lkn
/
pcloudcc-lneely
mirror of https://github.com/lneely/pcloudcc-lneely.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pssl namespace decomposition, remove compat junk (#121)

This commit is contained in:
Levi Neely 2025-03-09 16:39:30 +01:00 committed by GitHub
parent f266351e55
commit 8db64e8a4a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
11 changed files with 327 additions and 386 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
pclsync/pcrypto.c
View File

@ -68,7 +68,7 @@ static void psync_hmac_sha512_init(psync_hmac_sha512_ctx *ctx,
}
psync_sha512_init(&ctx->sha1ctx);
psync_sha512_update(&ctx->sha1ctx, keyxor, PSYNC_SHA512_BLOCK_LEN);
psync_ssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN);
pssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN);
}
static void psync_hmac_sha512_update(psync_hmac_sha512_ctx *ctx,
@ -81,7 +81,7 @@ static void psync_hmac_sha512_final(unsigned char *result,
psync_sha512_final(ctx->final + PSYNC_SHA512_BLOCK_LEN, &ctx->sha1ctx);
psync_sha512(ctx->final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN,
result);
psync_ssl_memclean(ctx->final,
pssl_memclean(ctx->final,
PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN);
}
@ -107,8 +107,8 @@ static void psync_hmac_sha512(const unsigned char *msg, size_t msglen,
psync_sha512_update(&sha1ctx, msg, msglen);
psync_sha512_final(final + PSYNC_SHA512_BLOCK_LEN, &sha1ctx);
psync_sha512(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN, result);
psync_ssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN);
psync_ssl_memclean(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN);
pssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN);
pssl_memclean(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN);
}
#define ALIGN_A256_BS(n) \
@ -165,7 +165,7 @@ psync_symmetric_key_t pcrypto_key_len(size_t len) {
key = (psync_symmetric_key_t)pmemlock_malloc(
offsetof(psync_symmetric_key_struct_t, key) + len);
key->keylen = len;
psync_ssl_rand_strong(key->key, len);
pssl_rand_strong(key->key, len);
return key;
}
@ -180,7 +180,7 @@ pcrypto_ctr_encdec_t pcrypto_ctr_encdec_create(psync_symmetric_key_t key) {
if (unlikely_log(key->keylen < PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE)) {
return PSYNC_CRYPTO_INVALID_ENCODER;
}
enc = psync_ssl_aes256_create_encoder(key);
enc = paes_create_encoder(key);
if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) {
return PSYNC_CRYPTO_INVALID_ENCODER;
}
@ -192,8 +192,8 @@ pcrypto_ctr_encdec_t pcrypto_ctr_encdec_create(psync_symmetric_key_t key) {
void pcrypto_ctr_encdec_free(
pcrypto_ctr_encdec_t enc) {
psync_ssl_aes256_free_encoder(enc->encoder);
psync_ssl_memclean(enc->iv, PSYNC_AES256_BLOCK_SIZE);
paes_free_encoder(enc->encoder);
pssl_memclean(enc->iv, PSYNC_AES256_BLOCK_SIZE);
psync_free(enc);
}
@ -404,7 +404,7 @@ pcrypto_textenc_create(psync_symmetric_key_t key) {
if (unlikely_log(key->keylen <
PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE))
return PSYNC_CRYPTO_INVALID_ENCODER;
enc = psync_ssl_aes256_create_encoder(key);
enc = paes_create_encoder(key);
if (unlikely_log(enc == PSYNC_INVALID_ENCODER))
return PSYNC_CRYPTO_INVALID_ENCODER;
ret = (pcrypto_textenc_t)pmemlock_malloc(
@ -418,8 +418,8 @@ pcrypto_textenc_create(psync_symmetric_key_t key) {
void pcrypto_textenc_free(
pcrypto_textenc_t enc) {
psync_ssl_aes256_free_encoder(enc->encoder);
psync_ssl_memclean(enc->iv, enc->ivlen);
paes_free_encoder(enc->encoder);
pssl_memclean(enc->iv, enc->ivlen);
pmemlock_free(enc);
}
@ -430,7 +430,7 @@ pcrypto_textdec_create(psync_symmetric_key_t key) {
if (unlikely_log(key->keylen <
PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE))
return PSYNC_CRYPTO_INVALID_ENCODER;
enc = psync_ssl_aes256_create_decoder(key);
enc = paes_create_decoder(key);
if (unlikely_log(enc == PSYNC_INVALID_ENCODER))
return PSYNC_CRYPTO_INVALID_ENCODER;
ret = (pcrypto_textenc_t)pmemlock_malloc(
@ -444,8 +444,8 @@ pcrypto_textdec_create(psync_symmetric_key_t key) {
void pcrypto_textdec_free(
pcrypto_textdec_t enc) {
psync_ssl_aes256_free_encoder(enc->encoder);
psync_ssl_memclean(enc->iv, enc->ivlen);
paes_free_encoder(enc->encoder);
pssl_memclean(enc->iv, enc->ivlen);
pmemlock_free(enc);
}
@ -456,12 +456,12 @@ pcrypto_sec_encdec_create(psync_symmetric_key_t key) {
pcrypto_sector_encdec_t ret;
if (unlikely_log(key->keylen < PSYNC_AES256_KEY_SIZE))
return PSYNC_CRYPTO_INVALID_ENCODER;
enc = psync_ssl_aes256_create_encoder(key);
enc = paes_create_encoder(key);
if (unlikely_log(enc == PSYNC_INVALID_ENCODER))
return PSYNC_CRYPTO_INVALID_ENCODER;
dec = psync_ssl_aes256_create_decoder(key);
dec = paes_create_decoder(key);
if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) {
psync_ssl_aes256_free_encoder(enc);
paes_free_encoder(enc);
return PSYNC_CRYPTO_INVALID_ENCODER;
}
ret = (pcrypto_sector_encdec_t)pmemlock_malloc(
@ -476,9 +476,9 @@ pcrypto_sec_encdec_create(psync_symmetric_key_t key) {
void pcrypto_sec_encdec_free(
pcrypto_sector_encdec_t enc) {
psync_ssl_aes256_free_encoder(enc->encoder);
psync_ssl_aes256_free_decoder(enc->decoder);
psync_ssl_memclean(enc->iv, enc->ivlen);
paes_free_encoder(enc->encoder);
paes_free_decoder(enc->decoder);
pssl_memclean(enc->iv, enc->ivlen);
pmemlock_free(enc);
}
@ -504,7 +504,7 @@ void pcrypto_encode_sec(
aessrc = ALIGN_PTR_A256_BS(buff);
aesdst = aessrc + PSYNC_AES256_BLOCK_SIZE;
assert(PSYNC_CRYPTO_AUTH_SIZE == 2 * PSYNC_AES256_BLOCK_SIZE);
psync_ssl_rand_strong(rnd, PSYNC_AES256_BLOCK_SIZE);
pssl_rand_strong(rnd, PSYNC_AES256_BLOCK_SIZE);
psync_hmac_sha512_init(&ctx, enc->iv, enc->ivlen);
psync_hmac_sha512_update(&ctx, data, datalen);
psync_hmac_sha512_update(&ctx, &sectorid, sizeof(sectorid));

