summaryrefslogtreecommitdiff
path: root/src/sp_cookie_encryption.c
diff options
context:
space:
mode:
authorThibault "bui" Koechlin2017-12-28 17:04:06 +0100
committerjvoisin2017-12-28 17:04:06 +0100
commit9f5e8d12f05fb24c915a5266a1e908a75c8aed08 (patch)
tree9160075ea943c7fd29a3923f844a0ac0d6b8b457 /src/sp_cookie_encryption.c
parent62c48bf9a85e0294b7b32cea438e904e1cd50669 (diff)
Clang-format pass
- `clang-format --style="{BasedOnStyle: google, SortIncludes: false}" -i snuffleu*.c sp_*.c sp_*.h` - Update the documentation accordingly
Diffstat (limited to 'src/sp_cookie_encryption.c')
-rw-r--r--src/sp_cookie_encryption.c79
1 files changed, 45 insertions, 34 deletions
diff --git a/src/sp_cookie_encryption.c b/src/sp_cookie_encryption.c
index 4e9818f..6abc20a 100644
--- a/src/sp_cookie_encryption.c
+++ b/src/sp_cookie_encryption.c
@@ -10,12 +10,12 @@ static inline void generate_key(unsigned char *key) {
10 PHP_SHA256_CTX ctx; 10 PHP_SHA256_CTX ctx;
11 const char *user_agent = getenv("HTTP_USER_AGENT"); 11 const char *user_agent = getenv("HTTP_USER_AGENT");
12 const char *env_var = 12 const char *env_var =
13 getenv(SNUFFLEUPAGUS_G(config).config_snuffleupagus->cookies_env_var); 13 getenv(SNUFFLEUPAGUS_G(config).config_snuffleupagus->cookies_env_var);
14 const char *encryption_key = 14 const char *encryption_key =
15 SNUFFLEUPAGUS_G(config).config_snuffleupagus->encryption_key; 15 SNUFFLEUPAGUS_G(config).config_snuffleupagus->encryption_key;
16 16
17 assert(32 == crypto_secretbox_KEYBYTES); // 32 is the size of a SHA256. 17 assert(32 == crypto_secretbox_KEYBYTES); // 32 is the size of a SHA256.
18 assert(encryption_key); // Encryption key can't be NULL 18 assert(encryption_key); // Encryption key can't be NULL
19 19
20 PHP_SHA256Init(&ctx); 20 PHP_SHA256Init(&ctx);
21 21
@@ -24,11 +24,12 @@ static inline void generate_key(unsigned char *key) {
24 } 24 }
25 25
26 if (env_var) { 26 if (env_var) {
27 PHP_SHA256Update(&ctx, (unsigned char*)env_var, strlen(env_var)); 27 PHP_SHA256Update(&ctx, (unsigned char *)env_var, strlen(env_var));
28 } else { 28 } else {
29 sp_log_err("cookie_encryption", "The environment variable '%s'" 29 sp_log_err("cookie_encryption",
30 "is empty, cookies are weakly encrypted.", 30 "The environment variable '%s'"
31 SNUFFLEUPAGUS_G(config).config_snuffleupagus->cookies_env_var); 31 "is empty, cookies are weakly encrypted.",
32 SNUFFLEUPAGUS_G(config).config_snuffleupagus->cookies_env_var);
32 } 33 }
33 34
34 if (encryption_key) { 35 if (encryption_key) {
@@ -41,9 +42,9 @@ static inline void generate_key(unsigned char *key) {
41 42
42static inline const sp_cookie *sp_lookup_cookie_config(const char *key) { 43static inline const sp_cookie *sp_lookup_cookie_config(const char *key) {
43 sp_list_node *it = SNUFFLEUPAGUS_G(config).config_cookie->cookies; 44 sp_list_node *it = SNUFFLEUPAGUS_G(config).config_cookie->cookies;
44 45
45 while (it) { 46 while (it) {
46 const sp_cookie *config = it->data; 47 const sp_cookie *config = it->data;
47 if (config && sp_match_value(key, config->name, config->name_r)) { 48 if (config && sp_match_value(key, config->name, config->name_r)) {
