From 47a5e001f992a2443fe168f49e2d35cf800d1105 Mon Sep 17 00:00:00 2001 From: Levi Neely <141506390+lneely@users.noreply.github.com> Date: Sun, 9 Mar 2025 16:14:27 +0100 Subject: [PATCH] pssl namespace decomposition, remove compat junk --- pclsync/pcrypto.c | 42 ++++---- pclsync/pcryptofolder.c | 198 +++++++++++++++++----------------- pclsync/pdiff.c | 2 +- pclsync/pfs.c | 8 +- pclsync/pp2p.c | 40 +++---- pclsync/ppassword.c | 4 +- pclsync/ppathstatus.c | 4 +- pclsync/psock.c | 44 ++++---- pclsync/pssl.c | 232 +++++++++++++++++----------------------- pclsync/pssl.h | 133 +++++++++-------------- pclsync/psynclib.c | 6 +- 11 files changed, 327 insertions(+), 386 deletions(-) diff --git a/pclsync/pcrypto.c b/pclsync/pcrypto.c index 73fa4f2..d407299 100644 --- a/pclsync/pcrypto.c +++ b/pclsync/pcrypto.c @@ -68,7 +68,7 @@ static void psync_hmac_sha512_init(psync_hmac_sha512_ctx *ctx, } psync_sha512_init(&ctx->sha1ctx); psync_sha512_update(&ctx->sha1ctx, keyxor, PSYNC_SHA512_BLOCK_LEN); - psync_ssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN); + pssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN); } static void psync_hmac_sha512_update(psync_hmac_sha512_ctx *ctx, @@ -81,7 +81,7 @@ static void psync_hmac_sha512_final(unsigned char *result, psync_sha512_final(ctx->final + PSYNC_SHA512_BLOCK_LEN, &ctx->sha1ctx); psync_sha512(ctx->final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN, result); - psync_ssl_memclean(ctx->final, + pssl_memclean(ctx->final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN); } @@ -107,8 +107,8 @@ static void psync_hmac_sha512(const unsigned char *msg, size_t msglen, psync_sha512_update(&sha1ctx, msg, msglen); psync_sha512_final(final + PSYNC_SHA512_BLOCK_LEN, &sha1ctx); psync_sha512(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN, result); - psync_ssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN); - psync_ssl_memclean(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN); + pssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN); + pssl_memclean(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN); } #define ALIGN_A256_BS(n) \ @@ -165,7 +165,7 @@ psync_symmetric_key_t pcrypto_key_len(size_t len) { key = (psync_symmetric_key_t)pmemlock_malloc( offsetof(psync_symmetric_key_struct_t, key) + len); key->keylen = len; - psync_ssl_rand_strong(key->key, len); + pssl_rand_strong(key->key, len); return key; } @@ -180,7 +180,7 @@ pcrypto_ctr_encdec_t pcrypto_ctr_encdec_create(psync_symmetric_key_t key) { if (unlikely_log(key->keylen < PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE)) { return PSYNC_CRYPTO_INVALID_ENCODER; } - enc = psync_ssl_aes256_create_encoder(key); + enc = paes_create_encoder(key); if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) { return PSYNC_CRYPTO_INVALID_ENCODER; } @@ -192,8 +192,8 @@ pcrypto_ctr_encdec_t pcrypto_ctr_encdec_create(psync_symmetric_key_t key) { void pcrypto_ctr_encdec_free( pcrypto_ctr_encdec_t enc) { - psync_ssl_aes256_free_encoder(enc->encoder); - psync_ssl_memclean(enc->iv, PSYNC_AES256_BLOCK_SIZE); + paes_free_encoder(enc->encoder); + pssl_memclean(enc->iv, PSYNC_AES256_BLOCK_SIZE); psync_free(enc); } @@ -404,7 +404,7 @@ pcrypto_textenc_create(psync_symmetric_key_t key) { if (unlikely_log(key->keylen < PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE)) return PSYNC_CRYPTO_INVALID_ENCODER; - enc = psync_ssl_aes256_create_encoder(key); + enc = paes_create_encoder(key); if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) return PSYNC_CRYPTO_INVALID_ENCODER; ret = (pcrypto_textenc_t)pmemlock_malloc( @@ -418,8 +418,8 @@ pcrypto_textenc_create(psync_symmetric_key_t key) { void pcrypto_textenc_free( pcrypto_textenc_t enc) { - psync_ssl_aes256_free_encoder(enc->encoder); - psync_ssl_memclean(enc->iv, enc->ivlen); + paes_free_encoder(enc->encoder); + pssl_memclean(enc->iv, enc->ivlen); pmemlock_free(enc); } @@ -430,7 +430,7 @@ pcrypto_textdec_create(psync_symmetric_key_t key) { if (unlikely_log(key->keylen < PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE)) return PSYNC_CRYPTO_INVALID_ENCODER; - enc = psync_ssl_aes256_create_decoder(key); + enc = paes_create_decoder(key); if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) return PSYNC_CRYPTO_INVALID_ENCODER; ret = (pcrypto_textenc_t)pmemlock_malloc( @@ -444,8 +444,8 @@ pcrypto_textdec_create(psync_symmetric_key_t key) { void pcrypto_textdec_free( pcrypto_textdec_t enc) { - psync_ssl_aes256_free_encoder(enc->encoder); - psync_ssl_memclean(enc->iv, enc->ivlen); + paes_free_encoder(enc->encoder); + pssl_memclean(enc->iv, enc->ivlen); pmemlock_free(enc); } @@ -456,12 +456,12 @@ pcrypto_sec_encdec_create(psync_symmetric_key_t key) { pcrypto_sector_encdec_t ret; if (unlikely_log(key->keylen < PSYNC_AES256_KEY_SIZE)) return PSYNC_CRYPTO_INVALID_ENCODER; - enc = psync_ssl_aes256_create_encoder(key); + enc = paes_create_encoder(key); if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) return PSYNC_CRYPTO_INVALID_ENCODER; - dec = psync_ssl_aes256_create_decoder(key); + dec = paes_create_decoder(key); if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) { - psync_ssl_aes256_free_encoder(enc); + paes_free_encoder(enc); return PSYNC_CRYPTO_INVALID_ENCODER; } ret = (pcrypto_sector_encdec_t)pmemlock_malloc( @@ -476,9 +476,9 @@ pcrypto_sec_encdec_create(psync_symmetric_key_t key) { void pcrypto_sec_encdec_free( pcrypto_sector_encdec_t enc) { - psync_ssl_aes256_free_encoder(enc->encoder); - psync_ssl_aes256_free_decoder(enc->decoder); - psync_ssl_memclean(enc->iv, enc->ivlen); + paes_free_encoder(enc->encoder); + paes_free_decoder(enc->decoder); + pssl_memclean(enc->iv, enc->ivlen); pmemlock_free(enc); } @@ -504,7 +504,7 @@ void pcrypto_encode_sec( aessrc = ALIGN_PTR_A256_BS(buff); aesdst = aessrc + PSYNC_AES256_BLOCK_SIZE; assert(PSYNC_CRYPTO_AUTH_SIZE == 2 * PSYNC_AES256_BLOCK_SIZE); - psync_ssl_rand_strong(rnd, PSYNC_AES256_BLOCK_SIZE); + pssl_rand_strong(rnd, PSYNC_AES256_BLOCK_SIZE); psync_hmac_sha512_init(&ctx, enc->iv, enc->ivlen); psync_hmac_sha512_update(&ctx, data, datalen); psync_hmac_sha512_update(&ctx, §orid, sizeof(sectorid)); diff --git a/pclsync/pcryptofolder.c b/pclsync/pcryptofolder.c index a40fe3c..ac46973 100644 --- a/pclsync/pcryptofolder.c +++ b/pclsync/pcryptofolder.c @@ -378,51 +378,51 @@ int pcryptofolder_setup(const char *password, const char *hint) { time_t cryptoexpires; int ret; debug(D_NOTICE, "generating salt"); - psync_ssl_rand_strong(salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN); + pssl_rand_strong(salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN); debug(D_NOTICE, "generating AES key from password and setting up encoder"); - aeskey = psync_ssl_gen_symmetric_key_from_pass( + aeskey = psymkey_generate( password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, PSYNC_CRYPTO_PASS_TO_KEY_ITERATIONS); enc = pcrypto_ctr_encdec_create(aeskey); - psync_ssl_free_symmetric_key(aeskey); + psymkey_free(aeskey); if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER)) { debug(D_WARNING, "psync_crypto_aes256_ctr_encoder_decoder_create failed"); return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED; } debug(D_NOTICE, "generating %d bit RSA key", (int)PSYNC_CRYPTO_RSA_SIZE); - rsa = psync_ssl_gen_rsa(PSYNC_CRYPTO_RSA_SIZE); + rsa = pssl_gen_rsa(PSYNC_CRYPTO_RSA_SIZE); if (unlikely(rsa == PSYNC_INVALID_RSA)) { debug(D_WARNING, "RSA key generation failed"); pcrypto_ctr_encdec_free(enc); return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED; } else debug(D_NOTICE, "RSA key generated"); - rsaprivate = psync_ssl_rsa_get_private(rsa); - rsapublic = psync_ssl_rsa_get_public(rsa); - psync_ssl_free_rsa(rsa); + rsaprivate = prsa_get_private(rsa); + rsapublic = prsa_get_public(rsa); + pssl_free_rsa(rsa); if (unlikely(rsaprivate == PSYNC_INVALID_RSA || rsapublic == PSYNC_INVALID_RSA)) { debug(D_WARNING, "psync_ssl_rsa_get_private or psync_ssl_rsa_get_public failed"); if (rsaprivate != PSYNC_INVALID_RSA) - psync_ssl_rsa_free_private(rsaprivate); + prsa_free_private(rsaprivate); if (rsapublic != PSYNC_INVALID_RSA) - psync_ssl_rsa_free_public(rsapublic); + prsa_free_public(rsapublic); pcrypto_ctr_encdec_free(enc); return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED; } - rsaprivatebin = psync_ssl_rsa_private_to_binary(rsaprivate); - rsapublicbin = psync_ssl_rsa_public_to_binary(rsapublic); - psync_ssl_rsa_free_private(rsaprivate); - psync_ssl_rsa_free_public(rsapublic); + rsaprivatebin = prsa_private_to_binary(rsaprivate); + rsapublicbin = prsa_public_to_binary(rsapublic); + prsa_free_private(rsaprivate); + prsa_free_public(rsapublic); if (unlikely(rsaprivatebin == PSYNC_INVALID_BIN_RSA || rsapublic == PSYNC_INVALID_BIN_RSA)) { debug(D_WARNING, "psync_ssl_rsa_private_to_binary or " "psync_ssl_rsa_public_to_binary failed"); if (rsaprivatebin != PSYNC_INVALID_BIN_RSA) - psync_ssl_rsa_free_binary(rsaprivatebin); + prsa_free_binary(rsaprivatebin); if (rsapublicbin != PSYNC_INVALID_BIN_RSA) - psync_ssl_rsa_free_binary(rsapublicbin); + prsa_free_binary(rsapublicbin); pcrypto_ctr_encdec_free(enc); return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED; } @@ -437,8 +437,8 @@ int pcryptofolder_setup(const char *password, const char *hint) { privatesha1); if (unlikely(ret != PSYNC_CRYPTO_SETUP_SUCCESS)) { debug(D_WARNING, "keys upload failed with error %d", ret); - psync_ssl_rsa_free_binary(rsaprivatebin); - psync_ssl_rsa_free_binary(rsapublicbin); + prsa_free_binary(rsaprivatebin); + prsa_free_binary(rsapublicbin); return ret; } debug(D_NOTICE, "keys uploaded"); @@ -447,8 +447,8 @@ int pcryptofolder_setup(const char *password, const char *hint) { rsapublicbin->datalen, salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, PSYNC_CRYPTO_PASS_TO_KEY_ITERATIONS, cryptoexpires, publicsha1, privatesha1, 0); - psync_ssl_rsa_free_binary(rsaprivatebin); - psync_ssl_rsa_free_binary(rsapublicbin); + prsa_free_binary(rsaprivatebin); + prsa_free_binary(rsapublicbin); return PSYNC_CRYPTO_SETUP_SUCCESS; } @@ -501,14 +501,14 @@ static int crypto_keys_match() { key = (psync_symmetric_key_t)psync_malloc( offsetof(psync_symmetric_key_struct_t, key) + 64); key->keylen = 64; - psync_ssl_rand_strong(key->key, key->keylen); - enckey = psync_ssl_rsa_encrypt_symmetric_key(crypto_pubkey, key); + pssl_rand_strong(key->key, key->keylen); + enckey = psymkey_encrypt(crypto_pubkey, key); if (enckey == PSYNC_INVALID_ENC_SYM_KEY) { psync_free(key); return 0; } - deckey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &enckey); + deckey = prsa_decrypt_symm_key_lock(&crypto_privkey, &enckey); psync_free(enckey); if (deckey == PSYNC_INVALID_SYM_KEY) { @@ -517,7 +517,7 @@ static int crypto_keys_match() { } res = key->keylen == deckey->keylen && !memcmp(key->key, deckey->key, key->keylen); - psync_ssl_free_symmetric_key(deckey); + psymkey_free(deckey); psync_free(key); if (res) debug(D_NOTICE, "encrypt/decrypt operation succeeded"); @@ -606,7 +606,7 @@ int pcryptofolder_unlock(const char *password) { } debug(D_NOTICE, "trying to load public key"); - crypto_pubkey = psync_ssl_rsa_load_public(rsapub, rsapublen); + crypto_pubkey = prsa_load_public(rsapub, rsapublen); if (crypto_pubkey == PSYNC_INVALID_RSA) { pthread_rwlock_unlock(&crypto_lock); debug(D_WARNING, "could not load public key"); @@ -618,9 +618,9 @@ int pcryptofolder_unlock(const char *password) { debug(D_NOTICE, "successfully loaded public key"); debug(D_NOTICE, "generating symmetric key"); - aeskey = psync_ssl_gen_symmetric_key_from_pass(password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt, saltlen, iterations); + aeskey = psymkey_generate(password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt, saltlen, iterations); enc = pcrypto_ctr_encdec_create(aeskey); - psync_ssl_free_symmetric_key(aeskey); + psymkey_free(aeskey); rsaprivdec = (unsigned char *)pmemlock_malloc(rsaprivlen); memcpy(rsaprivdec, rsapriv, rsaprivlen); pcrypto_ctr_encdec_decode(enc, rsaprivdec, rsaprivlen, 0); @@ -629,12 +629,12 @@ int pcryptofolder_unlock(const char *password) { debug(D_NOTICE, "trying to load private key"); - crypto_privkey = psync_ssl_rsa_load_private(rsaprivdec, rsaprivlen); - psync_ssl_memclean(rsaprivdec, rsaprivlen); + crypto_privkey = prsa_load_private(rsaprivdec, rsaprivlen); + pssl_memclean(rsaprivdec, rsaprivlen); pmemlock_free(rsaprivdec); if (crypto_privkey == PSYNC_INVALID_RSA) { debug(D_NOTICE, "failed to load private key"); - psync_ssl_rsa_free_public(crypto_pubkey); + prsa_free_public(crypto_pubkey); crypto_pubkey = PSYNC_INVALID_RSA; pthread_rwlock_unlock(&crypto_lock); psync_free(rsapriv); @@ -646,9 +646,9 @@ int pcryptofolder_unlock(const char *password) { debug(D_NOTICE, "verify matching public and private key"); if (!crypto_keys_match()) { - psync_ssl_rsa_free_public(crypto_pubkey); + prsa_free_public(crypto_pubkey); crypto_pubkey = PSYNC_INVALID_RSA; - psync_ssl_rsa_free_private(crypto_privkey); + prsa_free_private(crypto_privkey); crypto_privkey = PSYNC_INVALID_RSA; pthread_rwlock_unlock(&crypto_lock); debug(D_ERROR, "keys don't match"); @@ -694,9 +694,9 @@ int pcryptofolder_lock() { return PRINT_RETURN_CONST(PSYNC_CRYPTO_STOP_NOT_STARTED); } crypto_started_l = 0; - psync_ssl_rsa_free_public(crypto_pubkey); + prsa_free_public(crypto_pubkey); crypto_pubkey = PSYNC_INVALID_RSA; - psync_ssl_rsa_free_private(crypto_privkey); + prsa_free_private(crypto_privkey); crypto_privkey = PSYNC_INVALID_RSA; pthread_rwlock_unlock(&crypto_lock); debug(D_NOTICE, "stopped crypto"); @@ -781,7 +781,7 @@ static void save_folder_key(psync_folderid_t folderid, // will deadlock insert_folder_key_task *t; t = psync_new(insert_folder_key_task); - t->key = psync_ssl_copy_encrypted_symmetric_key(enckey); + t->key = psymkey_copy_encrypted(enckey); t->id = folderid; prun_thread1("save folder key to db task", ptask_cfldr_save_fldrkey, t); } @@ -790,7 +790,7 @@ static void save_file_key_to_db(psync_fileid_t fileid, uint64_t hash, psync_encrypted_symmetric_key_t enckey) { insert_file_key_task *t; t = psync_new(insert_file_key_task); - t->key = psync_ssl_copy_encrypted_symmetric_key(enckey); + t->key = psymkey_copy_encrypted(enckey); t->id = fileid; t->hash = hash; prun_thread1("save file key to db task", ptask_cfldr_save_filekey, t); @@ -843,7 +843,7 @@ static psync_encrypted_symmetric_key_t download_fldr_enckey(psync_folderid_t fol if (!key) return (psync_encrypted_symmetric_key_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); - ret = psync_ssl_alloc_encrypted_symmetric_key(keylen); + ret = psymkey_alloc_encrypted(keylen); memcpy(ret->data, key, keylen); psync_free(key); save_folder_key(folderid, ret); @@ -896,7 +896,7 @@ static psync_encrypted_symmetric_key_t download_file_enckey(psync_fileid_t filei if (!key) return (psync_encrypted_symmetric_key_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); - ret = psync_ssl_alloc_encrypted_symmetric_key(keylen); + ret = psymkey_alloc_encrypted(keylen); memcpy(ret->data, key, keylen); psync_free(key); save_file_key_to_db(fileid, result, ret); @@ -914,7 +914,7 @@ static psync_encrypted_symmetric_key_t get_fldr_enckey(psync_folderid_t folderid psync_sql_bind_uint(res, 1, folderid); if ((row = psync_sql_fetch_row(res))) { ckey = psync_get_lstring(row[0], &ckeylen); - enckey = psync_ssl_alloc_encrypted_symmetric_key(ckeylen); + enckey = psymkey_alloc_encrypted(ckeylen); memcpy(enckey->data, ckey, ckeylen); psync_sql_free_result(res); return enckey; @@ -936,7 +936,7 @@ static psync_encrypted_symmetric_key_t get_file_enckey(psync_fileid_t fileid, ui psync_sql_bind_uint(res, 2, hash); if ((row = psync_sql_fetch_row(res))) { ckey = psync_get_lstring(row[0], &ckeylen); - enckey = psync_ssl_alloc_encrypted_symmetric_key(ckeylen); + enckey = psymkey_alloc_encrypted(ckeylen); memcpy(enckey->data, ckey, ckeylen); psync_sql_free_result(res); return enckey; @@ -963,7 +963,7 @@ static psync_symmetric_key_t get_fldr_symkey_safe(psync_folderid_t folderid) { if (is_err(enckey)) return (psync_symmetric_key_t)enckey; - symkey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &enckey); + symkey = prsa_decrypt_symm_key_lock(&crypto_privkey, &enckey); psync_free(enckey); if (symkey == PSYNC_INVALID_SYM_KEY) @@ -991,7 +991,7 @@ static psync_symmetric_key_t get_file_symkey_safe(psync_fileid_t fileid, uint64_ (psync_encrypted_symmetric_key_t)PSYNC_CRYPTO_UNLOADED_SECTOR_ENCODER) return (psync_symmetric_key_t)PSYNC_CRYPTO_UNLOADED_SECTOR_ENCODER; - symkey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &enckey); + symkey = prsa_decrypt_symm_key_lock(&crypto_privkey, &enckey); psync_free(enckey); if (unlikely_log(symkey == PSYNC_INVALID_SYM_KEY)) @@ -1001,7 +1001,7 @@ static psync_symmetric_key_t get_file_symkey_safe(psync_fileid_t fileid, uint64_ } static void free_symkey(void *ptr) { - psync_ssl_free_symmetric_key((psync_symmetric_key_t)ptr); + psymkey_free((psync_symmetric_key_t)ptr); } static void @@ -1058,12 +1058,12 @@ static pcrypto_textenc_t get_fldr_encoder(psync_folderid_t folderid) { realkey = symkeyv1_to_symkey(skv1); psync_crypto_release_folder_symkey_locked(folderid, symkey); enc = pcrypto_textenc_create(realkey); - psync_ssl_free_symmetric_key(realkey); + psymkey_free(realkey); return enc; default: debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type); def1: - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); return (pcrypto_textenc_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); } @@ -1098,12 +1098,12 @@ static pcrypto_textdec_t get_fldrdecoder_safe(psync_folderid_t folderid) { realkey = symkeyv1_to_symkey(skv1); psync_crypto_release_folder_symkey_locked(folderid, symkey); dec = pcrypto_textdec_create(realkey); - psync_ssl_free_symmetric_key(realkey); + psymkey_free(realkey); return dec; default: debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type); def1: - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); return (pcrypto_textdec_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); } @@ -1131,7 +1131,7 @@ static pcrypto_textenc_t get_tmp_fldrencoder_safe(psync_fsfolderid_t folderid) { enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen); psync_sql_free_result(res); if (enckey) { - symkey = psync_ssl_rsa_decrypt_data(crypto_privkey, enckey, enckeylen); + symkey = prsa_decrypt_data(crypto_privkey, enckey, enckeylen); psync_free(enckey); } else symkey = PSYNC_INVALID_SYM_KEY; @@ -1152,14 +1152,14 @@ static pcrypto_textenc_t get_tmp_fldrencoder_safe(psync_fsfolderid_t folderid) { goto def1; } realkey = symkeyv1_to_symkey(skv1); - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); enc = pcrypto_textenc_create(realkey); - psync_ssl_free_symmetric_key(realkey); + psymkey_free(realkey); return enc; default: debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type); def1: - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); return (pcrypto_textenc_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); } @@ -1187,7 +1187,7 @@ static pcrypto_textdec_t get_tmp_fldrdecoder_safe(psync_fsfolderid_t folderid) { enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen); psync_sql_free_result(res); if (enckey) { - symkey = psync_ssl_rsa_decrypt_data(crypto_privkey, enckey, enckeylen); + symkey = prsa_decrypt_data(crypto_privkey, enckey, enckeylen); psync_free(enckey); if (symkey == PSYNC_INVALID_SYM_KEY) @@ -1213,14 +1213,14 @@ static pcrypto_textdec_t get_tmp_fldrdecoder_safe(psync_fsfolderid_t folderid) { goto def1; } realkey = symkeyv1_to_symkey(skv1); - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); dec = pcrypto_textdec_create(realkey); - psync_ssl_free_symmetric_key(realkey); + psymkey_free(realkey); return dec; default: debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type); def1: - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); return (pcrypto_textdec_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); } @@ -1378,12 +1378,12 @@ static pcrypto_sector_encdec_t get_fileencoder(psync_fileid_t fileid, uint64_t h realkey = symkeyv1_to_symkey(skv1); psync_crypto_release_file_symkey_locked(fileid, hash, symkey); enc = pcrypto_sec_encdec_create(realkey); - psync_ssl_free_symmetric_key(realkey); + psymkey_free(realkey); return enc; default: debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type); def1: - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); return (pcrypto_sector_encdec_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); } @@ -1416,7 +1416,7 @@ static pcrypto_sector_encdec_t get_fileencoder_tmp(psync_fsfileid_t fileid, enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen); psync_sql_free_result(res); if (enckey) { - symkey = psync_ssl_rsa_decrypt_data(crypto_privkey, enckey, enckeylen); + symkey = prsa_decrypt_data(crypto_privkey, enckey, enckeylen); psync_free(enckey); } else @@ -1434,14 +1434,14 @@ static pcrypto_sector_encdec_t get_fileencoder_tmp(psync_fsfileid_t fileid, goto def1; } realkey = symkeyv1_to_symkey(skv1); - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); enc = pcrypto_sec_encdec_create(realkey); - psync_ssl_free_symmetric_key(realkey); + psymkey_free(realkey); return enc; default: debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type); def1: - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); return (pcrypto_sector_encdec_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); } @@ -1501,7 +1501,7 @@ pcrypto_sector_encdec_t pcryptofolder_filencoder_from_binresult(psync_fileid_t f if (!key) return (pcrypto_sector_encdec_t)errptr( PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY)); - esym = psync_ssl_alloc_encrypted_symmetric_key(keylen); + esym = psymkey_alloc_encrypted(keylen); memcpy(esym->data, key, keylen); psync_free(key); hash = papi_find_result2(res, "hash", PARAM_NUM)->num; @@ -1514,7 +1514,7 @@ pcrypto_sector_encdec_t pcryptofolder_filencoder_from_binresult(psync_fileid_t f // save_file_key_to_db runs thread to save to db, that's why we insert // decrypted key to cache, so get_fileencoder finds // it - symkey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &esym); + symkey = prsa_decrypt_symm_key_lock(&crypto_privkey, &esym); psync_crypto_release_file_symkey_locked(fileid, hash, symkey); enc = get_fileencoder(fileid, hash, 0); @@ -1686,21 +1686,21 @@ char *pcryptofolder_filencoder_key_new(uint32_t flags, size_t *keylen) { return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED)); sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC; sym.flags = flags; - psync_ssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN); - psync_ssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE); + pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN); + pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE); pthread_rwlock_rdlock(&crypto_lock); if (!crypto_started_l) { pthread_rwlock_unlock(&crypto_lock); return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED)); } - encsym = psync_ssl_rsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym, + encsym = prsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym, sizeof(sym)); pthread_rwlock_unlock(&crypto_lock); if (encsym == PSYNC_INVALID_ENC_SYM_KEY) { debug(D_ERROR, "RSA encryption failed"); return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_RSA_ERROR)); } - psync_ssl_memclean(&sym, sizeof(sym)); + pssl_memclean(&sym, sizeof(sym)); ret = (char *)psync_base64_encode(encsym->data, encsym->datalen, keylen); psync_free(encsym); return ret; @@ -1715,14 +1715,14 @@ char *pcryptofolder_filencoder_key_newplain( return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED)); sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC; sym.flags = flags; - psync_ssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN); - psync_ssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE); + pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN); + pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE); pthread_rwlock_rdlock(&crypto_lock); if (!crypto_started_l) { pthread_rwlock_unlock(&crypto_lock); return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED)); } - encsym = psync_ssl_rsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym, + encsym = prsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym, sizeof(sym)); pthread_rwlock_unlock(&crypto_lock); if (encsym == PSYNC_INVALID_ENC_SYM_KEY) { @@ -1730,7 +1730,7 @@ char *pcryptofolder_filencoder_key_newplain( return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_RSA_ERROR)); } *deckey = symkeyv1_to_symkey(&sym); - psync_ssl_memclean(&sym, sizeof(sym)); + pssl_memclean(&sym, sizeof(sym)); ret = (char *)psync_base64_encode(encsym->data, encsym->datalen, keylen); psync_free(encsym); return ret; @@ -1749,16 +1749,16 @@ int pcryptofolder_mkdir(psync_folderid_t folderid, const char *name, ename = NULL; sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC; sym.flags = PSYNC_CRYPTO_SYM_FLAG_ISDIR; - psync_ssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN); - psync_ssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE); + pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN); + pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE); pthread_rwlock_rdlock(&crypto_lock); if (!crypto_started_l) { pthread_rwlock_unlock(&crypto_lock); return set_err(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED), err); } - encsym = psync_ssl_rsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym, + encsym = prsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym, sizeof(sym)); - psync_ssl_memclean(&sym, sizeof(sym)); + pssl_memclean(&sym, sizeof(sym)); ret = get_fldr_name(folderid, name, &ename, err); pthread_rwlock_unlock(&crypto_lock); if (ret) { @@ -1797,7 +1797,7 @@ int psync_pcloud_crypto_reencode_key( case PSYNC_CRYPTO_PUB_TYPE_RSA4096: if (offsetof(pub_key_ver1, key) >= rsapublen) goto err_bk_0; - pub = psync_ssl_rsa_load_public(rsapub + offsetof(pub_key_ver1, key), + pub = prsa_load_public(rsapub + offsetof(pub_key_ver1, key), rsapublen - offsetof(pub_key_ver1, key)); if (pub == PSYNC_INVALID_RSA) goto err_bk_0; @@ -1817,14 +1817,14 @@ int psync_pcloud_crypto_reencode_key( if (offsetof(priv_key_ver1, key) >= rsaprivlen) goto err_bk_1; rsapriv_struct = (priv_key_ver1 *)rsapriv; - aeskey = psync_ssl_gen_symmetric_key_from_pass( + aeskey = psymkey_generate( oldpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000); if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY)) goto err_nm_1; rsaprivlen -= offsetof(priv_key_ver1, key); enc = pcrypto_ctr_encdec_create(aeskey); - psync_ssl_free_symmetric_key(aeskey); + psymkey_free(aeskey); if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER)) goto err_nm_1; rsaprivdec = (unsigned char *)psync_malloc(rsaprivlen); @@ -1843,15 +1843,15 @@ int psync_pcloud_crypto_reencode_key( rsapriv_struct = (priv_key_ver1 *)newpriv; rsapriv_struct->type = PSYNC_CRYPTO_TYPE_RSA4096_64BYTESALT_20000IT; rsapriv_struct->flags = flags; - psync_ssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN); - aeskey = psync_ssl_gen_symmetric_key_from_pass( + pssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN); + aeskey = psymkey_generate( newpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000); if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY)) goto err_nm_1; // rsaprivlen-=offsetof(priv_key_ver1, key); enc = pcrypto_ctr_encdec_create(aeskey); - psync_ssl_free_symmetric_key(aeskey); + psymkey_free(aeskey); if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER)) goto err_nm_1; memcpy(rsapriv_struct->key, rsaprivdec, rsaprivlen); @@ -1859,8 +1859,8 @@ int psync_pcloud_crypto_reencode_key( rsaprivlen, 0); pcrypto_ctr_encdec_free(enc); newprivlen = offsetof(priv_key_ver1, key) + rsaprivlen; - priv = psync_ssl_rsa_load_private(rsaprivdec, rsaprivlen); - psync_ssl_memclean(rsaprivdec, rsaprivlen); + priv = prsa_load_private(rsaprivdec, rsaprivlen); + pssl_memclean(rsaprivdec, rsaprivlen); psync_free(rsaprivdec); if (unlikely(priv == PSYNC_INVALID_RSA)) goto err_ph_1; @@ -1873,19 +1873,19 @@ int psync_pcloud_crypto_reencode_key( if (!crypto_keys_match(pub, priv)) goto err_ph_2; psync_sha256(newpriv, newprivlen, newprivsha); - rsasign = psync_ssl_rsa_sign_sha256_hash(priv, newprivsha); + rsasign = prsa_sign_sha256_hash(priv, newprivsha); if (is_err(rsasign)) { psync_free(is_err); - psync_ssl_rsa_free_public(pub); - psync_ssl_rsa_free_private(priv); + prsa_free_public(pub); + prsa_free_private(priv); return to_err(rsasign); } *privenc = (char *)psync_base64_encode(newpriv, newprivlen, &dummy); *sign = (char *)psync_base64_encode(rsasign->data, rsasign->datalen, &dummy); psync_free(rsasign); psync_free(newpriv); - psync_ssl_rsa_free_public(pub); - psync_ssl_rsa_free_private(priv); + prsa_free_public(pub); + prsa_free_private(priv); if (!