198
pclsync/pcryptofolder.c
View File

@ -378,51 +378,51 @@ int pcryptofolder_setup(const char *password, const char *hint) {
time_t cryptoexpires;
int ret;
debug(D_NOTICE, "generating salt");
psync_ssl_rand_strong(salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
pssl_rand_strong(salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
debug(D_NOTICE, "generating AES key from password and setting up encoder");
aeskey = psync_ssl_gen_symmetric_key_from_pass(
aeskey = psymkey_generate(
password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt,
PSYNC_CRYPTO_PBKDF2_SALT_LEN, PSYNC_CRYPTO_PASS_TO_KEY_ITERATIONS);
enc = pcrypto_ctr_encdec_create(aeskey);
psync_ssl_free_symmetric_key(aeskey);
psymkey_free(aeskey);
if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER)) {
debug(D_WARNING, "psync_crypto_aes256_ctr_encoder_decoder_create failed");
return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
}
debug(D_NOTICE, "generating %d bit RSA key", (int)PSYNC_CRYPTO_RSA_SIZE);
rsa = psync_ssl_gen_rsa(PSYNC_CRYPTO_RSA_SIZE);
rsa = pssl_gen_rsa(PSYNC_CRYPTO_RSA_SIZE);
if (unlikely(rsa == PSYNC_INVALID_RSA)) {
debug(D_WARNING, "RSA key generation failed");
pcrypto_ctr_encdec_free(enc);
return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
} else
debug(D_NOTICE, "RSA key generated");
rsaprivate = psync_ssl_rsa_get_private(rsa);
rsapublic = psync_ssl_rsa_get_public(rsa);
psync_ssl_free_rsa(rsa);
rsaprivate = prsa_get_private(rsa);
rsapublic = prsa_get_public(rsa);
pssl_free_rsa(rsa);
if (unlikely(rsaprivate == PSYNC_INVALID_RSA ||
rsapublic == PSYNC_INVALID_RSA)) {
debug(D_WARNING,
"psync_ssl_rsa_get_private or psync_ssl_rsa_get_public failed");
if (rsaprivate != PSYNC_INVALID_RSA)
psync_ssl_rsa_free_private(rsaprivate);
prsa_free_private(rsaprivate);
if (rsapublic != PSYNC_INVALID_RSA)
psync_ssl_rsa_free_public(rsapublic);
prsa_free_public(rsapublic);
pcrypto_ctr_encdec_free(enc);
return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
}
rsaprivatebin = psync_ssl_rsa_private_to_binary(rsaprivate);
rsapublicbin = psync_ssl_rsa_public_to_binary(rsapublic);
psync_ssl_rsa_free_private(rsaprivate);
psync_ssl_rsa_free_public(rsapublic);
rsaprivatebin = prsa_private_to_binary(rsaprivate);
rsapublicbin = prsa_public_to_binary(rsapublic);
prsa_free_private(rsaprivate);
prsa_free_public(rsapublic);
if (unlikely(rsaprivatebin == PSYNC_INVALID_BIN_RSA ||
rsapublic == PSYNC_INVALID_BIN_RSA)) {
debug(D_WARNING, "psync_ssl_rsa_private_to_binary or "
"psync_ssl_rsa_public_to_binary failed");
if (rsaprivatebin != PSYNC_INVALID_BIN_RSA)
psync_ssl_rsa_free_binary(rsaprivatebin);
prsa_free_binary(rsaprivatebin);
if (rsapublicbin != PSYNC_INVALID_BIN_RSA)
psync_ssl_rsa_free_binary(rsapublicbin);
prsa_free_binary(rsapublicbin);
pcrypto_ctr_encdec_free(enc);
return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
}
@ -437,8 +437,8 @@ int pcryptofolder_setup(const char *password, const char *hint) {
privatesha1);
if (unlikely(ret != PSYNC_CRYPTO_SETUP_SUCCESS)) {
debug(D_WARNING, "keys upload failed with error %d", ret);
psync_ssl_rsa_free_binary(rsaprivatebin);
psync_ssl_rsa_free_binary(rsapublicbin);
prsa_free_binary(rsaprivatebin);
prsa_free_binary(rsapublicbin);
return ret;
}
debug(D_NOTICE, "keys uploaded");
@ -447,8 +447,8 @@ int pcryptofolder_setup(const char *password, const char *hint) {
rsapublicbin->datalen, salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN,
PSYNC_CRYPTO_PASS_TO_KEY_ITERATIONS, cryptoexpires, publicsha1,
privatesha1, 0);
psync_ssl_rsa_free_binary(rsaprivatebin);
psync_ssl_rsa_free_binary(rsapublicbin);
prsa_free_binary(rsaprivatebin);
prsa_free_binary(rsapublicbin);
return PSYNC_CRYPTO_SETUP_SUCCESS;
}
@ -501,14 +501,14 @@ static int crypto_keys_match() {
key = (psync_symmetric_key_t)psync_malloc(
offsetof(psync_symmetric_key_struct_t, key) + 64);
key->keylen = 64;
psync_ssl_rand_strong(key->key, key->keylen);
enckey = psync_ssl_rsa_encrypt_symmetric_key(crypto_pubkey, key);
pssl_rand_strong(key->key, key->keylen);
enckey = psymkey_encrypt(crypto_pubkey, key);
if (enckey == PSYNC_INVALID_ENC_SYM_KEY) {
psync_free(key);
return 0;
}
deckey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &enckey);
deckey = prsa_decrypt_symm_key_lock(&crypto_privkey, &enckey);
psync_free(enckey);
if (deckey == PSYNC_INVALID_SYM_KEY) {
@ -517,7 +517,7 @@ static int crypto_keys_match() {
}
res = key->keylen == deckey->keylen &&
!memcmp(key->key, deckey->key, key->keylen);
psync_ssl_free_symmetric_key(deckey);
psymkey_free(deckey);
psync_free(key);
if (res)
debug(D_NOTICE, "encrypt/decrypt operation succeeded");
@ -606,7 +606,7 @@ int pcryptofolder_unlock(const char *password) {
}
debug(D_NOTICE, "trying to load public key");
crypto_pubkey = psync_ssl_rsa_load_public(rsapub, rsapublen);
crypto_pubkey = prsa_load_public(rsapub, rsapublen);
if (crypto_pubkey == PSYNC_INVALID_RSA) {
pthread_rwlock_unlock(&crypto_lock);
debug(D_WARNING, "could not load public key");
@ -618,9 +618,9 @@ int pcryptofolder_unlock(const char *password) {
debug(D_NOTICE, "successfully loaded public key");
debug(D_NOTICE, "generating symmetric key");
aeskey = psync_ssl_gen_symmetric_key_from_pass(password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt, saltlen, iterations);
aeskey = psymkey_generate(password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt, saltlen, iterations);
enc = pcrypto_ctr_encdec_create(aeskey);
psync_ssl_free_symmetric_key(aeskey);
psymkey_free(aeskey);
rsaprivdec = (unsigned char *)pmemlock_malloc(rsaprivlen);
memcpy(rsaprivdec, rsapriv, rsaprivlen);
pcrypto_ctr_encdec_decode(enc, rsaprivdec, rsaprivlen, 0);
@ -629,12 +629,12 @@ int pcryptofolder_unlock(const char *password) {
debug(D_NOTICE, "trying to load private key");
crypto_privkey = psync_ssl_rsa_load_private(rsaprivdec, rsaprivlen);
psync_ssl_memclean(rsaprivdec, rsaprivlen);
crypto_privkey = prsa_load_private(rsaprivdec, rsaprivlen);
pssl_memclean(rsaprivdec, rsaprivlen);
pmemlock_free(rsaprivdec);
if (crypto_privkey == PSYNC_INVALID_RSA) {
debug(D_NOTICE, "failed to load private key");
psync_ssl_rsa_free_public(crypto_pubkey);
prsa_free_public(crypto_pubkey);
crypto_pubkey = PSYNC_INVALID_RSA;
pthread_rwlock_unlock(&crypto_lock);
psync_free(rsapriv);
@ -646,9 +646,9 @@ int pcryptofolder_unlock(const char *password) {
debug(D_NOTICE, "verify matching public and private key");
if (!crypto_keys_match()) {
psync_ssl_rsa_free_public(crypto_pubkey);
prsa_free_public(crypto_pubkey);
crypto_pubkey = PSYNC_INVALID_RSA;
psync_ssl_rsa_free_private(crypto_privkey);
prsa_free_private(crypto_privkey);
crypto_privkey = PSYNC_INVALID_RSA;
pthread_rwlock_unlock(&crypto_lock);
debug(D_ERROR, "keys don't match");
@ -694,9 +694,9 @@ int pcryptofolder_lock() {
return PRINT_RETURN_CONST(PSYNC_CRYPTO_STOP_NOT_STARTED);
}
crypto_started_l = 0;
psync_ssl_rsa_free_public(crypto_pubkey);
prsa_free_public(crypto_pubkey);
crypto_pubkey = PSYNC_INVALID_RSA;
psync_ssl_rsa_free_private(crypto_privkey);
prsa_free_private(crypto_privkey);
crypto_privkey = PSYNC_INVALID_RSA;
pthread_rwlock_unlock(&crypto_lock);
debug(D_NOTICE, "stopped crypto");
@ -781,7 +781,7 @@ static void save_folder_key(psync_folderid_t folderid,
// will deadlock
insert_folder_key_task *t;
t = psync_new(insert_folder_key_task);
t->key = psync_ssl_copy_encrypted_symmetric_key(enckey);
t->key = psymkey_copy_encrypted(enckey);
t->id = folderid;
prun_thread1("save folder key to db task", ptask_cfldr_save_fldrkey, t);
}
@ -790,7 +790,7 @@ static void save_file_key_to_db(psync_fileid_t fileid, uint64_t hash,
psync_encrypted_symmetric_key_t enckey) {
insert_file_key_task *t;
t = psync_new(insert_file_key_task);
t->key = psync_ssl_copy_encrypted_symmetric_key(enckey);
t->key = psymkey_copy_encrypted(enckey);
t->id = fileid;
t->hash = hash;
prun_thread1("save file key to db task", ptask_cfldr_save_filekey, t);
@ -843,7 +843,7 @@ static psync_encrypted_symmetric_key_t download_fldr_enckey(psync_folderid_t fol
if (!key)
return (psync_encrypted_symmetric_key_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
ret = psync_ssl_alloc_encrypted_symmetric_key(keylen);
ret = psymkey_alloc_encrypted(keylen);
memcpy(ret->data, key, keylen);
psync_free(key);
save_folder_key(folderid, ret);
@ -896,7 +896,7 @@ static psync_encrypted_symmetric_key_t download_file_enckey(psync_fileid_t filei
if (!key)
return (psync_encrypted_symmetric_key_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
ret = psync_ssl_alloc_encrypted_symmetric_key(keylen);
ret = psymkey_alloc_encrypted(keylen);
memcpy(ret->data, key, keylen);
psync_free(key);
save_file_key_to_db(fileid, result, ret);
@ -914,7 +914,7 @@ static psync_encrypted_symmetric_key_t get_fldr_enckey(psync_folderid_t folderid
psync_sql_bind_uint(res, 1, folderid);
if ((row = psync_sql_fetch_row(res))) {
ckey = psync_get_lstring(row[0], &ckeylen);
enckey = psync_ssl_alloc_encrypted_symmetric_key(ckeylen);
enckey = psymkey_alloc_encrypted(ckeylen);
memcpy(enckey->data, ckey, ckeylen);
psync_sql_free_result(res);
return enckey;
@ -936,7 +936,7 @@ static psync_encrypted_symmetric_key_t get_file_enckey(psync_fileid_t fileid, ui
psync_sql_bind_uint(res, 2, hash);
if ((row = psync_sql_fetch_row(res))) {
ckey = psync_get_lstring(row[0], &ckeylen);
enckey = psync_ssl_alloc_encrypted_symmetric_key(ckeylen);
enckey = psymkey_alloc_encrypted(ckeylen);
memcpy(enckey->data, ckey, ckeylen);
psync_sql_free_result(res);
return enckey;
@ -963,7 +963,7 @@ static psync_symmetric_key_t get_fldr_symkey_safe(psync_folderid_t folderid) {
if (is_err(enckey))
return (psync_symmetric_key_t)enckey;
symkey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &enckey);
symkey = prsa_decrypt_symm_key_lock(&crypto_privkey, &enckey);
psync_free(enckey);
if (symkey == PSYNC_INVALID_SYM_KEY)
@ -991,7 +991,7 @@ static psync_symmetric_key_t get_file_symkey_safe(psync_fileid_t fileid, uint64_
(psync_encrypted_symmetric_key_t)PSYNC_CRYPTO_UNLOADED_SECTOR_ENCODER)
return (psync_symmetric_key_t)PSYNC_CRYPTO_UNLOADED_SECTOR_ENCODER;
symkey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &enckey);
symkey = prsa_decrypt_symm_key_lock(&crypto_privkey, &enckey);
psync_free(enckey);
if (unlikely_log(symkey == PSYNC_INVALID_SYM_KEY))
@ -1001,7 +1001,7 @@ static psync_symmetric_key_t get_file_symkey_safe(psync_fileid_t fileid, uint64_
}
static void free_symkey(void *ptr) {
psync_ssl_free_symmetric_key((psync_symmetric_key_t)ptr);
psymkey_free((psync_symmetric_key_t)ptr);
}
static void
@ -1058,12 +1058,12 @@ static pcrypto_textenc_t get_fldr_encoder(psync_folderid_t folderid) {
realkey = symkeyv1_to_symkey(skv1);
psync_crypto_release_folder_symkey_locked(folderid, symkey);
enc = pcrypto_textenc_create(realkey);
psync_ssl_free_symmetric_key(realkey);
psymkey_free(realkey);
return enc;
default:
debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
def1:
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
return (pcrypto_textenc_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
}
@ -1098,12 +1098,12 @@ static pcrypto_textdec_t get_fldrdecoder_safe(psync_folderid_t folderid) {
realkey = symkeyv1_to_symkey(skv1);
psync_crypto_release_folder_symkey_locked(folderid, symkey);
dec = pcrypto_textdec_create(realkey);
psync_ssl_free_symmetric_key(realkey);
psymkey_free(realkey);
return dec;
default:
debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
def1:
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
return (pcrypto_textdec_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
}
@ -1131,7 +1131,7 @@ static pcrypto_textenc_t get_tmp_fldrencoder_safe(psync_fsfolderid_t folderid) {
enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen);
psync_sql_free_result(res);
if (enckey) {
symkey = psync_ssl_rsa_decrypt_data(crypto_privkey, enckey, enckeylen);
symkey = prsa_decrypt_data(crypto_privkey, enckey, enckeylen);
psync_free(enckey);
} else
symkey = PSYNC_INVALID_SYM_KEY;
@ -1152,14 +1152,14 @@ static pcrypto_textenc_t get_tmp_fldrencoder_safe(psync_fsfolderid_t folderid) {
goto def1;
}
realkey = symkeyv1_to_symkey(skv1);
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
enc = pcrypto_textenc_create(realkey);
psync_ssl_free_symmetric_key(realkey);
