Compare commits
No commits in common. 'c9' and 'i10cs' have entirely different histories.
@ -1 +1 @@
|
|||||||
0dd6efca729f1190f66855523c3920c3f7ddd482 SOURCES/cjose-0.6.1.tar.gz
|
4037d1a8ebef22d9fea22dd9e236a91bf1c6166c SOURCES/cjose-0.6.2.2.tar.gz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
SOURCES/cjose-0.6.1.tar.gz
|
SOURCES/cjose-0.6.2.2.tar.gz
|
||||||
|
|||||||
@ -1,53 +0,0 @@
|
|||||||
From b339a18aa06c78d64ac33d891d400eac7b86fff3 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
||||||
Date: Mon, 17 May 2021 13:30:24 +0200
|
|
||||||
Subject: [PATCH] Define OPENSSL_API_COMPAT to 0x10101000L
|
|
||||||
|
|
||||||
---
|
|
||||||
src/jwe.c | 2 ++
|
|
||||||
src/jwk.c | 2 ++
|
|
||||||
src/jws.c | 2 ++
|
|
||||||
3 files changed, 6 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/src/jwe.c b/src/jwe.c
|
|
||||||
index 822d408..d6f3149 100644
|
|
||||||
--- a/src/jwe.c
|
|
||||||
+++ b/src/jwe.c
|
|
||||||
@@ -5,6 +5,8 @@
|
|
||||||
* Copyright (c) 2014-2016 Cisco Systems, Inc. All Rights Reserved.
|
|
||||||
*/
|
|
||||||
|
|
||||||
+#define OPENSSL_API_COMPAT 0x10101000L
|
|
||||||
+
|
|
||||||
#include <cjose/base64.h>
|
|
||||||
#include <cjose/header.h>
|
|
||||||
#include <cjose/jwe.h>
|
|
||||||
diff --git a/src/jwk.c b/src/jwk.c
|
|
||||||
index 860f0e7..87408e9 100644
|
|
||||||
--- a/src/jwk.c
|
|
||||||
+++ b/src/jwk.c
|
|
||||||
@@ -5,6 +5,8 @@
|
|
||||||
* Copyright (c) 2014-2016 Cisco Systems, Inc. All Rights Reserved.
|
|
||||||
*/
|
|
||||||
|
|
||||||
+#define OPENSSL_API_COMPAT 0x10101000L
|
|
||||||
+
|
|
||||||
#include "include/jwk_int.h"
|
|
||||||
#include "include/util_int.h"
|
|
||||||
|
|
||||||
diff --git a/src/jws.c b/src/jws.c
|
|
||||||
index 4e03554..9d682a0 100644
|
|
||||||
--- a/src/jws.c
|
|
||||||
+++ b/src/jws.c
|
|
||||||
@@ -5,6 +5,8 @@
|
|
||||||
* Copyright (c) 2014-2016 Cisco Systems, Inc. All Rights Reserved.