*privenc || !*sign) { psync_free(*privenc); @@ -1895,18 +1895,18 @@ int psync_pcloud_crypto_reencode_key( return PSYNC_CRYPTO_SUCCESS; err_bk_1: - psync_ssl_rsa_free_public(pub); + prsa_free_public(pub); err_bk_0: return PSYNC_CRYPTO_BAD_KEY; err_nm_1: psync_free(newpriv); - psync_ssl_rsa_free_public(pub); + prsa_free_public(pub); return PERROR_NO_MEMORY; err_ph_2: - psync_ssl_rsa_free_private(priv); + prsa_free_private(priv); err_ph_1: psync_free(newpriv); - psync_ssl_rsa_free_public(pub); + prsa_free_public(pub); return PSYNC_CRYPTO_BAD_PASSPHRASE; } @@ -1920,7 +1920,7 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags, size_t rsaprivlen, dummy; unsigned char newprivsha[PSYNC_SHA256_DIGEST_LEN]; psync_rsa_signature_t rsasign; - rsapriv = psync_ssl_rsa_private_to_binary(crypto_privkey); + rsapriv = prsa_private_to_binary(crypto_privkey); if (rsapriv == PSYNC_INVALID_RSA) goto err_nm_0; rsaprivlen = rsapriv->datalen; @@ -1931,14 +1931,14 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags, rsapriv_struct = (priv_key_ver1 *)newpriv; rsapriv_struct->type = PSYNC_CRYPTO_TYPE_RSA4096_64BYTESALT_20000IT; rsapriv_struct->flags = flags; - psync_ssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN); - aeskey = psync_ssl_gen_symmetric_key_from_pass( + pssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN); + aeskey = psymkey_generate( newpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000); if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY)) goto err_nm_1; enc = pcrypto_ctr_encdec_create(aeskey); - psync_ssl_free_symmetric_key(aeskey); + psymkey_free(aeskey); if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER)) goto err_nm_1; memcpy(rsapriv_struct->key, rsapriv->data, rsaprivlen); @@ -1948,17 +1948,17 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags, rsaprivlen += offsetof(priv_key_ver1, key); psync_sha256(newpriv, rsaprivlen, newprivsha); - rsasign = psync_ssl_rsa_sign_sha256_hash(crypto_privkey, newprivsha); + rsasign = prsa_sign_sha256_hash(crypto_privkey, newprivsha); if (is_err(rsasign)) { psync_free(newpriv); - psync_ssl_rsa_free_binary(rsapriv); + prsa_free_binary(rsapriv); return to_err(rsasign); } *privenc = (char *)psync_base64_encode(newpriv, rsaprivlen, &dummy); *sign = (char *)psync_base64_encode(rsasign->data, rsasign->datalen, &dummy); psync_free(rsasign); psync_free(newpriv); - psync_ssl_rsa_free_binary(rsapriv); + prsa_free_binary(rsapriv); if (!*privenc || !*sign) { psync_free(*privenc); @@ -1970,7 +1970,7 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags, err_nm_1: psync_free(newpriv); - psync_ssl_rsa_free_binary(rsapriv); + prsa_free_binary(rsapriv); err_nm_0: return PERROR_NO_MEMORY; } diff --git a/pclsync/pdiff.c b/pclsync/pdiff.c index edca7de..bb81ed8 100644 --- a/pclsync/pdiff.c +++ b/pclsync/pdiff.c @@ -330,7 +330,7 @@ static psock_t *get_connected_socket() { psync_sql_res *q; unsigned char deviceidbin[16]; char deviceidhex[32 + 2]; - psync_ssl_rand_strong(deviceidbin, sizeof(deviceidbin)); + pssl_rand_strong(deviceidbin, sizeof(deviceidbin)); psync_binhex(deviceidhex, deviceidbin, sizeof(deviceidbin)); deviceidhex[sizeof(deviceidbin) * 2] = 0; q = psync_sql_prep_statement( diff --git a/pclsync/pfs.c b/pclsync/pfs.c index 54fe7f6..aab1749 100644 --- a/pclsync/pfs.c +++ b/pclsync/pfs.c @@ -1468,7 +1468,7 @@ static int psync_fs_open(const char *path, struct fuse_file_info *fi) { goto ex0; } encoder = pcrypto_sec_encdec_create(symkey); - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); if (unlikely_log(encoder == PSYNC_CRYPTO_INVALID_ENCODER)) { psync_free(encsymkey); ret = -ENOMEM; @@ -1639,7 +1639,7 @@ static int psync_fs_creat(const char *path, mode_t mode, return -psync_fs_crypto_err_to_errno(psync_crypto_to_error(encsymkey)); } encoder = pcrypto_sec_encdec_create(symkey); - psync_ssl_free_symmetric_key(symkey); + psymkey_free(symkey); if (unlikely_log(encoder == PSYNC_CRYPTO_INVALID_ENCODER)) { psync_fstask_release_folder_tasks_locked(folder); psync_sql_unlock(); @@ -3367,7 +3367,7 @@ void psync_fs_refresh_folder(psync_folderid_t folderid) { pfolder_path_sep(folderid, "/", NULL); if (path == PSYNC_INVALID_PATH) return; - psync_ssl_rand_strong(rndbuff, sizeof(rndbuff)); + pssl_rand_strong(rndbuff, sizeof(rndbuff)); psync_binhex(rndhex, rndbuff, sizeof(rndbuff)); rndhex[2 * sizeof(rndbuff)] = 0; pthread_mutex_lock(&start_mutex); @@ -3565,7 +3565,7 @@ static void psync_fs_init_once() { #if psync_fs_need_per_folder_refresh_const() unsigned char rndbuff[16]; char rndhex[34]; - psync_ssl_rand_strong(rndbuff, sizeof(rndbuff)); + pssl_rand_strong(rndbuff, sizeof(rndbuff)); psync_binhex(rndhex, rndbuff, sizeof(rndbuff)); rndhex[2 * sizeof(rndbuff)] = 0; psync_fake_prefix = psync_strcat(".refresh", rndhex, NULL); diff --git a/pclsync/pp2p.c b/pclsync/pp2p.c index c09682f..549c24a 100644 --- a/pclsync/pp2p.c +++ b/pclsync/pp2p.c @@ -221,7 +221,7 @@ static void psync_p2p_check(const packet_check *packet) { else return; resp.port = tcpport; - psync_ssl_rand_strong(resp.rand, sizeof(resp.rand)); + pssl_rand_strong(resp.rand, sizeof(resp.rand)); memcpy(hashsource, hashhex, PSYNC_HASH_DIGEST_HEXLEN); memcpy(hashsource + PSYNC_HASH_DIGEST_HEXLEN, resp.rand, sizeof(resp.rand)); psync_hash(hashsource, PSYNC_HASH_BLOCK_SIZE, hashbin); @@ -346,7 +346,7 @@ static void psync_p2p_tcphandler(void *ptr) { debug(D_WARNING, "got request for file that we do not have"); goto err0; } - binpubrsa = psync_ssl_alloc_binary_rsa(packet.keylen); + binpubrsa = pssl_alloc_binary_rsa(packet.keylen); if (unlikely_log( socket_read_all(sock, binpubrsa->data, binpubrsa->datalen))) { psync_free(binpubrsa); @@ -361,7 +361,7 @@ static void psync_p2p_tcphandler(void *ptr) { goto err0; } psync_free(token); - pubrsa = psync_ssl_rsa_binary_to_public(binpubrsa); + pubrsa = prsa_binary_to_public(binpubrsa); psync_free(binpubrsa); if (unlikely_log(pubrsa == PSYNC_INVALID_RSA)) goto err0; @@ -377,9 +377,9 @@ static void psync_p2p_tcphandler(void *ptr) { goto err0; } aeskey = pcrypto_key(); - encaeskey = psync_ssl_rsa_encrypt_symmetric_key(pubrsa, aeskey); + encaeskey = psymkey_encrypt(pubrsa, aeskey); encoder = pcrypto_ctr_encdec_create(aeskey); - psync_ssl_free_symmetric_key(aeskey); + psymkey_free(aeskey); keylen = encaeskey->datalen; enctype = P2P_ENCTYPE_RSA_AES; if (unlikely_log(encaeskey == PSYNC_INVALID_ENC_SYM_KEY) || @@ -550,7 +550,7 @@ static void psync_p2p_wake() { void pp2p_init() { unsigned char computerbin[PSYNC_HASH_DIGEST_LEN]; - psync_ssl_rand_strong(computerbin, PSYNC_HASH_DIGEST_LEN); + pssl_rand_strong(computerbin, PSYNC_HASH_DIGEST_LEN); psync_binhex(computername, computerbin, PSYNC_HASH_DIGEST_LEN); ptimer_exception_handler(psync_p2p_wake); if (!psync_setting_get_bool(_PS(p2psync))) @@ -574,17 +574,17 @@ static int psync_p2p_check_rsa() { psync_rsa_publickey_t rsapub; psync_binary_rsa_key_t rsapubbin; debug(D_NOTICE, "generating %ubit RSA key", PSYNC_P2P_RSA_SIZE); - rsa = psync_ssl_gen_rsa(PSYNC_P2P_RSA_SIZE); + rsa = pssl_gen_rsa(PSYNC_P2P_RSA_SIZE); debug(D_NOTICE, "key generated"); if (unlikely_log(rsa == PSYNC_INVALID_RSA)) goto rete; - rsapriv = psync_ssl_rsa_get_private(rsa); - rsapub = psync_ssl_rsa_get_public(rsa); + rsapriv = prsa_get_private(rsa); + rsapub = prsa_get_public(rsa); if (likely_log(rsapub != PSYNC_INVALID_RSA)) - rsapubbin = psync_ssl_rsa_public_to_binary(rsapub); + rsapubbin = prsa_public_to_binary(rsapub); else rsapubbin = PSYNC_INVALID_BIN_RSA; - psync_ssl_free_rsa(rsa); + pssl_free_rsa(rsa); if (likely_log(rsapriv != PSYNC_INVALID_RSA && rsapub != PSYNC_INVALID_RSA && rsapubbin != PSYNC_INVALID_BIN_RSA)) { @@ -594,11 +594,11 @@ static int psync_p2p_check_rsa() { goto ret0; } else { if (rsapriv != PSYNC_INVALID_RSA) - psync_ssl_rsa_free_private(rsapriv); + prsa_free_private(rsapriv); if (rsapub != PSYNC_INVALID_RSA) - psync_ssl_rsa_free_public(rsapub); + prsa_free_public(rsapub); if (rsapubbin != PSYNC_INVALID_BIN_RSA) - psync_ssl_rsa_free_binary(rsapubbin); + prsa_free_binary(rsapubbin); goto rete; } } @@ -672,18 +672,18 @@ static int psync_p2p_download(int sock, psync_fileid_t fileid, debug(D_ERROR, "too long key - %u bytes", (unsigned)keylen); return PSYNC_NET_PERMFAIL; } - ekey = psync_ssl_alloc_encrypted_symmetric_key(keylen); + ekey = psymkey_alloc_encrypted(keylen); if (unlikely_log(socket_read_all(sock, ekey->data, keylen)) || - unlikely_log((key = psync_ssl_rsa_decrypt_symm_key_lock( + unlikely_log((key = prsa_decrypt_symm_key_lock( &privkey, &ekey)) == PSYNC_INVALID_SYM_KEY)) { - // unlikely_log((key=psync_ssl_rsa_decrypt_symmetric_key(&psync_rsa_private, + // unlikely_log((key=psymkey_decrypt(&psync_rsa_private, // &ekey))==PSYNC_INVALID_SYM_KEY)){ psync_free(ekey); return PSYNC_NET_TEMPFAIL; } psync_free(ekey); decoder = pcrypto_ctr_encdec_create(key); - psync_ssl_free_symmetric_key(key); + psymkey_free(key); if (decoder == PSYNC_CRYPTO_INVALID_ENCODER) return PSYNC_NET_PERMFAIL; fd = pfile_open(filename, O_WRONLY, O_CREAT | O_TRUNC); @@ -754,7 +754,7 @@ int pp2p_check_download(psync_fileid_t fileid, pct1.type = P2P_CHECK; memcpy(pct1.hashstart, filehashhex, PSYNC_P2P_HEXHASH_BYTES); pct1.filesize = fsize; - psync_ssl_rand_strong(pct1.rand, sizeof(pct1.rand)); + pssl_rand_strong(pct1.rand, sizeof(pct1.rand)); memcpy(hashsource, filehashhex, PSYNC_HASH_DIGEST_HEXLEN); memcpy(hashsource + PSYNC_HASH_DIGEST_HEXLEN, pct1.rand, sizeof(pct1.rand)); psync_hash(hashsource, PSYNC_HASH_BLOCK_SIZE, hashbin); @@ -841,7 +841,7 @@ int pp2p_check_download(psync_fileid_t fileid, goto err_perm2; else if (bresp == P2P_RESP_WAIT) { uint32_t rnd; - psync_ssl_rand_strong((unsigned char *)&rnd, sizeof(rnd)); + pssl_rand_strong((unsigned char *)&rnd, sizeof(rnd)); rnd &= 0x7ff; psys_sleep_milliseconds(PSYNC_P2P_SLEEP_WAIT_DOWNLOAD + rnd); goto err_temp2; diff --git a/pclsync/ppassword.c b/pclsync/ppassword.c index 86a7d3d..704617c 100644 --- a/pclsync/ppassword.c +++ b/pclsync/ppassword.c @@ -351,8 +351,8 @@ uint64_t ppassword_score(const char *cpassword) { ldpwd[nlen] = lpwd[nlen]; } num = score_variants(password, lpwd, ldpwd, plen); - psync_ssl_memclean(lpwd, plen); - psync_ssl_memclean(ldpwd, plen); + pssl_memclean(lpwd, plen); + pssl_memclean(ldpwd, plen); psync_free(lpwd); psync_free(ldpwd); mul_score(num); diff --git a/pclsync/ppathstatus.c b/pclsync/ppathstatus.c index 4d1aa16..8c11cf9 100644 --- a/pclsync/ppathstatus.c +++ b/pclsync/ppathstatus.c @@ -216,7 +216,7 @@ void ppathstatus_reload_syncs() { void ppathstatus_clear_cache() { uint64_t ndrv_hash_seed, nsync_hash_seed; do { - psync_ssl_rand_strong((unsigned char *)&ndrv_hash_seed, + pssl_rand_strong((unsigned char *)&ndrv_hash_seed, sizeof(ndrv_hash_seed)); } while (unlikely(!ndrv_hash_seed)); nsync_hash_seed = 0x49916a8e891d1dafULL * ndrv_hash_seed; @@ -229,7 +229,7 @@ void ppathstatus_clear_cache() { void ppathstatus_clear_sync_cache() { uint64_t nsync_hash_seed; do { - psync_ssl_rand_strong((unsigned char *)&nsync_hash_seed, + pssl_rand_strong((unsigned char *)&nsync_hash_seed, sizeof(nsync_hash_seed)); } while (unlikely(nsync_hash_seed == drv_hash_seed)); psync_sql_lock(); diff --git a/pclsync/psock.c b/pclsync/psock.c index 8c392f5..6f728ef 100644 --- a/pclsync/psock.c +++ b/pclsync/psock.c @@ -384,7 +384,7 @@ int psock_try_write_buffer(psock_t *sock) { continue; } if (sock->ssl) { - cw = psync_ssl_write(sock->ssl, b->buff + b->roffset, + cw = pssl_write(sock->ssl, b->buff + b->roffset, b->woffset - b->roffset); if (cw == PSYNC_SSL_FAIL) { if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || @@ -431,7 +431,7 @@ int psock_try_write_buffer_thread(psock_t *sock) { int psock_readable(psock_t *sock) { psock_try_write_buffer(sock); - if (sock->ssl && psync_ssl_pendingdata(sock->ssl)) + if (sock->ssl && pssl_pendingdata(sock->ssl)) return 1; else if (wait_readable(sock->sock, 0, 0)) return 0; @@ -466,13 +466,13 @@ psock_t *psock_connect(const char *host, int unsigned port, int ssl) { } if (ssl) { - ssl = psync_ssl_connect(sock, &sslc, host); + ssl = pssl_connect(sock, &sslc, host); while (ssl == PSYNC_SSL_NEED_FINISH) { if (wait_ssl_ready(sock)) { - psync_ssl_free(sslc); + pssl_free(sslc); break; } - ssl = psync_ssl_connect_finish(sslc, host); + ssl = pssl_connect_finish(sslc, host); } if (unlikely_log(ssl != PSYNC_SSL_SUCCESS)) { close(sock); @@ -495,9 +495,9 @@ int psock_wait_write_timeout(int sock) { void psock_close(psock_t *sock) { if (sock->ssl) - while (psync_ssl_shutdown(sock->ssl) == PSYNC_SSL_NEED_FINISH) + while (pssl_shutdown(sock->ssl) == PSYNC_SSL_NEED_FINISH) if (wait_ssl_ready(sock->sock)) { - psync_ssl_free(sock->ssl); + pssl_free(sock->ssl); break; } psock_clear_write_buffered(sock); @@ -507,7 +507,7 @@ void psock_close(psock_t *sock) { void psock_close_bad(psock_t *sock) { if (sock->ssl) - psync_ssl_free(sock->ssl); + pssl_free(sock->ssl); psock_clear_write_buffered(sock); close(sock->sock); psync_free(sock); @@ -576,7 +576,7 @@ int psock_pendingdata(psock_t *sock) { if (sock->pending) return 1; if (sock->ssl) - return psync_ssl_pendingdata(sock->ssl); + return pssl_pendingdata(sock->ssl); else return 0; } @@ -590,7 +590,7 @@ int psock_pendingdata_buf(psock_t *sock) { return -1; #endif if (sock->ssl) - ret += psync_ssl_pendingdata(sock->ssl); + ret += pssl_pendingdata(sock->ssl); return ret; } @@ -605,13 +605,13 @@ int psock_pendingdata_buf_thread(psock_t *sock) { static int psync_socket_read_ssl(psock_t *sock, void *buff, int num) { int r; psock_try_write_buffer(sock); - if (!psync_ssl_pendingdata(sock->ssl) && !sock->pending && + if (!pssl_pendingdata(sock->ssl) && !sock->pending && psock_wait_read_timeout(sock->sock)) return -1; sock->pending = 0; while (1) { psock_try_write_buffer(sock); - r = psync_ssl_read(sock->ssl, buff, num); + r = pssl_read(sock->ssl, buff, num); if (r == PSYNC_SSL_FAIL) { if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || psync_ssl_errno == PSYNC_SSL_ERR_WANT_WRITE)) { @@ -661,7 +661,7 @@ int psock_read(psock_t *sock, void *buff, int num) { static int psync_socket_read_noblock_ssl(psock_t *sock, void *buff, int num) { int r; - r = psync_ssl_read(sock->ssl, buff, num); + r = pssl_read(sock->ssl, buff, num); if (r == PSYNC_SSL_FAIL) { sock->pending = 0; if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || @@ -701,14 +701,14 @@ static int psync_socket_read_ssl_thread(psock_t *sock, void *buff, int num) { pthread_mutex_lock(&mutex); psock_try_write_buffer(sock); pthread_mutex_unlock(&mutex); - if (!psync_ssl_pendingdata(sock->ssl) && !sock->pending && + if (!pssl_pendingdata(sock->ssl) && !sock->pending && psock_wait_read_timeout(sock->sock)) return -1; sock->pending = 0; while (1) { pthread_mutex_lock(&mutex); psock_try_write_buffer(sock); - r = psync_ssl_read(sock->ssl, buff, num); + r = pssl_read(sock->ssl, buff, num); pthread_mutex_unlock(&mutex); if (r == PSYNC_SSL_FAIL) { if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || @@ -800,7 +800,7 @@ int psock_write(psock_t *sock, const void *buff, int num) { if (psock_wait_write_timeout(sock->sock)) return -1; if (sock->ssl) { - r = psync_ssl_write(sock->ssl, buff, num); + r = pssl_write(sock->ssl, buff, num); if (r == PSYNC_SSL_FAIL) { if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || psync_ssl_errno == PSYNC_SSL_ERR_WANT_WRITE)) @@ -826,7 +826,7 @@ static int psync_socket_readall_ssl(psock_t *sock, void *buff, int num) { psock_try_write_buffer(sock); - if (!psync_ssl_pendingdata(sock->ssl) && !sock->pending && + if (!pssl_pendingdata(sock->ssl) && !sock->pending && psock_wait_read_timeout(sock->sock)) { return -1; } @@ -836,7 +836,7 @@ static int psync_socket_readall_ssl(psock_t *sock, void *buff, int num) { while (br < num) { psock_try_write_buffer(sock); - r = psync_ssl_read(sock->ssl, (char *)buff + br, num - br); + r = pssl_read(sock->ssl, (char *)buff + br, num - br); if (r == PSYNC_SSL_FAIL) { if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || @@ -895,7 +895,7 @@ static int psync_socket_writeall_ssl(psock_t *sock, const void *buff, int num) { int br, r; br = 0; while (br < num) { - r = psync_ssl_write(sock->ssl, (char *)buff + br, num - br); + r = pssl_write(sock->ssl, (char *)buff + br, num - br); if (r == PSYNC_SSL_FAIL) { if (psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || psync_ssl_errno == PSYNC_SSL_ERR_WANT_WRITE) { @@ -948,7 +948,7 @@ static int psync_socket_readall_ssl_thread(psock_t *sock, void *buff, int num) { br = 0; pthread_mutex_lock(&mutex); psock_try_write_buffer(sock); - r = psync_ssl_pendingdata(sock->ssl); + r = pssl_pendingdata(sock->ssl); pthread_mutex_unlock(&mutex); if (!r && !sock->pending && psock_wait_read_timeout(sock->sock)) return -1; @@ -956,7 +956,7 @@ static int psync_socket_readall_ssl_thread(psock_t *sock, void *buff, int num) { while (br < num) { pthread_mutex_lock(&mutex); psock_try_write_buffer(sock); - r = psync_ssl_read(sock->ssl, (char *)buff + br, num - br); + r = pssl_read(sock->ssl, (char *)buff + br, num - br); pthread_mutex_unlock(&mutex); if (r == PSYNC_SSL_FAIL) { if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || @@ -1022,7 +1022,7 @@ static int psync_socket_writeall_ssl_thread(psock_t *sock, const void *buff, if (sock->buffer) r = psync_socket_write_to_buf(sock, buff, num); else - r = psync_ssl_write(sock->ssl, (char *)buff + br, num - br); + r = pssl_write(sock->ssl, (char *)buff + br, num - br); pthread_mutex_unlock(&mutex); if (r == PSYNC_SSL_FAIL) { if (psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ || diff --git a/pclsync/pssl.c b/pclsync/pssl.c index d00e499..4b7de7e 100644 --- a/pclsync/pssl.c +++ b/pclsync/pssl.c @@ -29,8 +29,14 @@ DAMAGE. */ -#include #include +#include +#include +#include +#include +#include +#include + #include #include #include @@ -42,28 +48,19 @@ #include #include #include -#include -#include -#include - -#include "pcompiler.h" #include "pcache.h" +#include "pcompiler.h" #include "plibs.h" +#include "pmemlock.h" #include "prand.h" #include "psettings.h" +#include "pssl.h" #include "psslcerts.h" #include "psynclib.h" -#include "plibs.h" -#include "pmemlock.h" -#include "pssl.h" -#include "psynclib.h" -#include -#include -#include -static pthread_mutex_t rsa_decr_mutex = PTHREAD_MUTEX_INITIALIZER; +static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER; static void ssl_debug(int loglevel, int errnum, const char *msg) { char ebuf[100]; @@ -71,22 +68,22 @@ static void ssl_debug(int loglevel, int errnum, const char *msg) { debug(loglevel, "%s: %s (-0x%04x)", msg, ebuf, (unsigned int)-errnum); } -static void psync_ssl_free_psync_encrypted_data_t(psync_encrypted_data_t e) { - psync_ssl_memclean(e->data, e->datalen); +static void free_encrypted(psync_encrypted_data_t e) { + pssl_memclean(e->data, e->datalen); pmemlock_free(e); } -void psync_ssl_rsa_free_binary(psync_binary_rsa_key_t bin) { - psync_ssl_free_psync_encrypted_data_t(bin); +void prsa_free_binary(psync_binary_rsa_key_t bin) { + free_encrypted(bin); } -void psync_ssl_free_symmetric_key(psync_symmetric_key_t key) { - psync_ssl_memclean(key->key, key->keylen); +void psymkey_free(psync_symmetric_key_t key) { + pssl_memclean(key->key, key->keylen); pmemlock_free(key); } psync_encrypted_symmetric_key_t -psync_ssl_alloc_encrypted_symmetric_key(size_t len) { +psymkey_alloc_encrypted(size_t len) { psync_encrypted_symmetric_key_t ret; ret = psync_malloc(offsetof(psync_encrypted_data_struct_t, data) + len); ret->datalen = len; @@ -94,7 +91,7 @@ psync_ssl_alloc_encrypted_symmetric_key(size_t len) { } psync_encrypted_symmetric_key_t -psync_ssl_copy_encrypted_symmetric_key(psync_encrypted_symmetric_key_t src) { +psymkey_copy_encrypted(psync_encrypted_symmetric_key_t src) { psync_encrypted_symmetric_key_t ret; ret = psync_malloc(offsetof(psync_encrypted_data_struct_t, data) + src->datalen); @@ -103,28 +100,23 @@ psync_ssl_copy_encrypted_symmetric_key(psync_encrypted_symmetric_key_t src) { return ret; } -psync_symmetric_key_t psync_ssl_rsa_decrypt_symm_key_lock( +psync_symmetric_key_t prsa_decrypt_symm_key_lock( psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey) { psync_symmetric_key_t sym_key; debug(D_NOTICE, "Get RSA decrypt key lock."); - pthread_mutex_lock(&rsa_decr_mutex); + pthread_mutex_lock(&mutex); - sym_key = psync_ssl_rsa_decrypt_symmetric_key(*rsa, *enckey); + sym_key = psymkey_decrypt(*rsa, *enckey); - pthread_mutex_unlock(&rsa_decr_mutex); + pthread_mutex_unlock(&mutex); debug(D_NOTICE, "RSA decrypt key Lock released."); return sym_key; } -#if defined(PSYNC_AES_HW_MSC) -#include -#include -#endif - -static const int psync_mbed_ciphersuite[] = { +static const int ciphersuites[] = { MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, @@ -142,7 +134,7 @@ static const int psync_mbed_ciphersuite[] = { typedef struct { mbedtls_ctr_drbg_context rnd; pthread_mutex_t mutex; -} ctr_drbg_context_locked; +} rng_ctx; typedef struct { mbedtls_net_context srv; @@ -153,81 +145,57 @@ typedef struct { char cachekey[]; } ssl_connection_t; -static ctr_drbg_context_locked psync_mbed_rng; -static mbedtls_entropy_context psync_mbed_entropy; -static mbedtls_x509_crt psync_mbed_trusted_certs_x509; +static rng_ctx rng; +static mbedtls_entropy_context entropy; +static mbedtls_x509_crt ca_chain; PSYNC_THREAD int psync_ssl_errno; -#if defined(PSYNC_AES_HW) -int psync_ssl_hw_aes; -#endif - -static psync_ssl_debug_callback_t debug_cb = NULL; +static pssl_debug_callback_t debug_cb = NULL; static void *debug_ctx = NULL; void pssl_log_threshold(int threshold) { mbedtls_debug_set_threshold(threshold); } -void pssl_debug_cb(psync_ssl_debug_callback_t cb, void *ctx) { +void pssl_debug_cb(pssl_debug_callback_t cb, void *ctx) { debug_cb = cb; debug_ctx = ctx; } int rng_get(void *p_rng, unsigned char *output, size_t output_len) { - ctr_drbg_context_locked *rng; + rng_ctx *rng; int ret; - rng = (ctr_drbg_context_locked *)p_rng; + rng = (rng_ctx *)p_rng; pthread_mutex_lock(&rng->mutex); ret = mbedtls_ctr_drbg_random(&rng->rnd, output, output_len); pthread_mutex_unlock(&rng->mutex); return ret; } - -#if defined(PSYNC_AES_HW_GCC) -static int detect_aes_hw() { - uint32_t eax, ecx; - eax = 1; - __asm__("cpuid" : "=c"(ecx) : "a"(eax) : "%ebx", "%edx"); - ecx = (ecx >> 25) & 1; - if (ecx) - debug(D_NOTICE, "hardware AES support detected"); - else - debug(D_NOTICE, "hardware AES support not detected"); - return ecx; -} -#endif - -int psync_ssl_init() { +int pssl_init() { unsigned char seed[PSYNC_LHASH_DIGEST_LEN]; unsigned long i; int result; -#if defined(PSYNC_AES_HW) - psync_ssl_hw_aes = detect_aes_hw(); -#else - debug(D_NOTICE, "hardware AES is not supported for this compiler"); -#endif - if (pthread_mutex_init(&psync_mbed_rng.mutex, NULL)) + if (pthread_mutex_init(&rng.mutex, NULL)) return PRINT_RETURN(-1); - mbedtls_entropy_init(&psync_mbed_entropy); + mbedtls_entropy_init(&entropy); prand_seed(seed, seed, sizeof(seed), 0); - mbedtls_entropy_update_manual(&psync_mbed_entropy, seed, sizeof(seed)); + mbedtls_entropy_update_manual(&entropy, seed, sizeof(seed)); - mbedtls_ctr_drbg_init(&psync_mbed_rng.rnd); - if ((result = mbedtls_ctr_drbg_seed(&psync_mbed_rng.rnd, mbedtls_entropy_func, - &psync_mbed_entropy, NULL, 0))) { + mbedtls_ctr_drbg_init(&rng.rnd); + if ((result = mbedtls_ctr_drbg_seed(&rng.rnd, mbedtls_entropy_func, + &entropy, NULL, 0))) { debug(D_ERROR, "mbedtls_ctr_drbg_seed failed with return code %d", result); return PRINT_RETURN(-1); } - mbedtls_x509_crt_init(&psync_mbed_trusted_certs_x509); + mbedtls_x509_crt_init(&ca_chain); for (i = 0; i < ARRAY_SIZE(psync_ssl_trusted_certs); i++) { - result = mbedtls_x509_crt_parse(&psync_mbed_trusted_certs_x509, + result = mbedtls_x509_crt_parse(&ca_chain, (unsigned char *)psync_ssl_trusted_certs[i], 1 + strlen(psync_ssl_trusted_certs[i])); if (result) { @@ -239,13 +207,13 @@ int psync_ssl_init() { return 0; } -void psync_ssl_memclean(void *ptr, size_t len) { +void pssl_memclean(void *ptr, size_t len) { volatile unsigned char *p = ptr; while (len--) *p++ = 0; } -static ssl_connection_t *psync_ssl_alloc_conn(const char *hostname) { +static ssl_connection_t *conn_alloc(const char *hostname) { ssl_connection_t *conn; size_t len; len = strlen(hostname) + 1; @@ -324,7 +292,7 @@ static void save_session(ssl_connection_t *conn) { free_session, PSYNC_MAX_SSL_SESSIONS_PER_DOMAIN); } -static int chcek_peer_pubkey(ssl_connection_t *conn) { +static int check_peer_pubkey(ssl_connection_t *conn) { const mbedtls_x509_crt *cert; unsigned char buff[1024], sigbin[32]; char sighex[66]; @@ -359,13 +327,13 @@ static int chcek_peer_pubkey(ssl_connection_t *conn) { return -1; } -int psync_ssl_connect(int sock, void **sslconn, +int pssl_connect(int sock, void **sslconn, const char *hostname) { ssl_connection_t *conn; mbedtls_ssl_session *sess; int ret; - conn = psync_ssl_alloc_conn(hostname); + conn = conn_alloc(hostname); mbedtls_ssl_init(&conn->ssl); mbedtls_ssl_config_init(&conn->cfg); mbedtls_net_init(&conn->srv); @@ -387,9 +355,9 @@ int psync_ssl_connect(int sock, void **sslconn, mbedtls_ssl_conf_endpoint(&conn->cfg, MBEDTLS_SSL_IS_CLIENT); mbedtls_ssl_conf_dbg(&conn->cfg, debug_cb, debug_ctx); mbedtls_ssl_conf_authmode(&conn->cfg, MBEDTLS_SSL_VERIFY_REQUIRED); - mbedtls_ssl_conf_ca_chain(&conn->cfg, &psync_mbed_trusted_certs_x509, NULL); - mbedtls_ssl_conf_ciphersuites(&conn->cfg, psync_mbed_ciphersuite); - mbedtls_ssl_conf_rng(&conn->cfg, rng_get, &psync_mbed_rng); + mbedtls_ssl_conf_ca_chain(&conn->cfg, &ca_chain, NULL); + mbedtls_ssl_conf_ciphersuites(&conn->cfg, ciphersuites); + mbedtls_ssl_conf_rng(&conn->cfg, rng_get, &rng); mbedtls_ssl_set_bio(&conn->ssl, &conn->srv, mbed_write, mbed_read, NULL); mbedtls_ssl_set_hostname(&conn->ssl, hostname); @@ -407,7 +375,7 @@ int psync_ssl_connect(int sock, void **sslconn, ret = mbedtls_ssl_handshake(&conn->ssl); if (ret == 0) { - if ((chcek_peer_pubkey(conn))) { + if ((check_peer_pubkey(conn))) { goto err1; } *sslconn = conn; @@ -428,14 +396,14 @@ err0: return PRINT_RETURN_CONST(PSYNC_SSL_FAIL); } -int psync_ssl_connect_finish(void *sslconn, const char *hostname) { +int pssl_connect_finish(void *sslconn, const char *hostname) { ssl_connection_t *conn; int ret; conn = (ssl_connection_t *)sslconn; ret = mbedtls_ssl_handshake(&conn->ssl); if (ret == 0) { - if ((chcek_peer_pubkey(conn))) { + if ((check_peer_pubkey(conn))) { goto fail; } save_session(conn); @@ -453,7 +421,7 @@ fail: return PRINT_RETURN_CONST(PSYNC_SSL_FAIL); } -int psync_ssl_shutdown(void *sslconn) { +int pssl_shutdown(void *sslconn) { ssl_connection_t *conn; int ret; conn = (ssl_connection_t *)sslconn; @@ -472,18 +440,18 @@ noshutdown: return PSYNC_SSL_SUCCESS; } -void psync_ssl_free(void *sslconn) { +void pssl_free(void *sslconn) { ssl_connection_t *conn; conn = (ssl_connection_t *)sslconn; mbedtls_ssl_free(&conn->ssl); psync_free(conn); } -int psync_ssl_pendingdata(void *sslconn) { +int pssl_pendingdata(void *sslconn) { return mbedtls_ssl_get_bytes_avail(&((ssl_connection_t *)sslconn)->ssl); } -int psync_ssl_read(void *sslconn, void *buf, int num) { +int pssl_read(void *sslconn, void *buf, int num) { ssl_connection_t *conn; int res; conn = (ssl_connection_t *)sslconn; @@ -494,7 +462,7 @@ int psync_ssl_read(void *sslconn, void *buf, int num) { return PSYNC_SSL_FAIL; } -int psync_ssl_write(void *sslconn, const void *buf, int num) { +int pssl_write(void *sslconn, const void *buf, int num) { ssl_connection_t *conn; int res; conn = (ssl_connection_t *)sslconn; @@ -505,21 +473,21 @@ int psync_ssl_write(void *sslconn, const void *buf, int num) { return PSYNC_SSL_FAIL; } -void psync_ssl_rand_strong(unsigned char *buf, int num) { +void pssl_rand_strong(unsigned