psymkey_free(realkey);
return enc;
default:
debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
def1:
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
return (pcrypto_textenc_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
}
@ -1187,7 +1187,7 @@ static pcrypto_textdec_t get_tmp_fldrdecoder_safe(psync_fsfolderid_t folderid) {
enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen);
psync_sql_free_result(res);
if (enckey) {
symkey = psync_ssl_rsa_decrypt_data(crypto_privkey, enckey, enckeylen);
symkey = prsa_decrypt_data(crypto_privkey, enckey, enckeylen);
psync_free(enckey);
if (symkey == PSYNC_INVALID_SYM_KEY)
@ -1213,14 +1213,14 @@ static pcrypto_textdec_t get_tmp_fldrdecoder_safe(psync_fsfolderid_t folderid) {
goto def1;
}
realkey = symkeyv1_to_symkey(skv1);
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
dec = pcrypto_textdec_create(realkey);
psync_ssl_free_symmetric_key(realkey);
psymkey_free(realkey);
return dec;
default:
debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
def1:
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
return (pcrypto_textdec_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
}
@ -1378,12 +1378,12 @@ static pcrypto_sector_encdec_t get_fileencoder(psync_fileid_t fileid, uint64_t h
realkey = symkeyv1_to_symkey(skv1);
psync_crypto_release_file_symkey_locked(fileid, hash, symkey);
enc = pcrypto_sec_encdec_create(realkey);
psync_ssl_free_symmetric_key(realkey);
psymkey_free(realkey);
return enc;
default:
debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
def1:
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
return (pcrypto_sector_encdec_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
}
@ -1416,7 +1416,7 @@ static pcrypto_sector_encdec_t get_fileencoder_tmp(psync_fsfileid_t fileid,
enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen);
psync_sql_free_result(res);
if (enckey) {
symkey = psync_ssl_rsa_decrypt_data(crypto_privkey, enckey, enckeylen);
symkey = prsa_decrypt_data(crypto_privkey, enckey, enckeylen);
psync_free(enckey);
} else
@ -1434,14 +1434,14 @@ static pcrypto_sector_encdec_t get_fileencoder_tmp(psync_fsfileid_t fileid,
goto def1;
}
realkey = symkeyv1_to_symkey(skv1);
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
enc = pcrypto_sec_encdec_create(realkey);
psync_ssl_free_symmetric_key(realkey);
psymkey_free(realkey);
return enc;
default:
debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
def1:
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
return (pcrypto_sector_encdec_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
}
@ -1501,7 +1501,7 @@ pcrypto_sector_encdec_t pcryptofolder_filencoder_from_binresult(psync_fileid_t f
if (!key)
return (pcrypto_sector_encdec_t)errptr(
PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
esym = psync_ssl_alloc_encrypted_symmetric_key(keylen);
esym = psymkey_alloc_encrypted(keylen);
memcpy(esym->data, key, keylen);
psync_free(key);
hash = papi_find_result2(res, "hash", PARAM_NUM)->num;
@ -1514,7 +1514,7 @@ pcrypto_sector_encdec_t pcryptofolder_filencoder_from_binresult(psync_fileid_t f
// save_file_key_to_db runs thread to save to db, that's why we insert
// decrypted key to cache, so get_fileencoder finds
// it
symkey = psync_ssl_rsa_decrypt_symm_key_lock(&crypto_privkey, &esym);
symkey = prsa_decrypt_symm_key_lock(&crypto_privkey, &esym);
psync_crypto_release_file_symkey_locked(fileid, hash, symkey);
enc = get_fileencoder(fileid, hash, 0);
@ -1686,21 +1686,21 @@ char *pcryptofolder_filencoder_key_new(uint32_t flags, size_t *keylen) {
return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC;
sym.flags = flags;
psync_ssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
psync_ssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
pthread_rwlock_rdlock(&crypto_lock);
if (!crypto_started_l) {
pthread_rwlock_unlock(&crypto_lock);
return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
}
encsym = psync_ssl_rsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym,
encsym = prsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym,
sizeof(sym));
pthread_rwlock_unlock(&crypto_lock);
if (encsym == PSYNC_INVALID_ENC_SYM_KEY) {
debug(D_ERROR, "RSA encryption failed");
return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_RSA_ERROR));
}
psync_ssl_memclean(&sym, sizeof(sym));
pssl_memclean(&sym, sizeof(sym));
ret = (char *)psync_base64_encode(encsym->data, encsym->datalen, keylen);
psync_free(encsym);
return ret;
@ -1715,14 +1715,14 @@ char *pcryptofolder_filencoder_key_newplain(
return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC;
sym.flags = flags;
psync_ssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
psync_ssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
pthread_rwlock_rdlock(&crypto_lock);
if (!crypto_started_l) {
pthread_rwlock_unlock(&crypto_lock);
return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
}
encsym = psync_ssl_rsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym,
encsym = prsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym,
sizeof(sym));
pthread_rwlock_unlock(&crypto_lock);
if (encsym == PSYNC_INVALID_ENC_SYM_KEY) {
@ -1730,7 +1730,7 @@ char *pcryptofolder_filencoder_key_newplain(
return (char *)errptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_RSA_ERROR));
}
*deckey = symkeyv1_to_symkey(&sym);
psync_ssl_memclean(&sym, sizeof(sym));
pssl_memclean(&sym, sizeof(sym));
ret = (char *)psync_base64_encode(encsym->data, encsym->datalen, keylen);
psync_free(encsym);
return ret;
@ -1749,16 +1749,16 @@ int pcryptofolder_mkdir(psync_folderid_t folderid, const char *name,
ename = NULL;
sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC;
sym.flags = PSYNC_CRYPTO_SYM_FLAG_ISDIR;
psync_ssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
psync_ssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
pthread_rwlock_rdlock(&crypto_lock);
if (!crypto_started_l) {
pthread_rwlock_unlock(&crypto_lock);
return set_err(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED), err);
}
encsym = psync_ssl_rsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym,
encsym = prsa_encrypt_data(crypto_pubkey, (unsigned char *)&sym,
sizeof(sym));
psync_ssl_memclean(&sym, sizeof(sym));
pssl_memclean(&sym, sizeof(sym));
ret = get_fldr_name(folderid, name, &ename, err);
pthread_rwlock_unlock(&crypto_lock);
if (ret) {
@ -1797,7 +1797,7 @@ int psync_pcloud_crypto_reencode_key(
case PSYNC_CRYPTO_PUB_TYPE_RSA4096:
if (offsetof(pub_key_ver1, key) >= rsapublen)
goto err_bk_0;
pub = psync_ssl_rsa_load_public(rsapub + offsetof(pub_key_ver1, key),
pub = prsa_load_public(rsapub + offsetof(pub_key_ver1, key),
rsapublen - offsetof(pub_key_ver1, key));
if (pub == PSYNC_INVALID_RSA)
goto err_bk_0;
@ -1817,14 +1817,14 @@ int psync_pcloud_crypto_reencode_key(
if (offsetof(priv_key_ver1, key) >= rsaprivlen)
goto err_bk_1;
rsapriv_struct = (priv_key_ver1 *)rsapriv;
aeskey = psync_ssl_gen_symmetric_key_from_pass(
aeskey = psymkey_generate(
oldpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE,
rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000);
if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY))
goto err_nm_1;
rsaprivlen -= offsetof(priv_key_ver1, key);
enc = pcrypto_ctr_encdec_create(aeskey);
psync_ssl_free_symmetric_key(aeskey);
psymkey_free(aeskey);
if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER))
goto err_nm_1;
rsaprivdec = (unsigned char *)psync_malloc(rsaprivlen);
@ -1843,15 +1843,15 @@ int psync_pcloud_crypto_reencode_key(
rsapriv_struct = (priv_key_ver1 *)newpriv;
rsapriv_struct->type = PSYNC_CRYPTO_TYPE_RSA4096_64BYTESALT_20000IT;
rsapriv_struct->flags = flags;
psync_ssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
aeskey = psync_ssl_gen_symmetric_key_from_pass(
pssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
aeskey = psymkey_generate(
newpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE,
rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000);
if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY))
goto err_nm_1;
// rsaprivlen-=offsetof(priv_key_ver1, key);
enc = pcrypto_ctr_encdec_create(aeskey);
psync_ssl_free_symmetric_key(aeskey);
psymkey_free(aeskey);
if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER))
goto err_nm_1;
memcpy(rsapriv_struct->key, rsaprivdec, rsaprivlen);
@ -1859,8 +1859,8 @@ int psync_pcloud_crypto_reencode_key(
rsaprivlen, 0);
pcrypto_ctr_encdec_free(enc);
newprivlen = offsetof(priv_key_ver1, key) + rsaprivlen;
priv = psync_ssl_rsa_load_private(rsaprivdec, rsaprivlen);
psync_ssl_memclean(rsaprivdec, rsaprivlen);
priv = prsa_load_private(rsaprivdec, rsaprivlen);
pssl_memclean(rsaprivdec, rsaprivlen);
psync_free(rsaprivdec);
if (unlikely(priv == PSYNC_INVALID_RSA))
goto err_ph_1;
@ -1873,19 +1873,19 @@ int psync_pcloud_crypto_reencode_key(
if (!crypto_keys_match(pub, priv))
goto err_ph_2;
psync_sha256(newpriv, newprivlen, newprivsha);
rsasign = psync_ssl_rsa_sign_sha256_hash(priv, newprivsha);
rsasign = prsa_sign_sha256_hash(priv, newprivsha);
if (is_err(rsasign)) {
psync_free(is_err);
psync_ssl_rsa_free_public(pub);
psync_ssl_rsa_free_private(priv);
prsa_free_public(pub);
prsa_free_private(priv);
return to_err(rsasign);
}
*privenc = (char *)psync_base64_encode(newpriv, newprivlen, &dummy);
*sign = (char *)psync_base64_encode(rsasign->data, rsasign->datalen, &dummy);
psync_free(rsasign);
psync_free(newpriv);
psync_ssl_rsa_free_public(pub);
psync_ssl_rsa_free_private(priv);
prsa_free_public(pub);
prsa_free_private(priv);
if (!*privenc || !*sign) {
psync_free(*privenc);
@ -1895,18 +1895,18 @@ int psync_pcloud_crypto_reencode_key(
return PSYNC_CRYPTO_SUCCESS;
err_bk_1:
psync_ssl_rsa_free_public(pub);
prsa_free_public(pub);
err_bk_0:
return PSYNC_CRYPTO_BAD_KEY;
err_nm_1:
psync_free(newpriv);
psync_ssl_rsa_free_public(pub);
prsa_free_public(pub);
return PERROR_NO_MEMORY;
err_ph_2:
psync_ssl_rsa_free_private(priv);
prsa_free_private(priv);
err_ph_1:
psync_free(newpriv);
psync_ssl_rsa_free_public(pub);
prsa_free_public(pub);
return PSYNC_CRYPTO_BAD_PASSPHRASE;
}
@ -1920,7 +1920,7 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
size_t rsaprivlen, dummy;
unsigned char newprivsha[PSYNC_SHA256_DIGEST_LEN];
psync_rsa_signature_t rsasign;
rsapriv = psync_ssl_rsa_private_to_binary(crypto_privkey);
rsapriv = prsa_private_to_binary(crypto_privkey);
if (rsapriv == PSYNC_INVALID_RSA)
goto err_nm_0;
rsaprivlen = rsapriv->datalen;
@ -1931,14 +1931,14 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
rsapriv_struct = (priv_key_ver1 *)newpriv;
rsapriv_struct->type = PSYNC_CRYPTO_TYPE_RSA4096_64BYTESALT_20000IT;
rsapriv_struct->flags = flags;
psync_ssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
aeskey = psync_ssl_gen_symmetric_key_from_pass(
pssl_rand_strong(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
aeskey = psymkey_generate(
newpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE,
rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000);
if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY))
goto err_nm_1;
enc = pcrypto_ctr_encdec_create(aeskey);
psync_ssl_free_symmetric_key(aeskey);
psymkey_free(aeskey);
if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER))
goto err_nm_1;
memcpy(rsapriv_struct->key, rsapriv->data, rsaprivlen);
@ -1948,17 +1948,17 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
rsaprivlen += offsetof(priv_key_ver1, key);
psync_sha256(newpriv, rsaprivlen, newprivsha);
rsasign = psync_ssl_rsa_sign_sha256_hash(crypto_privkey, newprivsha);
rsasign = prsa_sign_sha256_hash(crypto_privkey, newprivsha);
if (is_err(rsasign)) {
psync_free(newpriv);
psync_ssl_rsa_free_binary(rsapriv);
prsa_free_binary(rsapriv);
return to_err(rsasign);
}
*privenc = (char *)psync_base64_encode(newpriv, rsaprivlen, &dummy);
*sign = (char *)psync_base64_encode(rsasign->data, rsasign->datalen, &dummy);
psync_free(rsasign);
psync_free(newpriv);
psync_ssl_rsa_free_binary(rsapriv);
prsa_free_binary(rsapriv);
if (!*privenc || !*sign) {
psync_free(*privenc);
@ -1970,7 +1970,7 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
err_nm_1:
psync_free(newpriv);
psync_ssl_rsa_free_binary(rsapriv);
prsa_free_binary(rsapriv);
err_nm_0:
return PERROR_NO_MEMORY;
}

