); + } else if (dynamic_cast(a)) { + m_logData = dynamic_cast(a); + } else if (dynamic_cast(a)) { + m_msg = dynamic_cast(a); + } else if (dynamic_cast(a)) { + m_actionsSetVar.push_back( + dynamic_cast(a)); + } else if (dynamic_cast(a)) { + m_actionsTag.push_back(dynamic_cast(a)); + } else if (dynamic_cast(a)) { + m_actionsRuntimePos.push_back(a); + m_containsStaticBlockAction = true; + } else if (a->isDisruptive() == true) { + if (m_disruptiveAction != nullptr) { + delete m_disruptiveAction; + m_disruptiveAction = nullptr; + } + m_disruptiveAction = a; + } else { + m_actionsRuntimePos.push_back(a); } - m_disruptiveAction = a; - } else { - m_actionsRuntimePos.push_back(a); - } - } else { - delete a; - std::cout << "General failure, action: " << a->m_name; - std::cout << " has an unknown type." << std::endl; - throw; // cppcheck-suppress rethrowNoCurrentException + break; + default: + std::cout << "General failure, action: " << a->m_name; + std::cout << " has an unknown type." << std::endl; + delete a; + #ifdef NDEBUG + break; + #else + assert(false); + #endif } } delete actions; @@ -239,7 +246,7 @@ void RuleWithActions::executeActionsAfterFullMatch(Transaction *trans, bool containsBlock, std::shared_ptr ruleMessage) { bool disruptiveAlreadyExecuted = false; - for (auto &a : trans->m_rules->m_defaultActions[getPhase()]) { // cppcheck-suppress ctunullpointer + for (const auto &a : trans->m_rules->m_defaultActions[getPhase()]) { // cppcheck-suppress ctunullpointer if (a.get()->action_kind != actions::Action::RunTimeOnlyIfMatchKind) { continue; } From 053e3b526655b57b4b2007726ad50e690f0014b8 Mon Sep 17 00:00:00 2001 From: gberkes Date: Sun, 4 Aug 2024 22:13:58 +0200 Subject: [PATCH 63/66] Document the usage and the importance of assertions. --- README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 36201735..704967d6 100644 --- a/README.md +++ b/README.md @@ -236,10 +236,16 @@ CFLAGS to disable the compilation optimization parameters: ```shell $ export CFLAGS="-g -O0" $ ./build.sh -$ ./configure +$ ./configure --enable-assertions=yes $ make $ sudo make install ``` +"Assertions allow us to document assumptions and to spot violations early in the +development process. What is more, assertions allow us to spot violations with a +minimum of effort." https://dl.acm.org/doi/pdf/10.1145/240964.240969 + +It is recommended to use assertions where applicable, and to enable them with +'--enable-assertions=yes' during the testing and debugging workflow. ### Benchmarking From d47185d7710bdb8310cd12197eaebd1274b7a386 Mon Sep 17 00:00:00 2001 From: gberkes Date: Sun, 4 Aug 2024 22:47:15 +0200 Subject: [PATCH 64/66] Build System: Introduce Configurable Assertion Handling Implemented a new configuration option --enable-assertions=[yes|no] within config.ac, enabling controlled inclusion of -DNDEBUG in CPPFLAGS. The default setting suppresses assertions (by adding -DNDEBUG to CPPFLAGS), preserving the original behavior. This enhancement allows for the optional enabling of assertions during development or debugging by setting --enable-assertions=yes, thereby excluding -DNDEBUG from CPPFLAGS. --- .github/workflows/ci.yml | 6 +++--- configure.ac | 24 ++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d745ba44..d1fe4cbb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,8 +12,8 @@ jobs: matrix: os: [ubuntu-22.04] platform: - - {label: "x64", arch: "amd64", configure: ""} - - {label: "x32", arch: "i386", configure: "PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32"} + - {label: "x64", arch: "amd64", configure: "--enable-assertions=yes"} + - {label: "x32", arch: "i386", configure: "PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS= -m32--enable-assertions=yes"} compiler: - {label: "gcc", cc: "gcc", cxx: "g++"} - {label: "clang", cc: "clang", cxx: "clang++"} @@ -112,7 +112,7 @@ jobs: - name: build.sh run: ./build.sh - name: configure - run: ./configure ${{ matrix.configure.opt }} + run: ./configure ${{ matrix.configure.opt }} --enable-assertions=yes - uses: ammaraskar/gcc-problem-matcher@master - name: make run: make -j `sysctl -n hw.logicalcpu` diff --git a/configure.ac b/configure.ac index f69c5c61..d8943164 100644 --- a/configure.ac +++ b/configure.ac @@ -248,6 +248,17 @@ AC_SUBST([MSC_VERSION]) MSC_GIT_VERSION=msc_version_git AC_SUBST([MSC_GIT_VERSION]) +AC_ARG_ENABLE(assertions, + [AS_HELP_STRING([--enable-assertions],[Turn on assertions feature: undefine NDEBUG])], + + [case "${enableval}" in + yes) assertions=true ;; + no) assertions=false ;; + *) AC_MSG_ERROR(bad value ${enableval} for --enable-assertions) ;; + esac], + + [assertions=false] + ) AC_ARG_ENABLE(debug-logs, [AS_HELP_STRING([--disable-debug-logs],[Turn off the SecDebugLog feature])], @@ -377,6 +388,14 @@ if test "$aflFuzzer" == "true"; then GLOBAL_CPPFLAGS="$GLOBAL_CPPFLAGS $FUZZ_CPPCFLAGS" $buildExamples = false fi + +case $assertions in + false) ASSERTIONS_CPPCFLAGS="-DNDEBUG" ;; + true) ASSERTIONS_CPPCFLAGS="-UNDEBUG" ;; + *) AC_MSG_ERROR(bad value ${assertions} for assertions) ;; +esac +GLOBAL_CPPFLAGS="$GLOBAL_CPPFLAGS $ASSERTIONS_CPPCFLAGS" + AC_SUBST(GLOBAL_LDADD) AC_SUBST(GLOBAL_CPPFLAGS) @@ -613,6 +632,11 @@ if test $buildTestUtilities = true; then else echo " + Test Utilities ....disabled" fi +if test $assertions = true; then + echo " + Assertions ....enabled" +else + echo " + Assertions ....disabled" +fi if test $debugLogs = true; then echo " + SecDebugLog ....enabled" else From dc3f80a15594222c798635c2452e4ae497f58bf1 Mon Sep 17 00:00:00 2001 From: gberkes Date: Sun, 4 Aug 2024 22:55:42 +0200 Subject: [PATCH 65/66] Fixed missing whitespace. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d1fe4cbb..3c5fae6c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: os: [ubuntu-22.04] platform: - {label: "x64", arch: "amd64", configure: "--enable-assertions=yes"} - - {label: "x32", arch: "i386", configure: "PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS= -m32--enable-assertions=yes"} + - {label: "x32", arch: "i386", configure: "PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS= -m32 --enable-assertions=yes"} compiler: - {label: "gcc", cc: "gcc", cxx: "g++"} - {label: "clang", cc: "clang", cxx: "clang++"} From b4cb24327cfc4960b34ad2c95acce8fdf1a76402 Mon Sep 17 00:00:00 2001 From: gberkes Date: Sun, 4 Aug 2024 23:00:39 +0200 Subject: [PATCH 66/66] Fixed extra whitespace. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3c5fae6c..04a99b00 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: os: [ubuntu-22.04] platform: - {label: "x64", arch: "amd64", configure: "--enable-assertions=yes"} - - {label: "x32", arch: "i386", configure: "PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS= -m32 --enable-assertions=yes"} + - {label: "x32", arch: "i386", configure: "PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32 --enable-assertions=yes"} compiler: - {label: "gcc", cc: "gcc", cxx: "g++"} - {label: "clang", cc: "clang", cxx: "clang++"}