|
|
||||||
*/
|
|
||||||
|
|
||||||
+#define OPENSSL_API_COMPAT 0x10101000L
|
|
||||||
+
|
|
||||||
#include <cjose/base64.h>
|
|
||||||
#include <cjose/header.h>
|
|
||||||
#include <cjose/jws.h>
|
|
||||||
--
|
|
||||||
2.31.1
|
|
||||||
|
|
||||||
@ -1,25 +0,0 @@
|
|||||||
commit 54d449473b21e93805070264791e80f84f601b4d
|
|
||||||
Author: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
|
|
||||||
Date: Tue Apr 5 20:51:20 2022 +0200
|
|
||||||
|
|
||||||
check result of cek = cjose_get_alloc()(cek_len) in jwe.c
|
|
||||||
|
|
||||||
see: https://github.com/cisco/cjose/issues/110
|
|
||||||
|
|
||||||
Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
|
|
||||||
|
|
||||||
diff --git a/src/jwe.c b/src/jwe.c
|
|
||||||
index 4285097..157ddec 100644
|
|
||||||
--- a/src/jwe.c
|
|
||||||
+++ b/src/jwe.c
|
|
||||||
@@ -2064,6 +2064,10 @@ uint8_t *cjose_jwe_decrypt_multi(cjose_jwe_t *jwe, cjose_key_locator key_locator
|
|
||||||
{
|
|
||||||
cek_len = jwe->cek_len;
|
|
||||||
cek = cjose_get_alloc()(cek_len);
|
|
||||||
+ if (!cek) {
|
|
||||||
+ CJOSE_ERROR(err, CJOSE_ERR_NO_MEMORY);
|
|
||||||
+ return NULL;
|
|
||||||
+ }
|
|
||||||
memcpy(cek, jwe->cek, cek_len);
|
|
||||||
}
|
|
||||||
else
|
|
||||||
@ -1,91 +0,0 @@
|
|||||||
diff -up cjose-0.6.1/src/jwe.c.orig cjose-0.6.1/src/jwe.c
|
|
||||||
--- cjose-0.6.1/src/jwe.c.orig 2023-07-19 16:23:44.658712950 +0200
|
|
||||||
+++ cjose-0.6.1/src/jwe.c 2023-07-19 16:55:02.173914437 +0200
|
|
||||||
@@ -1227,6 +1227,12 @@ static bool _cjose_jwe_decrypt_dat_a256g
|
|
||||||
goto _cjose_jwe_decrypt_dat_a256gcm_fail;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if (jwe->enc_auth_tag.raw_len != 16)
|
|
||||||
+ {
|
|
||||||
+ CJOSE_ERROR(err, CJOSE_ERR_CRYPTO);
|
|
||||||
+ goto _cjose_jwe_decrypt_dat_a256gcm_fail;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
// set the expected GCM-mode authentication tag
|
|
||||||
if (EVP_CIPHER_CTX_ctrl(ctx, CJOSE_EVP_CTRL_GCM_SET_TAG, jwe->enc_auth_tag.raw_len, jwe->enc_auth_tag.raw) != 1)
|
|
||||||
{
|
|
||||||
diff -up cjose-0.6.1/test/check_jwe.c.orig cjose-0.6.1/test/check_jwe.c
|
|
||||||
--- cjose-0.6.1/test/check_jwe.c.orig 2018-04-12 00:39:58.000000000 +0200
|
|
||||||
+++ cjose-0.6.1/test/check_jwe.c 2023-07-19 16:38:45.412336742 +0200
|
|
||||||
@@ -809,6 +809,63 @@ START_TEST(test_cjose_jwe_decrypt_aes)
|
|
||||||
}
|
|
||||||
END_TEST
|
|
||||||
|
|
||||||
+START_TEST(test_cjose_jwe_decrypt_aes_gcm)
|
|
||||||
+{
|
|
||||||
+ cjose_err err;
|
|
||||||
+
|
|
||||||
+ const char *key = JWK_OCT_32;
|
|
||||||
+ const char *plain1 = "Live long and prosper.";
|
|
||||||
+ char *compact1 = "eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..Du_9fxxV-zrReaWC.aS_rpokeuxkaPc2sykcQDCQuJCYoww.GpeKGEqd8KQ0v6JNea5aSA";
|
|
||||||
+ char *compact2 = "eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..Du_9fxxV-zrReaWC.aS_rpokeuxkaPc2sykcQDCQuJCYoww.Gp";
|
|
||||||
+
|
|
||||||
+ cjose_jwk_t *jwk = cjose_jwk_import(key, strlen(key), &err);
|
|
||||||
+ ck_assert_msg(NULL != jwk,
|
|
||||||
+ "cjose_jwk_import failed: "
|
|
||||||
+ "%s, file: %s, function: %s, line: %ld",
|
|
||||||
+ err.message, err.file, err.function, err.line);
|
|
||||||
+
|
|