2
pclsync/pdiff.c
View File

@ -330,7 +330,7 @@ static psock_t *get_connected_socket() {
psync_sql_res *q;
unsigned char deviceidbin[16];
char deviceidhex[32 + 2];
psync_ssl_rand_strong(deviceidbin, sizeof(deviceidbin));
pssl_rand_strong(deviceidbin, sizeof(deviceidbin));
psync_binhex(deviceidhex, deviceidbin, sizeof(deviceidbin));
deviceidhex[sizeof(deviceidbin) * 2] = 0;
q = psync_sql_prep_statement(

8
pclsync/pfs.c
View File

@ -1468,7 +1468,7 @@ static int psync_fs_open(const char *path, struct fuse_file_info *fi) {
goto ex0;
}
encoder = pcrypto_sec_encdec_create(symkey);
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
if (unlikely_log(encoder == PSYNC_CRYPTO_INVALID_ENCODER)) {
psync_free(encsymkey);
ret = -ENOMEM;
@ -1639,7 +1639,7 @@ static int psync_fs_creat(const char *path, mode_t mode,
return -psync_fs_crypto_err_to_errno(psync_crypto_to_error(encsymkey));
}
encoder = pcrypto_sec_encdec_create(symkey);
psync_ssl_free_symmetric_key(symkey);
psymkey_free(symkey);
if (unlikely_log(encoder == PSYNC_CRYPTO_INVALID_ENCODER)) {
psync_fstask_release_folder_tasks_locked(folder);
psync_sql_unlock();
@ -3367,7 +3367,7 @@ void psync_fs_refresh_folder(psync_folderid_t folderid) {
pfolder_path_sep(folderid, "/", NULL);
if (path == PSYNC_INVALID_PATH)
return;
psync_ssl_rand_strong(rndbuff, sizeof(rndbuff));
pssl_rand_strong(rndbuff, sizeof(rndbuff));
psync_binhex(rndhex, rndbuff, sizeof(rndbuff));
rndhex[2 * sizeof(rndbuff)] = 0;
pthread_mutex_lock(&start_mutex);
@ -3565,7 +3565,7 @@ static void psync_fs_init_once() {
#if psync_fs_need_per_folder_refresh_const()
unsigned char rndbuff[16];
char rndhex[34];
psync_ssl_rand_strong(rndbuff, sizeof(rndbuff));
pssl_rand_strong(rndbuff, sizeof(rndbuff));
psync_binhex(rndhex, rndbuff, sizeof(rndbuff));
rndhex[2 * sizeof(rndbuff)] = 0;
psync_fake_prefix = psync_strcat(".refresh", rndhex, NULL);

40
pclsync/pp2p.c
View File

@ -221,7 +221,7 @@ static void psync_p2p_check(const packet_check *packet) {
else
return;
resp.port = tcpport;
psync_ssl_rand_strong(resp.rand, sizeof(resp.rand));
pssl_rand_strong(resp.rand, sizeof(resp.rand));
memcpy(hashsource, hashhex, PSYNC_HASH_DIGEST_HEXLEN);
memcpy(hashsource + PSYNC_HASH_DIGEST_HEXLEN, resp.rand, sizeof(resp.rand));
psync_hash(hashsource, PSYNC_HASH_BLOCK_SIZE, hashbin);
@ -346,7 +346,7 @@ static void psync_p2p_tcphandler(void *ptr) {
debug(D_WARNING, "got request for file that we do not have");
goto err0;
}
binpubrsa = psync_ssl_alloc_binary_rsa(packet.keylen);
binpubrsa = pssl_alloc_binary_rsa(packet.keylen);
if (unlikely_log(
socket_read_all(sock, binpubrsa->data, binpubrsa->datalen))) {
psync_free(binpubrsa);
@ -361,7 +361,7 @@ static void psync_p2p_tcphandler(void *ptr) {
goto err0;
}
psync_free(token);
pubrsa = psync_ssl_rsa_binary_to_public(binpubrsa);
pubrsa = prsa_binary_to_public(binpubrsa);
psync_free(binpubrsa);
if (unlikely_log(pubrsa == PSYNC_INVALID_RSA))
goto err0;
@ -377,9 +377,9 @@ static void psync_p2p_tcphandler(void *ptr) {
goto err0;
}
aeskey = pcrypto_key();
encaeskey = psync_ssl_rsa_encrypt_symmetric_key(pubrsa, aeskey);
encaeskey = psymkey_encrypt(pubrsa, aeskey);
encoder = pcrypto_ctr_encdec_create(aeskey);
psync_ssl_free_symmetric_key(aeskey);
psymkey_free(aeskey);
keylen = encaeskey->datalen;
enctype = P2P_ENCTYPE_RSA_AES;
if (unlikely_log(encaeskey == PSYNC_INVALID_ENC_SYM_KEY) ||
@ -550,7 +550,7 @@ static void psync_p2p_wake() {
void pp2p_init() {
unsigned char computerbin[PSYNC_HASH_DIGEST_LEN];
psync_ssl_rand_strong(computerbin, PSYNC_HASH_DIGEST_LEN);
pssl_rand_strong(computerbin, PSYNC_HASH_DIGEST_LEN);
psync_binhex(computername, computerbin, PSYNC_HASH_DIGEST_LEN);
ptimer_exception_handler(psync_p2p_wake);
if (!psync_setting_get_bool(_PS(p2psync)))
@ -574,17 +574,17 @@ static int psync_p2p_check_rsa() {
psync_rsa_publickey_t rsapub;
psync_binary_rsa_key_t rsapubbin;
debug(D_NOTICE, "generating %ubit RSA key", PSYNC_P2P_RSA_SIZE);
rsa = psync_ssl_gen_rsa(PSYNC_P2P_RSA_SIZE);
rsa = pssl_gen_rsa(PSYNC_P2P_RSA_SIZE);
debug(D_NOTICE, "key generated");
if (unlikely_log(rsa == PSYNC_INVALID_RSA))
goto rete;
rsapriv = psync_ssl_rsa_get_private(rsa);
rsapub = psync_ssl_rsa_get_public(rsa);
rsapriv = prsa_get_private(rsa);
rsapub = prsa_get_public(rsa);
if (likely_log(rsapub != PSYNC_INVALID_RSA))
rsapubbin = psync_ssl_rsa_public_to_binary(rsapub);
rsapubbin = prsa_public_to_binary(rsapub);
else
rsapubbin = PSYNC_INVALID_BIN_RSA;
psync_ssl_free_rsa(rsa);
pssl_free_rsa(rsa);
if (likely_log(rsapriv != PSYNC_INVALID_RSA &&
rsapub != PSYNC_INVALID_RSA &&
rsapubbin != PSYNC_INVALID_BIN_RSA)) {
@ -594,11 +594,11 @@ static int psync_p2p_check_rsa() {
goto ret0;
} else {
if (rsapriv != PSYNC_INVALID_RSA)
psync_ssl_rsa_free_private(rsapriv);
prsa_free_private(rsapriv);
if (rsapub != PSYNC_INVALID_RSA)
psync_ssl_rsa_free_public(rsapub);
prsa_free_public(rsapub);
if (rsapubbin != PSYNC_INVALID_BIN_RSA)
psync_ssl_rsa_free_binary(rsapubbin);
prsa_free_binary(rsapubbin);
goto rete;
}
}
@ -672,18 +672,18 @@ static int psync_p2p_download(int sock, psync_fileid_t fileid,
debug(D_ERROR, "too long key - %u bytes", (unsigned)keylen);
return PSYNC_NET_PERMFAIL;
}
ekey = psync_ssl_alloc_encrypted_symmetric_key(keylen);
ekey = psymkey_alloc_encrypted(keylen);
if (unlikely_log(socket_read_all(sock, ekey->data, keylen)) ||
unlikely_log((key = psync_ssl_rsa_decrypt_symm_key_lock(
unlikely_log((key = prsa_decrypt_symm_key_lock(
&privkey, &ekey)) == PSYNC_INVALID_SYM_KEY)) {
// unlikely_log((key=psync_ssl_rsa_decrypt_symmetric_key(&psync_rsa_private,
// unlikely_log((key=psymkey_decrypt(&psync_rsa_private,
// &ekey))==PSYNC_INVALID_SYM_KEY)){
psync_free(ekey);
return PSYNC_NET_TEMPFAIL;
}
psync_free(ekey);
decoder = pcrypto_ctr_encdec_create(key);
psync_ssl_free_symmetric_key(key);
psymkey_free(key);
if (decoder == PSYNC_CRYPTO_INVALID_ENCODER)
return PSYNC_NET_PERMFAIL;
fd = pfile_open(filename, O_WRONLY, O_CREAT | O_TRUNC);
@ -754,7 +754,7 @@ int pp2p_check_download(psync_fileid_t fileid,
pct1.type = P2P_CHECK;
memcpy(pct1.hashstart, filehashhex, PSYNC_P2P_HEXHASH_BYTES);
pct1.filesize = fsize;
psync_ssl_rand_strong(pct1.rand, sizeof(pct1.rand));
pssl_rand_strong(pct1.rand, sizeof(pct1.rand));
memcpy(hashsource, filehashhex, PSYNC_HASH_DIGEST_HEXLEN);
memcpy(hashsource + PSYNC_HASH_DIGEST_HEXLEN, pct1.rand, sizeof(pct1.rand));
psync_hash(hashsource, PSYNC_HASH_BLOCK_SIZE, hashbin);
@ -841,7 +841,7 @@ int pp2p_check_download(psync_fileid_t fileid,
goto err_perm2;
else if (bresp == P2P_RESP_WAIT) {
uint32_t rnd;
psync_ssl_rand_strong((unsigned char *)&rnd, sizeof(rnd));
pssl_rand_strong((unsigned char *)&rnd, sizeof(rnd));
rnd &= 0x7ff;
psys_sleep_milliseconds(PSYNC_P2P_SLEEP_WAIT_DOWNLOAD + rnd);
goto err_temp2;