char *buf, int num) { // FIXME: causing segfault - if (unlikely(rng_get(&psync_mbed_rng, buf, num))) { + if (unlikely(rng_get(&rng, buf, num))) { debug(D_CRITICAL, "could not generate %d random bytes, exiting", num); abort(); } } -psync_rsa_t psync_ssl_gen_rsa(int bits) { +psync_rsa_t pssl_gen_rsa(int bits) { mbedtls_rsa_context *ctx; ctx = psync_new(mbedtls_rsa_context); mbedtls_rsa_init(ctx); mbedtls_rsa_set_padding(ctx, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); - if (mbedtls_rsa_gen_key(ctx, rng_get, &psync_mbed_rng, bits, + if (mbedtls_rsa_gen_key(ctx, rng_get, &rng, bits, 65537)) { mbedtls_rsa_free(ctx); psync_free(ctx); @@ -528,27 +496,27 @@ psync_rsa_t psync_ssl_gen_rsa(int bits) { return ctx; } -void psync_ssl_free_rsa(psync_rsa_t rsa) { +void pssl_free_rsa(psync_rsa_t rsa) { mbedtls_rsa_free(rsa); psync_free(rsa); } -psync_rsa_publickey_t psync_ssl_rsa_get_public(psync_rsa_t rsa) { +psync_rsa_publickey_t prsa_get_public(psync_rsa_t rsa) { psync_binary_rsa_key_t bin; psync_rsa_publickey_t ret; - bin = psync_ssl_rsa_public_to_binary(rsa); + bin = prsa_public_to_binary(rsa); if (bin == PSYNC_INVALID_BIN_RSA) return PSYNC_INVALID_RSA; - ret = psync_ssl_rsa_binary_to_public(bin); - psync_ssl_rsa_free_binary(bin); + ret = prsa_binary_to_public(bin); + prsa_free_binary(bin); return ret; } -void psync_ssl_rsa_free_public(psync_rsa_publickey_t key) { - psync_ssl_free_rsa(key); +void prsa_free_public(psync_rsa_publickey_t key) { + pssl_free_rsa(key); } -psync_rsa_privatekey_t psync_ssl_rsa_get_private(psync_rsa_t rsa) { +psync_rsa_privatekey_t prsa_get_private(psync_rsa_t rsa) { mbedtls_rsa_context *ctx; ctx = psync_new(mbedtls_rsa_context); mbedtls_rsa_init(ctx); @@ -562,12 +530,12 @@ psync_rsa_privatekey_t psync_ssl_rsa_get_private(psync_rsa_t rsa) { return ctx; } -void psync_ssl_rsa_free_private(psync_rsa_privatekey_t key) { - psync_ssl_free_rsa(key); +void prsa_free_private(psync_rsa_privatekey_t key) { + pssl_free_rsa(key); } psync_binary_rsa_key_t -psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa) { +prsa_public_to_binary(psync_rsa_publickey_t rsa) { unsigned char buff[4096], *p; mbedtls_pk_context ctx; psync_binary_rsa_key_t ret; @@ -589,7 +557,7 @@ psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa) { } psync_binary_rsa_key_t -psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa) { +prsa_private_to_binary(psync_rsa_privatekey_t rsa) { unsigned char buff[4096]; mbedtls_pk_context ctx; psync_binary_rsa_key_t ret; @@ -606,11 +574,11 @@ psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa) { pmemlock_malloc(offsetof(psync_encrypted_data_struct_t, data) + len); ret->datalen = len; memcpy(ret->data, buff + sizeof(buff) - len, len); - psync_ssl_memclean(buff + sizeof(buff) - len, len); + pssl_memclean(buff + sizeof(buff) - len, len); return ret; } -psync_rsa_publickey_t psync_ssl_rsa_load_public(const unsigned char *keydata, +psync_rsa_publickey_t prsa_load_public(const unsigned char *keydata, size_t keylen) { mbedtls_pk_context ctx; mbedtls_rsa_context *rsa; @@ -666,7 +634,7 @@ static unsigned char* trim_der_key(const unsigned char *keydata, size_t *keylen) return trimmed; } -psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata, size_t keylen) { +psync_rsa_privatekey_t prsa_load_private(const unsigned char *keydata, size_t keylen) { mbedtls_pk_context ctx; mbedtls_rsa_context *rsa; int ret; @@ -674,7 +642,7 @@ psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata, trim_der_key(keydata, &keylen); mbedtls_pk_init(&ctx); - ret = mbedtls_pk_parse_key(&ctx, keydata, keylen, NULL, 0, rng_get, &psync_mbed_rng); + ret = mbedtls_pk_parse_key(&ctx, keydata, keylen, NULL, 0, rng_get, &rng); if(unlikely(ret)) { ssl_debug(D_WARNING, ret, "pk_parse_key failed"); return PSYNC_INVALID_RSA; @@ -696,17 +664,17 @@ psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata, } psync_rsa_publickey_t -psync_ssl_rsa_binary_to_public(psync_binary_rsa_key_t bin) { - return psync_ssl_rsa_load_public(bin->data, bin->datalen); +prsa_binary_to_public(psync_binary_rsa_key_t bin) { + return prsa_load_public(bin->data, bin->datalen); } psync_rsa_privatekey_t -psync_ssl_rsa_binary_to_private(psync_binary_rsa_key_t bin) { - return psync_ssl_rsa_load_private(bin->data, bin->datalen); +prsa_binary_to_private(psync_binary_rsa_key_t bin) { + return prsa_load_private(bin->data, bin->datalen); } psync_symmetric_key_t -psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen, +psymkey_generate(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations) { psync_symmetric_key_t key = (psync_symmetric_key_t)pmemlock_malloc( @@ -724,7 +692,7 @@ psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen, return key; } -char *psync_ssl_derive_password_from_passphrase(const char *username, +char *psymkey_derive(const char *username, const char *passphrase) { unsigned char *usercopy; unsigned char usersha512[PSYNC_SHA512_DIGEST_LEN], passwordbin[32]; @@ -751,7 +719,7 @@ char *psync_ssl_derive_password_from_passphrase(const char *username, } psync_encrypted_symmetric_key_t -psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, +prsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen) { psync_encrypted_symmetric_key_t ret; int code; @@ -760,7 +728,7 @@ psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, ret = (psync_encrypted_symmetric_key_t)psync_malloc( offsetof(psync_encrypted_data_struct_t, data) + rsalen); if ((code = mbedtls_rsa_rsaes_oaep_encrypt( - rsa, rng_get, &psync_mbed_rng, + rsa, rng_get, &rng, NULL, 0, datalen, data, ret->data))) { psync_free(ret); debug( @@ -774,37 +742,37 @@ psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, return ret; } -psync_symmetric_key_t psync_ssl_rsa_decrypt_data(psync_rsa_privatekey_t rsa, +psync_symmetric_key_t prsa_decrypt_data(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen) { unsigned char buff[2048]; psync_symmetric_key_t ret; size_t len; if (mbedtls_rsa_rsaes_oaep_decrypt(rsa, rng_get, - &psync_mbed_rng, NULL, + &rng, NULL, 0, &len, data, buff, sizeof(buff))) return PSYNC_INVALID_SYM_KEY; ret = (psync_symmetric_key_t)pmemlock_malloc( offsetof(psync_symmetric_key_struct_t, key) + len); ret->keylen = len; memcpy(ret->key, buff, len); - psync_ssl_memclean(buff, len); + pssl_memclean(buff, len); return ret; } psync_encrypted_symmetric_key_t -psync_ssl_rsa_encrypt_symmetric_key(psync_rsa_publickey_t rsa, +psymkey_encrypt(psync_rsa_publickey_t rsa, const psync_symmetric_key_t key) { - return psync_ssl_rsa_encrypt_data(rsa, key->key, key->keylen); + return prsa_encrypt_data(rsa, key->key, key->keylen); } -psync_symmetric_key_t psync_ssl_rsa_decrypt_symmetric_key( +psync_symmetric_key_t psymkey_decrypt( psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey) { - return psync_ssl_rsa_decrypt_data(rsa, enckey->data, enckey->datalen); + return prsa_decrypt_data(rsa, enckey->data, enckey->datalen); } psync_aes256_encoder -psync_ssl_aes256_create_encoder(psync_symmetric_key_t key) { +paes_create_encoder(psync_symmetric_key_t key) { mbedtls_aes_context *aes; assert(key->keylen >= PSYNC_AES256_KEY_SIZE); aes = psync_new(mbedtls_aes_context); @@ -812,13 +780,13 @@ psync_ssl_aes256_create_encoder(psync_symmetric_key_t key) { return aes; } -void psync_ssl_aes256_free_encoder(psync_aes256_encoder aes) { - psync_ssl_memclean(aes, sizeof(mbedtls_aes_context)); +void paes_free_encoder(psync_aes256_encoder aes) { + pssl_memclean(aes, sizeof(mbedtls_aes_context)); psync_free(aes); } psync_aes256_encoder -psync_ssl_aes256_create_decoder(psync_symmetric_key_t key) { +paes_create_decoder(psync_symmetric_key_t key) { mbedtls_aes_context *aes; assert(key->keylen >= PSYNC_AES256_KEY_SIZE); aes = psync_new(mbedtls_aes_context); @@ -826,13 +794,13 @@ psync_ssl_aes256_create_decoder(psync_symmetric_key_t key) { return aes; } -void psync_ssl_aes256_free_decoder(psync_aes256_encoder aes) { - psync_ssl_memclean(aes, sizeof(mbedtls_aes_context)); +void paes_free_decoder(psync_aes256_encoder aes) { + pssl_memclean(aes, sizeof(mbedtls_aes_context)); psync_free(aes); } psync_rsa_signature_t -psync_ssl_rsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, +prsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, const unsigned char *data) { psync_rsa_signature_t ret; int padding, hash_id; @@ -846,7 +814,7 @@ psync_ssl_rsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, padding = mbedtls_rsa_get_padding_mode(rsa); hash_id = mbedtls_rsa_get_md_alg(rsa); mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA256); - if (mbedtls_rsa_rsassa_pss_sign(rsa, rng_get, &psync_mbed_rng, + if (mbedtls_rsa_rsassa_pss_sign(rsa, rng_get, &rng, MBEDTLS_MD_SHA256, PSYNC_SHA256_DIGEST_LEN, data, ret->data)) { free(ret); diff --git a/pclsync/pssl.h b/pclsync/pssl.h index 14b50c8..0e7921d 100644 --- a/pclsync/pssl.h +++ b/pclsync/pssl.h @@ -86,60 +86,38 @@ typedef mbedtls_aes_context *psync_aes256_encoder; typedef mbedtls_aes_context *psync_aes256_decoder; // ctx, level, message, ???, ??? -typedef void (*psync_ssl_debug_callback_t)(void *, int, const char *, int, +typedef void (*pssl_debug_callback_t)(void *, int, const char *, int, const char *); void pssl_log_threshold(int threshold); -void pssl_debug_cb(psync_ssl_debug_callback_t cb, void *ctx); +void pssl_debug_cb(pssl_debug_callback_t cb, void *ctx); -#if defined(__GNUC__) && \ - (defined(__amd64__) || defined(__x86_64__) || defined(__i386__)) -#define