||||||
+ cjose_jwe_t *jwe1 = cjose_jwe_import(compact1, strlen(compact1), &err);
|
|
||||||
+ ck_assert_msg(NULL != jwe1,
|
|
||||||
+ "cjose_jwe_import failed: "
|
|
||||||
+ "%s, file: %s, function: %s, line: %ld",
|
|
||||||
+ err.message, err.file, err.function, err.line);
|
|
||||||
+
|
|
||||||
+ uint8_t *plain2 = NULL;
|
|
||||||
+ size_t plain2_len = 0;
|
|
||||||
+ plain2 = cjose_jwe_decrypt(jwe1, jwk, &plain2_len, &err);
|
|
||||||
+ ck_assert_msg(NULL != plain2,
|
|
||||||
+ "cjose_jwe_decrypt failed: "
|
|
||||||
+ "%s, file: %s, function: %s, line: %ld",
|
|
||||||
+ err.message, err.file, err.function, err.line);
|
|
||||||
+
|
|
||||||
+ ck_assert_msg(plain2_len == strlen(plain1),
|
|
||||||
+ "length of decrypted plaintext does not match length of original, "
|
|
||||||
+ "expected: %lu, found: %lu",
|
|
||||||
+ strlen(plain1), plain2_len);
|
|
||||||
+ ck_assert_msg(strncmp(plain1, plain2, plain2_len) == 0, "decrypted plaintext does not match encrypted plaintext");
|
|
||||||
+
|
|
||||||
+ cjose_get_dealloc()(plain2);
|
|
||||||
+ cjose_jwe_release(jwe1);
|
|
||||||
+
|
|
||||||
+ cjose_jwe_t *jwe2 = cjose_jwe_import(compact2, strlen(compact2), &err);
|
|
||||||
+ ck_assert_msg(NULL != jwe2,
|
|
||||||
+ "cjose_jwe_import failed: "
|
|
||||||
+ "%s, file: %s, function: %s, line: %ld",
|
|
||||||
+ err.message, err.file, err.function, err.line);
|
|
||||||
+
|
|
||||||
+ uint8_t *plain3 = NULL;
|
|
||||||
+ size_t plain3_len = 0;
|
|
||||||
+ plain3 = cjose_jwe_decrypt(jwe2, jwk, &plain3_len, &err);
|
|
||||||
+ ck_assert_msg(NULL == plain3,
|
|
||||||
+ "cjose_jwe_decrypt succeeded where it should have failed: "
|
|
||||||
+ "%s, file: %s, function: %s, line: %ld",
|
|
||||||
+ err.message, err.file, err.function, err.line);
|
|
||||||
+
|
|
||||||
+ cjose_jwe_release(jwe2);
|
|
||||||
+ cjose_jwk_release(jwk);
|
|
||||||
+}
|
|
||||||
+END_TEST
|
|
||||||
+
|
|
||||||
START_TEST(test_cjose_jwe_decrypt_rsa)
|
|
||||||
{
|
|
||||||
struct cjose_jwe_decrypt_rsa
|
|
||||||
@@ -1210,6 +1267,7 @@ Suite *cjose_jwe_suite()
|
|
||||||
tcase_add_test(tc_jwe, test_cjose_jwe_self_encrypt_self_decrypt_large);
|
|
||||||
tcase_add_test(tc_jwe, test_cjose_jwe_self_encrypt_self_decrypt_many);
|
|
||||||
tcase_add_test(tc_jwe, test_cjose_jwe_decrypt_aes);
|
|
||||||
+ tcase_add_test(tc_jwe, test_cjose_jwe_decrypt_aes_gcm);
|
|
||||||
tcase_add_test(tc_jwe, test_cjose_jwe_decrypt_rsa);
|
|
||||||
tcase_add_test(tc_jwe, test_cjose_jwe_encrypt_with_bad_header);
|
|
||||||
tcase_add_test(tc_jwe, test_cjose_jwe_encrypt_with_bad_key);
|
|
||||||
@ -1,74 +0,0 @@
|
|||||||
commit 0238eb8f3612515f4374381b593dd79116169330
|
|
||||||
Author: John Dennis <jdennis@redhat.com>
|
|
||||||
Date: Thu Aug 2 16:21:33 2018 -0400
|
|
||||||
|
|
||||||
fix concatkdf failures on big endian architectures
|
|
||||||
|
|
||||||
Several of the elements used to compute the digest in ECDH-ES key
|
|
||||||
agreement computation are represented in binary form as a 32-bit
|
|
||||||
integer length followed by that number of octets. the length
|
|
||||||
field. The 32-bit length integer is represented in big endian
|
|
||||||
format (the 8 most significant bits are in the first octet.).