4
pclsync/ppassword.c
View File

@ -351,8 +351,8 @@ uint64_t ppassword_score(const char *cpassword) {
ldpwd[nlen] = lpwd[nlen];
}
num = score_variants(password, lpwd, ldpwd, plen);
psync_ssl_memclean(lpwd, plen);
psync_ssl_memclean(ldpwd, plen);
pssl_memclean(lpwd, plen);
pssl_memclean(ldpwd, plen);
psync_free(lpwd);
psync_free(ldpwd);
mul_score(num);

4
pclsync/ppathstatus.c
View File

@ -216,7 +216,7 @@ void ppathstatus_reload_syncs() {
void ppathstatus_clear_cache() {
uint64_t ndrv_hash_seed, nsync_hash_seed;
do {
psync_ssl_rand_strong((unsigned char *)&ndrv_hash_seed,
pssl_rand_strong((unsigned char *)&ndrv_hash_seed,
sizeof(ndrv_hash_seed));
} while (unlikely(!ndrv_hash_seed));
nsync_hash_seed = 0x49916a8e891d1dafULL * ndrv_hash_seed;
@ -229,7 +229,7 @@ void ppathstatus_clear_cache() {
void ppathstatus_clear_sync_cache() {
uint64_t nsync_hash_seed;
do {
psync_ssl_rand_strong((unsigned char *)&nsync_hash_seed,
pssl_rand_strong((unsigned char *)&nsync_hash_seed,
sizeof(nsync_hash_seed));
} while (unlikely(nsync_hash_seed == drv_hash_seed));
psync_sql_lock();

44
pclsync/psock.c
View File

@ -384,7 +384,7 @@ int psock_try_write_buffer(psock_t *sock) {
continue;
}
if (sock->ssl) {
cw = psync_ssl_write(sock->ssl, b->buff + b->roffset,
cw = pssl_write(sock->ssl, b->buff + b->roffset,
b->woffset - b->roffset);
if (cw == PSYNC_SSL_FAIL) {
if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
@ -431,7 +431,7 @@ int psock_try_write_buffer_thread(psock_t *sock) {
int psock_readable(psock_t *sock) {
psock_try_write_buffer(sock);
if (sock->ssl && psync_ssl_pendingdata(sock->ssl))
if (sock->ssl && pssl_pendingdata(sock->ssl))
return 1;
else if (wait_readable(sock->sock, 0, 0))
return 0;
@ -466,13 +466,13 @@ psock_t *psock_connect(const char *host, int unsigned port, int ssl) {
}
if (ssl) {
ssl = psync_ssl_connect(sock, &sslc, host);
ssl = pssl_connect(sock, &sslc, host);
while (ssl == PSYNC_SSL_NEED_FINISH) {
if (wait_ssl_ready(sock)) {
psync_ssl_free(sslc);
pssl_free(sslc);
break;
}
ssl = psync_ssl_connect_finish(sslc, host);
ssl = pssl_connect_finish(sslc, host);
}
if (unlikely_log(ssl != PSYNC_SSL_SUCCESS)) {
close(sock);
@ -495,9 +495,9 @@ int psock_wait_write_timeout(int sock) {
void psock_close(psock_t *sock) {
if (sock->ssl)
while (psync_ssl_shutdown(sock->ssl) == PSYNC_SSL_NEED_FINISH)
while (pssl_shutdown(sock->ssl) == PSYNC_SSL_NEED_FINISH)
if (wait_ssl_ready(sock->sock)) {
psync_ssl_free(sock->ssl);
pssl_free(sock->ssl);
break;
}
psock_clear_write_buffered(sock);
@ -507,7 +507,7 @@ void psock_close(psock_t *sock) {
void psock_close_bad(psock_t *sock) {
if (sock->ssl)
psync_ssl_free(sock->ssl);
pssl_free(sock->ssl);
psock_clear_write_buffered(sock);
close(sock->sock);
psync_free(sock);
@ -576,7 +576,7 @@ int psock_pendingdata(psock_t *sock) {
if (sock->pending)
return 1;
if (sock->ssl)
return psync_ssl_pendingdata(sock->ssl);
return pssl_pendingdata(sock->ssl);
else
return 0;
}
@ -590,7 +590,7 @@ int psock_pendingdata_buf(psock_t *sock) {
return -1;
#endif
if (sock->ssl)
ret += psync_ssl_pendingdata(sock->ssl);
ret += pssl_pendingdata(sock->ssl);
return ret;
}
@ -605,13 +605,13 @@ int psock_pendingdata_buf_thread(psock_t *sock) {
static int psync_socket_read_ssl(psock_t *sock, void *buff, int num) {
int r;
psock_try_write_buffer(sock);
if (!psync_ssl_pendingdata(sock->ssl) && !sock->pending &&
if (!pssl_pendingdata(sock->ssl) && !sock->pending &&
psock_wait_read_timeout(sock->sock))
return -1;
sock->pending = 0;
while (1) {
psock_try_write_buffer(sock);
r = psync_ssl_read(sock->ssl, buff, num);
r = pssl_read(sock->ssl, buff, num);
if (r == PSYNC_SSL_FAIL) {
if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
psync_ssl_errno == PSYNC_SSL_ERR_WANT_WRITE)) {
@ -661,7 +661,7 @@ int psock_read(psock_t *sock, void *buff, int num) {
static int psync_socket_read_noblock_ssl(psock_t *sock, void *buff, int num) {
int r;
r = psync_ssl_read(sock->ssl, buff, num);
r = pssl_read(sock->ssl, buff, num);
if (r == PSYNC_SSL_FAIL) {
sock->pending = 0;
if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
@ -701,14 +701,14 @@ static int psync_socket_read_ssl_thread(psock_t *sock, void *buff, int num) {
pthread_mutex_lock(&mutex);
psock_try_write_buffer(sock);
pthread_mutex_unlock(&mutex);
if (!psync_ssl_pendingdata(sock->ssl) && !sock->pending &&
if (!pssl_pendingdata(sock->ssl) && !sock->pending &&
psock_wait_read_timeout(sock->sock))
return -1;
sock->pending = 0;
while (1) {
pthread_mutex_lock(&mutex);
psock_try_write_buffer(sock);
r = psync_ssl_read(sock->ssl, buff, num);
r = pssl_read(sock->ssl, buff, num);
pthread_mutex_unlock(&mutex);
if (r == PSYNC_SSL_FAIL) {
if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
@ -800,7 +800,7 @@ int psock_write(psock_t *sock, const void *buff, int num) {
if (psock_wait_write_timeout(sock->sock))
return -1;
if (sock->ssl) {
r = psync_ssl_write(sock->ssl, buff, num);
r = pssl_write(sock->ssl, buff, num);
if (r == PSYNC_SSL_FAIL) {
if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
psync_ssl_errno == PSYNC_SSL_ERR_WANT_WRITE))
@ -826,7 +826,7 @@ static int psync_socket_readall_ssl(psock_t *sock, void *buff, int num) {
psock_try_write_buffer(sock);
if (!psync_ssl_pendingdata(sock->ssl) && !sock->pending &&
if (!pssl_pendingdata(sock->ssl) && !sock->pending &&
psock_wait_read_timeout(sock->sock)) {
return -1;
}
@ -836,7 +836,7 @@ static int psync_socket_readall_ssl(psock_t *sock, void *buff, int num) {
while (br < num) {
psock_try_write_buffer(sock);
r = psync_ssl_read(sock->ssl, (char *)buff + br, num - br);
r = pssl_read(sock->ssl, (char *)buff + br, num - br);
if (r == PSYNC_SSL_FAIL) {
if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
@ -895,7 +895,7 @@ static int psync_socket_writeall_ssl(psock_t *sock, const void *buff, int num) {
int br, r;
br = 0;
while (br < num) {
r = psync_ssl_write(sock->ssl, (char *)buff + br, num - br);
r = pssl_write(sock->ssl, (char *)buff + br, num - br);
if (r == PSYNC_SSL_FAIL) {
if (psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
psync_ssl_errno == PSYNC_SSL_ERR_WANT_WRITE) {
@ -948,7 +948,7 @@ static int psync_socket_readall_ssl_thread(psock_t *sock, void *buff, int num) {
br = 0;
pthread_mutex_lock(&mutex);
psock_try_write_buffer(sock);
r = psync_ssl_pendingdata(sock->ssl);
r = pssl_pendingdata(sock->ssl);
pthread_mutex_unlock(&mutex);
if (!r && !sock->pending && psock_wait_read_timeout(sock->sock))
return -1;
@ -956,7 +956,7 @@ static int psync_socket_readall_ssl_thread(psock_t *sock, void *buff, int num) {
while (br < num) {
pthread_mutex_lock(&mutex);
psock_try_write_buffer(sock);
r = psync_ssl_read(sock->ssl, (char *)buff + br, num - br);
r = pssl_read(sock->ssl, (char *)buff + br, num - br);
pthread_mutex_unlock(&mutex);
if (r == PSYNC_SSL_FAIL) {
if (likely_log(psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||
@ -1022,7 +1022,7 @@ static int psync_socket_writeall_ssl_thread(psock_t *sock, const void *buff,
if (sock->buffer)
r = psync_socket_write_to_buf(sock, buff, num);
else
r = psync_ssl_write(sock->ssl, (char *)buff + br, num - br);
r = pssl_write(sock->ssl, (char *)buff + br, num - br);
pthread_mutex_unlock(&mutex);
if (r == PSYNC_SSL_FAIL) {
if (psync_ssl_errno == PSYNC_SSL_ERR_WANT_READ ||