PSYNC_AES_HW -#define PSYNC_AES_HW_GCC -#endif - -static inline void psync_aes256_encode_block(psync_aes256_encoder enc, - const unsigned char *src, - unsigned char *dst) { +static inline void psync_aes256_encode_block(psync_aes256_encoder enc, const unsigned char *src, unsigned char *dst) { mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst); } -static inline void psync_aes256_decode_block(psync_aes256_decoder enc, - const unsigned char *src, - unsigned char *dst) { +static inline void psync_aes256_decode_block(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) { mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); } -static inline void psync_aes256_encode_2blocks_consec(psync_aes256_decoder enc, - const unsigned char *src, - unsigned char *dst) { +static inline void psync_aes256_encode_2blocks_consec(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) { mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst); - mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE, dst + PSYNC_AES256_BLOCK_SIZE); } -static inline void psync_aes256_decode_2blocks_consec(psync_aes256_decoder enc, - const unsigned char *src, - unsigned char *dst) { +static inline void psync_aes256_decode_2blocks_consec(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) { mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); - mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, dst + PSYNC_AES256_BLOCK_SIZE); } -static inline void psync_aes256_decode_4blocks_consec_xor( - psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, - unsigned char *bxor) { +static inline void psync_aes256_decode_4blocks_consec_xor(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, unsigned char *bxor) { unsigned long i; mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); - mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); - mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, - src + PSYNC_AES256_BLOCK_SIZE * 2, - dst + PSYNC_AES256_BLOCK_SIZE * 2); - mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, - src + PSYNC_AES256_BLOCK_SIZE * 3, - dst + PSYNC_AES256_BLOCK_SIZE * 3); - for (i = 0; i < PSYNC_AES256_BLOCK_SIZE * 4 / sizeof(unsigned long); i++) + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 2, dst + PSYNC_AES256_BLOCK_SIZE * 2); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 3, dst + PSYNC_AES256_BLOCK_SIZE * 3); + for (i = 0; i < PSYNC_AES256_BLOCK_SIZE * 4 / sizeof(unsigned long); i++) { ((unsigned long *)dst)[i] ^= ((unsigned long *)bxor)[i]; + } } @@ -166,52 +144,47 @@ typedef psync_encrypted_data_t psync_rsa_signature_t; #define PSYNC_INVALID_ENCODER NULL #define PSYNC_INVALID_BIN_RSA NULL -#define psync_ssl_alloc_binary_rsa psync_ssl_alloc_encrypted_symmetric_key +#define pssl_alloc_binary_rsa psymkey_alloc_encrypted // Lock used to serialize access to RSA decrypt key function -int psync_ssl_init(); -void psync_ssl_memclean(void *ptr, size_t len); -int psync_ssl_connect(int sock, void **sslconn, - const char *hostname); -int psync_ssl_connect_finish(void *sslconn, const char *hostname); -void psync_ssl_free(void *sslconn); -int psync_ssl_shutdown(void *sslconn); -int psync_ssl_pendingdata(void *sslconn); -int psync_ssl_read(void *sslconn, void *buf, int num); -int psync_ssl_write(void *sslconn, const void *buf, int num); - -void psync_ssl_rand_strong(unsigned char *buf, int num); - -psync_rsa_t psync_ssl_gen_rsa(int bits); -void psync_ssl_free_rsa(psync_rsa_t rsa); -psync_rsa_publickey_t psync_ssl_rsa_get_public(psync_rsa_t rsa); -void psync_ssl_rsa_free_public(psync_rsa_publickey_t key); -psync_rsa_privatekey_t psync_ssl_rsa_get_private(psync_rsa_t rsa); -void psync_ssl_rsa_free_private(psync_rsa_privatekey_t key); -psync_binary_rsa_key_t psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa); -psync_binary_rsa_key_t psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa); -psync_rsa_publickey_t psync_ssl_rsa_load_public(const unsigned char *keydata, - size_t keylen); -psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata, - size_t keylen); -psync_rsa_publickey_t psync_ssl_rsa_binary_to_public(psync_binary_rsa_key_t bin); -psync_rsa_privatekey_t psync_ssl_rsa_binary_to_private(psync_binary_rsa_key_t bin); -void psync_ssl_rsa_free_binary(psync_binary_rsa_key_t bin); -psync_symmetric_key_t psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations); -char *psync_ssl_derive_password_from_passphrase(const char *username, const char *passphrase); -psync_encrypted_symmetric_key_t psync_ssl_alloc_encrypted_symmetric_key(size_t len); -psync_encrypted_symmetric_key_t psync_ssl_copy_encrypted_symmetric_key(psync_encrypted_symmetric_key_t src); -void psync_ssl_free_symmetric_key(psync_symmetric_key_t key); -psync_encrypted_symmetric_key_t psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen); -psync_symmetric_key_t psync_ssl_rsa_decrypt_data(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen); -psync_encrypted_symmetric_key_t psync_ssl_rsa_encrypt_symmetric_key(psync_rsa_publickey_t rsa, const psync_symmetric_key_t key); -psync_symmetric_key_t psync_ssl_rsa_decrypt_symmetric_key(psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey); -psync_aes256_encoder psync_ssl_aes256_create_encoder(psync_symmetric_key_t key); -void psync_ssl_aes256_free_encoder(psync_aes256_encoder aes); -psync_aes256_encoder psync_ssl_aes256_create_decoder(psync_symmetric_key_t key); -void psync_ssl_aes256_free_decoder(psync_aes256_encoder aes); -psync_rsa_signature_t psync_ssl_rsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, const unsigned char *data); -psync_symmetric_key_t psync_ssl_rsa_decrypt_symm_key_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey); +int pssl_init(); +void pssl_memclean(void *ptr, size_t len); +int pssl_connect(int sock, void **sslconn, const char *hostname); +int pssl_connect_finish(void *sslconn, const char *hostname); +void pssl_free(void *sslconn); +int pssl_shutdown(void *sslconn); +int pssl_pendingdata(void *sslconn); +int pssl_read(void *sslconn, void *buf, int num); +int pssl_write(void *sslconn, const void *buf, int num); +void pssl_rand_strong(unsigned char *buf, int num); +psync_rsa_t pssl_gen_rsa(int bits); +void pssl_free_rsa(psync_rsa_t rsa); +psync_rsa_publickey_t prsa_get_public(psync_rsa_t rsa); +void prsa_free_public(psync_rsa_publickey_t key); +psync_rsa_privatekey_t prsa_get_private(psync_rsa_t rsa); +void prsa_free_private(psync_rsa_privatekey_t key); +psync_binary_rsa_key_t prsa_public_to_binary(psync_rsa_publickey_t rsa); +psync_binary_rsa_key_t prsa_private_to_binary(psync_rsa_privatekey_t rsa); +psync_rsa_publickey_t prsa_load_public(const unsigned char *keydata, size_t keylen); +psync_rsa_privatekey_t prsa_load_private(const unsigned char *keydata, size_t keylen); +psync_rsa_publickey_t prsa_binary_to_public(psync_binary_rsa_key_t bin); +psync_rsa_privatekey_t prsa_binary_to_private(psync_binary_rsa_key_t bin); +void prsa_free_binary(psync_binary_rsa_key_t bin); +psync_symmetric_key_t psymkey_generate(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations); +char *psymkey_derive(const char *username, const char *passphrase); +psync_encrypted_symmetric_key_t psymkey_alloc_encrypted(size_t len); +psync_encrypted_symmetric_key_t psymkey_copy_encrypted(psync_encrypted_symmetric_key_t src); +void psymkey_free(psync_symmetric_key_t key); +psync_encrypted_symmetric_key_t prsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen); +psync_symmetric_key_t prsa_decrypt_data(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen); +psync_encrypted_symmetric_key_t psymkey_encrypt(psync_rsa_publickey_t rsa, const psync_symmetric_key_t key); +psync_symmetric_key_t psymkey_decrypt(psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey); +psync_aes256_encoder paes_create_encoder(psync_symmetric_key_t key); +void paes_free_encoder(psync_aes256_encoder aes); +psync_aes256_encoder paes_create_decoder(psync_symmetric_key_t key); +void paes_free_decoder(psync_aes256_encoder aes); +psync_rsa_signature_t prsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, const unsigned char *data); +psync_symmetric_key_t prsa_decrypt_symm_key_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey); #endif diff --git a/pclsync/psynclib.c b/pclsync/psynclib.c index 6523d49..e0aee03 100644 --- a/pclsync/psynclib.c +++ b/pclsync/psynclib.c @@ -228,7 +228,7 @@ static void ssl_debug_cb(void *ctx, int level, const char *msg, int TODO1, TODO1); // trying to figure out what these are... } -void psync_set_ssl_debug_callback(psync_ssl_debug_callback_t cb) { +void psync_set_ssl_debug_callback(pssl_debug_callback_t cb) { pssl_log_threshold(PSYNC_SSL_DEBUG_LEVEL); pssl_debug_cb(cb, NULL); } @@ -278,7 +278,7 @@ int psync_init() { } psync_sql_statement("UPDATE task SET inprogress=0 WHERE inprogress=1"); ptimer_init(); - if (unlikely_log(psync_ssl_init())) { + if (unlikely_log(pssl_init())) { if (IS_DEBUG) pthread_mutex_unlock(&psync_libstate_mutex); return_error(PERROR_SSL_INIT_FAILED); @@ -2177,7 +2177,7 @@ int psync_password_quality10000(const char *password) { char *psync_derive_password_from_passphrase(const char *username, const char *passphrase) { - return psync_ssl_derive_password_from_passphrase(username, passphrase); + return psymkey_derive(username, passphrase); } int psync_crypto_setup(const char *password, const char *hint) {