|
|
||||||
|
|
||||||
The conversion to a 4 byte big endian integer was being computed
|
|
||||||
in a manner that only worked on little endian architectures. The
|
|
||||||
function htonl() returns a 32-bit integer whose octet sequence given
|
|
||||||
the address of the integer is big endian. There is no need for any
|
|
||||||
further manipulation.
|
|
||||||
|
|
||||||
The existing code used bit shifting on a 32-bit value. In C bit
|
|
||||||
shifting is endian agnostic for multi-octet values, a right shift
|
|
||||||
moves most significant bits toward least significant bits. The result
|
|
||||||
of a bit shift of a multi-octet value on either big or little
|
|
||||||
archictures will always be the same provided you "view" it as the same
|
|
||||||
data type (e.g. 32-bit integer). But indexing the octets of that
|
|
||||||
mulit-octet value will be different depending on endianness, hence the
|
|
||||||
assembled octets differed depending on endianness.
|
|
||||||
|
|
||||||
Issue: #77
|
|
||||||
Signed-off-by: John Dennis <jdennis@redhat.com>
|
|
||||||
|
|
||||||
diff --git a/src/concatkdf.c b/src/concatkdf.c
|
|
||||||
index ec064ab..59b845a 100644
|
|
||||||
--- a/src/concatkdf.c
|
|
||||||
+++ b/src/concatkdf.c
|
|
||||||
@@ -29,15 +29,9 @@
|
|
||||||
////////////////////////////////////////////////////////////////////////////////
|
|
||||||
static uint8_t *_apply_uint32(const uint32_t value, uint8_t *buffer)
|
|
||||||
{
|
|
||||||
- const uint32_t formatted = htonl(value);
|
|
||||||
- const uint8_t data[4] = {
|
|
||||||
- (formatted >> 0) & 0xff,
|
|
||||||
- (formatted >> 8) & 0xff,
|
|
||||||
- (formatted >> 16) & 0xff,
|
|
||||||
- (formatted >> 24) & 0xff
|
|
||||||
- };
|
|
||||||
- memcpy(buffer, data, 4);
|
|
||||||
+ const uint32_t big_endian_int32 = htonl(value);
|
|
||||||
|
|
||||||
+ memcpy(buffer, &big_endian_int32, 4);
|
|
||||||
return buffer + 4;
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/test/check_concatkdf.c b/test/check_concatkdf.c
|
|
||||||
index e4325fc..41d0f1c 100644
|
|
||||||
--- a/test/check_concatkdf.c
|
|
||||||
+++ b/test/check_concatkdf.c
|
|
||||||
@@ -60,14 +60,9 @@ _create_otherinfo_header_finish:
|
|
||||||
|
|
||||||
static bool _cmp_uint32(uint8_t **actual, uint32_t expected)
|
|
||||||
{
|
|
||||||
- uint32_t value = htonl(expected);
|
|
||||||
- uint8_t expectedData[] = {
|
|
||||||
- (value >> 0) & 0xff,
|
|
||||||
- (value >> 8) & 0xff,
|
|
||||||
- (value >> 16) & 0xff,
|
|
||||||
- (value >> 24) & 0xff
|
|
||||||
- };
|
|
||||||
- bool result = (0 == memcmp(*actual, expectedData, 4));
|
|
||||||
+ uint32_t big_endian_int32 = htonl(expected);
|
|
||||||
+
|
|
||||||
+ bool result = (0 == memcmp(*actual, &big_endian_int32, 4));
|
|
||||||
(*actual) += 4;
|
|
||||||
return result;
|
|
||||||
}
|
|
||||||
Loading…
Reference in new issue