232
pclsync/pssl.c
View File

@ -29,8 +29,14 @@
DAMAGE.
*/
#include <errno.h>
#include <ctype.h>
#include <errno.h>
#include <pthread.h>
#include <stddef.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <mbedtls/asn1.h>
#include <mbedtls/ctr_drbg.h>
#include <mbedtls/debug.h>
@ -42,28 +48,19 @@
#include <mbedtls/rsa.h>
#include <mbedtls/sha256.h>
#include <mbedtls/ssl.h>
#include <pthread.h>
#include <stddef.h>
#include <stdio.h>
#include "pcompiler.h"
#include "pcache.h"
#include "pcompiler.h"
#include "plibs.h"
#include "pmemlock.h"
#include "prand.h"
#include "psettings.h"
#include "pssl.h"
#include "psslcerts.h"
#include "psynclib.h"
#include "plibs.h"
#include "pmemlock.h"
#include "pssl.h"
#include "psynclib.h"
#include <stddef.h>
#include <string.h>
#include <unistd.h>
static pthread_mutex_t rsa_decr_mutex = PTHREAD_MUTEX_INITIALIZER;
static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
static void ssl_debug(int loglevel, int errnum, const char *msg) {
char ebuf[100];
@ -71,22 +68,22 @@ static void ssl_debug(int loglevel, int errnum, const char *msg) {
debug(loglevel, "%s: %s (-0x%04x)", msg, ebuf, (unsigned int)-errnum);
}
static void psync_ssl_free_psync_encrypted_data_t(psync_encrypted_data_t e) {
psync_ssl_memclean(e->data, e->datalen);
static void free_encrypted(psync_encrypted_data_t e) {
pssl_memclean(e->data, e->datalen);
pmemlock_free(e);
}
void psync_ssl_rsa_free_binary(psync_binary_rsa_key_t bin) {
psync_ssl_free_psync_encrypted_data_t(bin);
void prsa_free_binary(psync_binary_rsa_key_t bin) {
free_encrypted(bin);
}
void psync_ssl_free_symmetric_key(psync_symmetric_key_t key) {
psync_ssl_memclean(key->key, key->keylen);
void psymkey_free(psync_symmetric_key_t key) {
pssl_memclean(key->key, key->keylen);
pmemlock_free(key);
}
psync_encrypted_symmetric_key_t
psync_ssl_alloc_encrypted_symmetric_key(size_t len) {
psymkey_alloc_encrypted(size_t len) {
psync_encrypted_symmetric_key_t ret;
ret = psync_malloc(offsetof(psync_encrypted_data_struct_t, data) + len);
ret->datalen = len;
@ -94,7 +91,7 @@ psync_ssl_alloc_encrypted_symmetric_key(size_t len) {
}
psync_encrypted_symmetric_key_t
psync_ssl_copy_encrypted_symmetric_key(psync_encrypted_symmetric_key_t src) {
psymkey_copy_encrypted(psync_encrypted_symmetric_key_t src) {
psync_encrypted_symmetric_key_t ret;
ret = psync_malloc(offsetof(psync_encrypted_data_struct_t, data) +
src->datalen);
@ -103,28 +100,23 @@ psync_ssl_copy_encrypted_symmetric_key(psync_encrypted_symmetric_key_t src) {
return ret;
}
psync_symmetric_key_t psync_ssl_rsa_decrypt_symm_key_lock(
psync_symmetric_key_t prsa_decrypt_symm_key_lock(
psync_rsa_privatekey_t *rsa,
const psync_encrypted_symmetric_key_t *enckey) {
psync_symmetric_key_t sym_key;
debug(D_NOTICE, "Get RSA decrypt key lock.");
pthread_mutex_lock(&rsa_decr_mutex);
pthread_mutex_lock(&mutex);
sym_key = psync_ssl_rsa_decrypt_symmetric_key(*rsa, *enckey);
sym_key = psymkey_decrypt(*rsa, *enckey);
pthread_mutex_unlock(&rsa_decr_mutex);
pthread_mutex_unlock(&mutex);
debug(D_NOTICE, "RSA decrypt key Lock released.");
return sym_key;
}
#if defined(PSYNC_AES_HW_MSC)
#include <intrin.h>
#include <wmmintrin.h>
#endif
static const int psync_mbed_ciphersuite[] = {
static const int ciphersuites[] = {
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
@ -142,7 +134,7 @@ static const int psync_mbed_ciphersuite[] = {
typedef struct {
mbedtls_ctr_drbg_context rnd;
pthread_mutex_t mutex;
} ctr_drbg_context_locked;
} rng_ctx;
typedef struct {
mbedtls_net_context srv;
@ -153,81 +145,57 @@ typedef struct {
char cachekey[];
} ssl_connection_t;
static ctr_drbg_context_locked psync_mbed_rng;
static mbedtls_entropy_context psync_mbed_entropy;
static mbedtls_x509_crt psync_mbed_trusted_certs_x509;
static rng_ctx rng;
static mbedtls_entropy_context entropy;
static mbedtls_x509_crt ca_chain;
PSYNC_THREAD int psync_ssl_errno;
#if defined(PSYNC_AES_HW)
int psync_ssl_hw_aes;
#endif
static psync_ssl_debug_callback_t debug_cb = NULL;
static pssl_debug_callback_t debug_cb = NULL;
static void *debug_ctx = NULL;
void pssl_log_threshold(int threshold) {
mbedtls_debug_set_threshold(threshold);
}
void pssl_debug_cb(psync_ssl_debug_callback_t cb, void *ctx) {
void pssl_debug_cb(pssl_debug_callback_t cb, void *ctx) {
debug_cb = cb;
debug_ctx = ctx;
}
int rng_get(void *p_rng, unsigned char *output, size_t output_len) {
ctr_drbg_context_locked *rng;
rng_ctx *rng;
int ret;
rng = (ctr_drbg_context_locked *)p_rng;
rng = (rng_ctx *)p_rng;
pthread_mutex_lock(&rng->mutex);
ret = mbedtls_ctr_drbg_random(&rng->rnd, output, output_len);
pthread_mutex_unlock(&rng->mutex);
return ret;
}
#if defined(PSYNC_AES_HW_GCC)
static int detect_aes_hw() {
uint32_t eax, ecx;
eax = 1;
__asm__("cpuid" : "=c"(ecx) : "a"(eax) : "%ebx", "%edx");
ecx = (ecx >> 25) & 1;
if (ecx)
debug(D_NOTICE, "hardware AES support detected");
else
debug(D_NOTICE, "hardware AES support not detected");
return ecx;
}
#endif
int psync_ssl_init() {
int pssl_init() {
unsigned char seed[PSYNC_LHASH_DIGEST_LEN];
unsigned long i;
int result;
#if defined(PSYNC_AES_HW)
psync_ssl_hw_aes = detect_aes_hw();
#else
debug(D_NOTICE, "hardware AES is not supported for this compiler");
#endif
if (pthread_mutex_init(&psync_mbed_rng.mutex, NULL))
if (pthread_mutex_init(&rng.mutex, NULL))
return PRINT_RETURN(-1);
mbedtls_entropy_init(&psync_mbed_entropy);
mbedtls_entropy_init(&entropy);
prand_seed(seed, seed, sizeof(seed), 0);
mbedtls_entropy_update_manual(&psync_mbed_entropy, seed, sizeof(seed));
mbedtls_entropy_update_manual(&entropy, seed, sizeof(seed));
mbedtls_ctr_drbg_init(&psync_mbed_rng.rnd);
if ((result = mbedtls_ctr_drbg_seed(&psync_mbed_rng.rnd, mbedtls_entropy_func,
&psync_mbed_entropy, NULL, 0))) {
mbedtls_ctr_drbg_init(&rng.rnd);
if ((result = mbedtls_ctr_drbg_seed(&rng.rnd, mbedtls_entropy_func,
&entropy, NULL, 0))) {
debug(D_ERROR, "mbedtls_ctr_drbg_seed failed with return code %d", result);
return PRINT_RETURN(-1);
}
mbedtls_x509_crt_init(&psync_mbed_trusted_certs_x509);
mbedtls_x509_crt_init(&ca_chain);
for (i = 0; i < ARRAY_SIZE(psync_ssl_trusted_certs); i++) {
result = mbedtls_x509_crt_parse(&psync_mbed_trusted_certs_x509,
result = mbedtls_x509_crt_parse(&ca_chain,
(unsigned char *)psync_ssl_trusted_certs[i],
1 + strlen(psync_ssl_trusted_certs[i]));
if (result) {
@ -239,13 +207,13 @@ int psync_ssl_init() {
return 0;
}
void psync_ssl_memclean(void *ptr, size_t len) {
void pssl_memclean(void *ptr, size_t len) {
volatile unsigned char *p = ptr;
while (len--)
*p++ = 0;
}
static ssl_connection_t *psync_ssl_alloc_conn(const char *hostname) {
static ssl_connection_t *conn_alloc(const char *hostname) {
ssl_connection_t *conn;
size_t len;
len = strlen(hostname) + 1;
@ -324,7 +292,7 @@ static void save_session(ssl_connection_t *conn) {
free_session, PSYNC_MAX_SSL_SESSIONS_PER_DOMAIN);
}
static int chcek_peer_pubkey(ssl_connection_t *conn) {
static int check_peer_pubkey(ssl_connection_t *conn) {
const mbedtls_x509_crt *cert;
unsigned char buff[1024], sigbin[32];
char sighex[66];
@ -359,13 +327,13 @@ static int chcek_peer_pubkey(ssl_connection_t *conn) {
return -1;
}
int psync_ssl_connect(int sock, void **sslconn,
int pssl_connect(int sock, void **sslconn,
const char *hostname) {
ssl_connection_t *conn;
mbedtls_ssl_session *sess;
int ret;
conn = psync_ssl_alloc_conn(hostname);
conn = conn_alloc(hostname);
mbedtls_ssl_init(&conn->ssl);
mbedtls_ssl_config_init(&conn->cfg);
mbedtls_net_init(&conn->srv);
@ -387,9 +355,9 @@ int psync_ssl_connect(int sock, void **sslconn,
mbedtls_ssl_conf_endpoint(&conn->cfg, MBEDTLS_SSL_IS_CLIENT);
mbedtls_ssl_conf_dbg(&conn->cfg, debug_cb, debug_ctx);
mbedtls_ssl_conf_authmode(&conn->cfg, MBEDTLS_SSL_VERIFY_REQUIRED);
mbedtls_ssl_conf_ca_chain(&conn->cfg, &psync_mbed_trusted_certs_x509, NULL);
mbedtls_ssl_conf_ciphersuites(&conn->cfg, psync_mbed_ciphersuite);
mbedtls_ssl_conf_rng(&conn->cfg, rng_get, &psync_mbed_rng);
mbedtls_ssl_conf_ca_chain(&conn->cfg, &ca_chain, NULL);
mbedtls_ssl_conf_ciphersuites(&conn->cfg, ciphersuites);
mbedtls_ssl_conf_rng(&conn->cfg, rng_get, &rng);
mbedtls_ssl_set_bio(&conn->ssl, &conn->srv, mbed_write, mbed_read, NULL);
mbedtls_ssl_set_hostname(&conn->ssl, hostname);
@ -407,7 +375,7 @@ int psync_ssl_connect(int sock, void **sslconn,
ret = mbedtls_ssl_handshake(&conn->ssl);
if (ret == 0) {
if ((chcek_peer_pubkey(conn))) {
if ((check_peer_pubkey(conn))) {
goto err1;
}
*sslconn = conn;
@ -428,14 +396,14 @@ err0:
return PRINT_RETURN_CONST(PSYNC_SSL_FAIL);
}
int psync_ssl_connect_finish(void *sslconn, const char *hostname) {
int pssl_connect_finish(void *sslconn, const char *hostname) {
ssl_connection_t *conn;
int ret;
conn = (ssl_connection_t *)sslconn;
ret = mbedtls_ssl_handshake(&conn->ssl);
if (ret == 0) {
if ((chcek_peer_pubkey(conn))) {
if ((check_peer_pubkey(conn))) {
goto fail;
}
save_session(conn);
@ -453,7 +421,7 @@ fail:
return PRINT_RETURN_CONST(PSYNC_SSL_FAIL);
}
int psync_ssl_shutdown(void *sslconn) {
int pssl_shutdown(void *sslconn) {
ssl_connection_t *conn;
int ret;
conn = (ssl_connection_t *)sslconn;
@ -472,18 +440,18 @@ noshutdown:
return PSYNC_SSL_SUCCESS;
}
void psync_ssl_free(void *sslconn) {
void pssl_free(void *sslconn) {
ssl_connection_t *conn;
conn = (ssl_connection_t *)sslconn;
mbedtls_ssl_free(&conn->ssl);
psync_free(conn);
}
int psync_ssl_pendingdata(void *sslconn) {
int pssl_pendingdata(void *sslconn) {
return mbedtls_ssl_get_bytes_avail(&((ssl_connection_t *)sslconn)->ssl);
}
int psync_ssl_read(void *sslconn, void *buf, int num) {
int pssl_read(void *sslconn, void *buf, int num) {
ssl_connection_t *conn;
int res;
conn = (ssl_connection_t *)sslconn;
@ -494,7 +462,7 @@ int psync_ssl_read(void *sslconn, void *buf, int num) {
return PSYNC_SSL_FAIL;
}
int psync_ssl_write(void *sslconn, const void *buf, int num) {
int pssl_write(void *sslconn, const void *buf, int num) {
ssl_connection_t *conn;
int res;
conn = (ssl_connection_t *)sslconn;
@ -505,21 +473,21 @@ int psync_ssl_write(void *sslconn, const void *buf, int num) {
return PSYNC_SSL_FAIL;
}
void psync_ssl_rand_strong(unsigned char *buf, int num) {
void pssl_rand_strong(unsigned char *buf, int num) {
// FIXME: causing segfault
if (unlikely(rng_get(&psync_mbed_rng, buf, num))) {
if (unlikely(rng_get(&rng, buf, num))) {
debug(D_CRITICAL, "could not generate %d random bytes, exiting", num);
abort();
}
}
psync_rsa_t psync_ssl_gen_rsa(int bits) {
psync_rsa_t pssl_gen_rsa(int bits) {
mbedtls_rsa_context *ctx;
ctx = psync_new(mbedtls_rsa_context);
mbedtls_rsa_init(ctx);
mbedtls_rsa_set_padding(ctx, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1);
if (mbedtls_rsa_gen_key(ctx, rng_get, &psync_mbed_rng, bits,
if (mbedtls_rsa_gen_key(ctx, rng_get, &rng, bits,
65537)) {
mbedtls_rsa_free(ctx);
psync_free(ctx);
@ -528,27 +496,27 @@ psync_rsa_t psync_ssl_gen_rsa(int bits) {
return ctx;
}
void psync_ssl_free_rsa(psync_rsa_t rsa) {
void pssl_free_rsa(psync_rsa_t rsa) {
mbedtls_rsa_free(rsa);
psync_free(rsa);
}
psync_rsa_publickey_t psync_ssl_rsa_get_public(psync_rsa_t rsa) {
psync_rsa_publickey_t prsa_get_public(psync_rsa_t rsa) {
psync_binary_rsa_key_t bin;
psync_rsa_publickey_t ret;
bin = psync_ssl_rsa_public_to_binary(rsa);
bin = prsa_public_to_binary(rsa);
if (bin == PSYNC_INVALID_BIN_RSA)
return PSYNC_INVALID_RSA;
ret = psync_ssl_rsa_binary_to_public(bin);
psync_ssl_rsa_free_binary(bin);
ret = prsa_binary_to_public(bin);
prsa_free_binary(bin);
return ret;
}
void psync_ssl_rsa_free_public(psync_rsa_publickey_t key) {
psync_ssl_free_rsa(key);
void prsa_free_public(psync_rsa_publickey_t key) {
pssl_free_rsa(key);
}
psync_rsa_privatekey_t psync_ssl_rsa_get_private(psync_rsa_t rsa) {
psync_rsa_privatekey_t prsa_get_private(psync_rsa_t rsa) {
mbedtls_rsa_context *ctx;
ctx = psync_new(mbedtls_rsa_context);
mbedtls_rsa_init(ctx);
@ -562,12 +530,12 @@ psync_rsa_privatekey_t psync_ssl_rsa_get_private(psync_rsa_t rsa) {
return ctx;
}
void psync_ssl_rsa_free_private(psync_rsa_privatekey_t key) {
psync_ssl_free_rsa(key);
void prsa_free_private(psync_rsa_privatekey_t key) {
pssl_free_rsa(key);
}
psync_binary_rsa_key_t
psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa) {
prsa_public_to_binary(psync_rsa_publickey_t rsa) {
unsigned char buff[4096], *p;
mbedtls_pk_context ctx;
psync_binary_rsa_key_t ret;
@ -589,7 +557,7 @@ psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa) {
}
psync_binary_rsa_key_t
psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa) {
prsa_private_to_binary(psync_rsa_privatekey_t rsa) {
unsigned char buff[4096];
mbedtls_pk_context ctx;
psync_binary_rsa_key_t ret;
@ -606,11 +574,11 @@ psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa) {
pmemlock_malloc(offsetof(psync_encrypted_data_struct_t, data) + len);
ret->datalen = len;
memcpy(ret->data, buff + sizeof(buff) - len, len);
psync_ssl_memclean(buff + sizeof(buff) - len, len);
pssl_memclean(buff + sizeof(buff) - len, len);
return ret;
}
psync_rsa_publickey_t psync_ssl_rsa_load_public(const unsigned char *keydata,
psync_rsa_publickey_t prsa_load_public(const unsigned char *keydata,
size_t keylen) {
mbedtls_pk_context ctx;
mbedtls_rsa_context *rsa;
@ -666,7 +634,7 @@ static unsigned char* trim_der_key(const unsigned char *keydata, size_t *keylen)
return trimmed;
}
psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata, size_t keylen) {
psync_rsa_privatekey_t prsa_load_private(const unsigned char *keydata, size_t keylen) {
mbedtls_pk_context ctx;
mbedtls_rsa_context *rsa;
int ret;
@ -674,7 +642,7 @@ psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata,
trim_der_key(keydata, &keylen);
mbedtls_pk_init(&ctx);
ret = mbedtls_pk_parse_key(&ctx, keydata, keylen, NULL, 0, rng_get, &psync_mbed_rng);
ret = mbedtls_pk_parse_key(&ctx, keydata, keylen, NULL, 0, rng_get, &rng);
if(unlikely(ret)) {
ssl_debug(D_WARNING, ret, "pk_parse_key failed");
return PSYNC_INVALID_RSA;
@ -696,17 +664,17 @@ psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata,
}
psync_rsa_publickey_t
psync_ssl_rsa_binary_to_public(psync_binary_rsa_key_t bin) {
return psync_ssl_rsa_load_public(bin->data, bin->datalen);
prsa_binary_to_public(psync_binary_rsa_key_t bin) {
return prsa_load_public(bin->data, bin->datalen);
}
psync_rsa_privatekey_t
psync_ssl_rsa_binary_to_private(psync_binary_rsa_key_t bin) {
return psync_ssl_rsa_load_private(bin->data, bin->datalen);
prsa_binary_to_private(psync_binary_rsa_key_t bin) {
return prsa_load_private(bin->data, bin->datalen);
}
psync_symmetric_key_t
psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen,
psymkey_generate(const char *password, size_t keylen,
const unsigned char *salt, size_t saltlen,
size_t iterations) {
psync_symmetric_key_t key = (psync_symmetric_key_t)pmemlock_malloc(
@ -724,7 +692,7 @@ psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen,
return key;
}
char *psync_ssl_derive_password_from_passphrase(const char *username,
char *psymkey_derive(const char *username,
const char *passphrase) {
unsigned char *usercopy;
unsigned char usersha512[PSYNC_SHA512_DIGEST_LEN], passwordbin[32];
@ -751,7 +719,7 @@ char *psync_ssl_derive_password_from_passphrase(const char *username,
}
psync_encrypted_symmetric_key_t
psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data,
prsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data,
size_t datalen) {
psync_encrypted_symmetric_key_t ret;
int code;
@ -760,7 +728,7 @@ psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data,
ret = (psync_encrypted_symmetric_key_t)psync_malloc(
offsetof(psync_encrypted_data_struct_t, data) + rsalen);
if ((code = mbedtls_rsa_rsaes_oaep_encrypt(
rsa, rng_get, &psync_mbed_rng,
rsa, rng_get, &rng,
NULL, 0, datalen, data, ret->data))) {
psync_free(ret);
debug(
@ -774,37 +742,37 @@ psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data,
return ret;
}
psync_symmetric_key_t psync_ssl_rsa_decrypt_data(psync_rsa_privatekey_t rsa,
psync_symmetric_key_t prsa_decrypt_data(psync_rsa_privatekey_t rsa,
const unsigned char *data,
size_t datalen) {
unsigned char buff[2048];
psync_symmetric_key_t ret;
size_t len;
if (mbedtls_rsa_rsaes_oaep_decrypt(rsa, rng_get,
&psync_mbed_rng, NULL,
&rng, NULL,
0, &len, data, buff, sizeof(buff)))
return PSYNC_INVALID_SYM_KEY;
ret = (psync_symmetric_key_t)pmemlock_malloc(
offsetof(psync_symmetric_key_struct_t, key) + len);
ret->keylen = len;
memcpy(ret->key, buff, len);
psync_ssl_memclean(buff, len);
pssl_memclean(buff, len);
return ret;
}
psync_encrypted_symmetric_key_t
psync_ssl_rsa_encrypt_symmetric_key(psync_rsa_publickey_t rsa,
psymkey_encrypt(psync_rsa_publickey_t rsa,
const psync_symmetric_key_t key) {
return psync_ssl_rsa_encrypt_data(rsa, key->key, key->keylen);
return prsa_encrypt_data(rsa, key->key, key->keylen);
}
psync_symmetric_key_t psync_ssl_rsa_decrypt_symmetric_key(
psync_symmetric_key_t psymkey_decrypt(
psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey) {
return psync_ssl_rsa_decrypt_data(rsa, enckey->data, enckey->datalen);
return prsa_decrypt_data(rsa, enckey->data, enckey->datalen);
}
psync_aes256_encoder
psync_ssl_aes256_create_encoder(psync_symmetric_key_t key) {
paes_create_encoder(psync_symmetric_key_t key) {
mbedtls_aes_context *aes;
assert(key->keylen >= PSYNC_AES256_KEY_SIZE);
aes = psync_new(mbedtls_aes_context);
@ -812,13 +780,13 @@ psync_ssl_aes256_create_encoder(psync_symmetric_key_t key) {
return aes;
}
void psync_ssl_aes256_free_encoder(psync_aes256_encoder aes) {
psync_ssl_memclean(aes, sizeof(mbedtls_aes_context));
void paes_free_encoder(psync_aes256_encoder aes) {
pssl_memclean(aes, sizeof(mbedtls_aes_context));
psync_free(aes);
}
psync_aes256_encoder
psync_ssl_aes256_create_decoder(psync_symmetric_key_t key) {
paes_create_decoder(psync_symmetric_key_t key) {
mbedtls_aes_context *aes;
assert(key->keylen >= PSYNC_AES256_KEY_SIZE);
aes = psync_new(mbedtls_aes_context);
@ -826,13 +794,13 @@ psync_ssl_aes256_create_decoder(psync_symmetric_key_t key) {
return aes;
}
void psync_ssl_aes256_free_decoder(psync_aes256_encoder aes) {
psync_ssl_memclean(aes, sizeof(mbedtls_aes_context));
void paes_free_decoder(psync_aes256_encoder aes) {
pssl_memclean(aes, sizeof(mbedtls_aes_context));
psync_free(aes);
}
psync_rsa_signature_t
psync_ssl_rsa_sign_sha256_hash(psync_rsa_privatekey_t rsa,
prsa_sign_sha256_hash(psync_rsa_privatekey_t rsa,
const unsigned char *data) {
psync_rsa_signature_t ret;
int padding, hash_id;
@ -846,7 +814,7 @@ psync_ssl_rsa_sign_sha256_hash(psync_rsa_privatekey_t rsa,
padding = mbedtls_rsa_get_padding_mode(rsa);
hash_id = mbedtls_rsa_get_md_alg(rsa);
mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA256);
if (mbedtls_rsa_rsassa_pss_sign(rsa, rng_get, &psync_mbed_rng,
if (mbedtls_rsa_rsassa_pss_sign(rsa, rng_get, &rng,
MBEDTLS_MD_SHA256,
PSYNC_SHA256_DIGEST_LEN, data, ret->data)) {
free(ret);

133
pclsync/pssl.h
View File

@ -86,60 +86,38 @@ typedef mbedtls_aes_context *psync_aes256_encoder;
typedef mbedtls_aes_context *psync_aes256_decoder;
// ctx, level, message, ???, ???
typedef void (*psync_ssl_debug_callback_t)(void *, int, const char *, int,
typedef void (*pssl_debug_callback_t)(void *, int, const char *, int,
const char *);
void pssl_log_threshold(int threshold);
void pssl_debug_cb(psync_ssl_debug_callback_t cb, void *ctx);
void pssl_debug_cb(pssl_debug_callback_t cb, void *ctx);
#if defined(__GNUC__) && \
(defined(__amd64__) || defined(__x86_64__) || defined(__i386__))
#define PSYNC_AES_HW
#define PSYNC_AES_HW_GCC
#endif
static inline void psync_aes256_encode_block(psync_aes256_encoder enc,
const unsigned char *src,
unsigned char *dst) {
static inline void psync_aes256_encode_block(psync_aes256_encoder enc, const unsigned char *src, unsigned char *dst) {
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst);
}
static inline void psync_aes256_decode_block(psync_aes256_decoder enc,
const unsigned char *src,
unsigned char *dst) {
static inline void psync_aes256_decode_block(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst);
}
static inline void psync_aes256_encode_2blocks_consec(psync_aes256_decoder enc,
const unsigned char *src,
unsigned char *dst) {
static inline void psync_aes256_encode_2blocks_consec(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE,
dst + PSYNC_AES256_BLOCK_SIZE);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE, dst + PSYNC_AES256_BLOCK_SIZE);
}
static inline void psync_aes256_decode_2blocks_consec(psync_aes256_decoder enc,
const unsigned char *src,
unsigned char *dst) {
static inline void psync_aes256_decode_2blocks_consec(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE,
dst + PSYNC_AES256_BLOCK_SIZE);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, dst + PSYNC_AES256_BLOCK_SIZE);
}
static inline void psync_aes256_decode_4blocks_consec_xor(
psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst,
unsigned char *bxor) {
static inline void psync_aes256_decode_4blocks_consec_xor(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, unsigned char *bxor) {
unsigned long i;
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE,
dst + PSYNC_AES256_BLOCK_SIZE);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT,
src + PSYNC_AES256_BLOCK_SIZE * 2,
dst + PSYNC_AES256_BLOCK_SIZE * 2);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT,
src + PSYNC_AES256_BLOCK_SIZE * 3,
dst + PSYNC_AES256_BLOCK_SIZE * 3);
for (i = 0; i < PSYNC_AES256_BLOCK_SIZE * 4 / sizeof(unsigned long); i++)
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, dst + PSYNC_AES256_BLOCK_SIZE);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 2, dst + PSYNC_AES256_BLOCK_SIZE * 2);
mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 3, dst + PSYNC_AES256_BLOCK_SIZE * 3);
for (i = 0; i < PSYNC_AES256_BLOCK_SIZE * 4 / sizeof(unsigned long); i++) {
((unsigned long *)dst)[i] ^= ((unsigned long *)bxor)[i];
}
}
@ -166,52 +144,47 @@ typedef psync_encrypted_data_t psync_rsa_signature_t;
#define PSYNC_INVALID_ENCODER NULL
#define PSYNC_INVALID_BIN_RSA NULL
#define psync_ssl_alloc_binary_rsa psync_ssl_alloc_encrypted_symmetric_key
#define pssl_alloc_binary_rsa psymkey_alloc_encrypted
// Lock used to serialize access to RSA decrypt key function
int psync_ssl_init();
void psync_ssl_memclean(void *ptr, size_t len);
int psync_ssl_connect(int sock, void **sslconn,
const char *hostname);
int psync_ssl_connect_finish(void *sslconn, const char *hostname);
void psync_ssl_free(void *sslconn);
int psync_ssl_shutdown(void *sslconn);
int psync_ssl_pendingdata(void *sslconn);
int psync_ssl_read(void *sslconn, void *buf, int num);
int psync_ssl_write(void *sslconn, const void *buf, int num);
void psync_ssl_rand_strong(unsigned char *buf, int num);
psync_rsa_t psync_ssl_gen_rsa(int bits);
void psync_ssl_free_rsa(psync_rsa_t rsa);
psync_rsa_publickey_t psync_ssl_rsa_get_public(psync_rsa_t rsa);
void psync_ssl_rsa_free_public(psync_rsa_publickey_t key);
psync_rsa_privatekey_t psync_ssl_rsa_get_private(psync_rsa_t rsa);
void psync_ssl_rsa_free_private(psync_rsa_privatekey_t key);
psync_binary_rsa_key_t psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa);
psync_binary_rsa_key_t psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa);
psync_rsa_publickey_t psync_ssl_rsa_load_public(const unsigned char *keydata,
size_t keylen);
psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata,
size_t keylen);
psync_rsa_publickey_t psync_ssl_rsa_binary_to_public(psync_binary_rsa_key_t bin);
psync_rsa_privatekey_t psync_ssl_rsa_binary_to_private(psync_binary_rsa_key_t bin);
void psync_ssl_rsa_free_binary(psync_binary_rsa_key_t bin);
psync_symmetric_key_t psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations);
char *psync_ssl_derive_password_from_passphrase(const char *username, const char *passphrase);
psync_encrypted_symmetric_key_t psync_ssl_alloc_encrypted_symmetric_key(size_t len);
psync_encrypted_symmetric_key_t psync_ssl_copy_encrypted_symmetric_key(psync_encrypted_symmetric_key_t src);
void psync_ssl_free_symmetric_key(psync_symmetric_key_t key);
psync_encrypted_symmetric_key_t psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen);
psync_symmetric_key_t psync_ssl_rsa_decrypt_data(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen);
psync_encrypted_symmetric_key_t psync_ssl_rsa_encrypt_symmetric_key(psync_rsa_publickey_t rsa, const psync_symmetric_key_t key);
psync_symmetric_key_t psync_ssl_rsa_decrypt_symmetric_key(psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey);
psync_aes256_encoder psync_ssl_aes256_create_encoder(psync_symmetric_key_t key);
void psync_ssl_aes256_free_encoder(psync_aes256_encoder aes);
psync_aes256_encoder psync_ssl_aes256_create_decoder(psync_symmetric_key_t key);
void psync_ssl_aes256_free_decoder(psync_aes256_encoder aes);
psync_rsa_signature_t psync_ssl_rsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, const unsigned char *data);
psync_symmetric_key_t psync_ssl_rsa_decrypt_symm_key_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey);
int pssl_init();
void pssl_memclean(void *ptr, size_t len);
int pssl_connect(int sock, void **sslconn, const char *hostname);
int pssl_connect_finish(void *sslconn, const char *hostname);
void pssl_free(void *sslconn);
int pssl_shutdown(void *sslconn);
int pssl_pendingdata(void *sslconn);
int pssl_read(void *sslconn, void *buf, int num);
int pssl_write(void *sslconn, const void *buf, int num);
void pssl_rand_strong(unsigned char *buf, int num);
psync_rsa_t pssl_gen_rsa(int bits);
void pssl_free_rsa(psync_rsa_t rsa);
psync_rsa_publickey_t prsa_get_public(psync_rsa_t rsa);
void prsa_free_public(psync_rsa_publickey_t key);
psync_rsa_privatekey_t prsa_get_private(psync_rsa_t rsa);
void prsa_free_private(psync_rsa_privatekey_t key);
psync_binary_rsa_key_t prsa_public_to_binary(psync_rsa_publickey_t rsa);
psync_binary_rsa_key_t prsa_private_to_binary(psync_rsa_privatekey_t rsa);
psync_rsa_publickey_t prsa_load_public(const unsigned char *keydata, size_t keylen);
psync_rsa_privatekey_t prsa_load_private(const unsigned char *keydata, size_t keylen);
psync_rsa_publickey_t prsa_binary_to_public(psync_binary_rsa_key_t bin);
psync_rsa_privatekey_t prsa_binary_to_private(psync_binary_rsa_key_t bin);
void prsa_free_binary(psync_binary_rsa_key_t bin);
psync_symmetric_key_t psymkey_generate(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations);
char *psymkey_derive(const char *username, const char *passphrase);
psync_encrypted_symmetric_key_t psymkey_alloc_encrypted(size_t len);
psync_encrypted_symmetric_key_t psymkey_copy_encrypted(psync_encrypted_symmetric_key_t src);
void psymkey_free(psync_symmetric_key_t key);
psync_encrypted_symmetric_key_t prsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen);
psync_symmetric_key_t prsa_decrypt_data(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen);
psync_encrypted_symmetric_key_t psymkey_encrypt(psync_rsa_publickey_t rsa, const psync_symmetric_key_t key);
psync_symmetric_key_t psymkey_decrypt(psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey);
psync_aes256_encoder paes_create_encoder(psync_symmetric_key_t key);
void paes_free_encoder(psync_aes256_encoder aes);
psync_aes256_encoder paes_create_decoder(psync_symmetric_key_t key);
void paes_free_decoder(psync_aes256_encoder aes);
psync_rsa_signature_t prsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, const unsigned char *data);
psync_symmetric_key_t prsa_decrypt_symm_key_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey);
#endif

6
pclsync/psynclib.c
View File

@ -228,7 +228,7 @@ static void ssl_debug_cb(void *ctx, int level, const char *msg, int TODO1,
TODO1); // trying to figure out what these are...
}
void psync_set_ssl_debug_callback(psync_ssl_debug_callback_t cb) {
void psync_set_ssl_debug_callback(pssl_debug_callback_t cb) {
pssl_log_threshold(PSYNC_SSL_DEBUG_LEVEL);
pssl_debug_cb(cb, NULL);
}
@ -278,7 +278,7 @@ int psync_init() {
}
psync_sql_statement("UPDATE task SET inprogress=0 WHERE inprogress=1");
ptimer_init();
if (unlikely_log(psync_ssl_init())) {
if (unlikely_log(pssl_init())) {
if (IS_DEBUG)
pthread_mutex_unlock(&psync_libstate_mutex);
return_error(PERROR_SSL_INIT_FAILED);
@ -2177,7 +2177,7 @@ int psync_password_quality10000(const char *password) {
char *psync_derive_password_from_passphrase(const char *username,
const char *passphrase) {
return psync_ssl_derive_password_from_passphrase(username, passphrase);
return psymkey_derive(username, passphrase);
}
int psync_crypto_setup(const char *password, const char *hint) {