48 return config; 49 return config;
49 } 50 }
@@ -60,7 +61,7 @@ int decrypt_cookie(zval *pDest, int num_args, va_list args,
60 unsigned char *decrypted; 61 unsigned char *decrypted;
61 const sp_cookie *cookie = sp_lookup_cookie_config(ZSTR_VAL(hash_key->key)); 62 const sp_cookie *cookie = sp_lookup_cookie_config(ZSTR_VAL(hash_key->key));
62 int ret = 0; 63 int ret = 0;
63 64
64 /* If the cookie isn't in the conf, it shouldn't be encrypted. */ 65 /* If the cookie isn't in the conf, it shouldn't be encrypted. */
65 if (!cookie || !cookie->encrypt) { 66 if (!cookie || !cookie->encrypt) {
66 return ZEND_HASH_APPLY_KEEP; 67 return ZEND_HASH_APPLY_KEEP;
@@ -72,18 +73,20 @@ int decrypt_cookie(zval *pDest, int num_args, va_list args,
72 } 73 }
73 74
74 debase64 = php_base64_decode((unsigned char *)(Z_STRVAL_P(pDest)), 75 debase64 = php_base64_decode((unsigned char *)(Z_STRVAL_P(pDest)),
75 Z_STRLEN_P(pDest)); 76 Z_STRLEN_P(pDest));
76 77
77 if (ZSTR_LEN(debase64) < 78 if (ZSTR_LEN(debase64) <
78 crypto_secretbox_NONCEBYTES + crypto_secretbox_ZEROBYTES) { 79 crypto_secretbox_NONCEBYTES + crypto_secretbox_ZEROBYTES) {
79 if (true == cookie->simulation) { 80 if (true == cookie->simulation) {
80 sp_log_msg("cookie_encryption", SP_LOG_SIMULATION, 81 sp_log_msg(
82 "cookie_encryption", SP_LOG_SIMULATION,
81 "Buffer underflow tentative detected in cookie encryption handling " 83 "Buffer underflow tentative detected in cookie encryption handling "
82 "for %s. Using the cookie 'as it' instead of decrypting it.", 84 "for %s. Using the cookie 'as it' instead of decrypting it.",
83 ZSTR_VAL(hash_key->key)); 85 ZSTR_VAL(hash_key->key));
84 return ZEND_HASH_APPLY_KEEP; 86 return ZEND_HASH_APPLY_KEEP;
85 } else { 87 } else {
86 sp_log_msg("cookie_encryption", SP_LOG_DROP, 88 sp_log_msg(
89 "cookie_encryption", SP_LOG_DROP,
87 "Buffer underflow tentative detected in cookie encryption handling."); 90 "Buffer underflow tentative detected in cookie encryption handling.");
88 return ZEND_HASH_APPLY_REMOVE; 91 return ZEND_HASH_APPLY_REMOVE;
89 } 92 }
@@ -101,14 +104,16 @@ int decrypt_cookie(zval *pDest, int num_args, va_list args,
101 104
102 if (-1 == ret) { 105 if (-1 == ret) {
103 if (true == cookie->simulation) { 106 if (true == cookie->simulation) {
104 sp_log_msg("cookie_encryption", SP_LOG_SIMULATION, 107 sp_log_msg(
105 "Something went wrong with the decryption of %s. Using the cookie " 108 "cookie_encryption", SP_LOG_SIMULATION,
106 "'as it' instead of decrypting it", ZSTR_VAL(hash_key->key)); 109 "Something went wrong with the decryption of %s. Using the cookie "
110 "'as it' instead of decrypting it",
111 ZSTR_VAL(hash_key->key));
107 return ZEND_HASH_APPLY_KEEP; 112 return ZEND_HASH_APPLY_KEEP;
108 } else { 113 } else {
109 sp_log_msg("cookie_encryption", SP_LOG_DROP, 114 sp_log_msg("cookie_encryption", SP_LOG_DROP,
110 "Something went wrong with the decryption of %s.", 115 "Something went wrong with the decryption of %s.",
111 ZSTR_VAL(hash_key->key)); 116 ZSTR_VAL(hash_key->key));
112 return ZEND_HASH_APPLY_REMOVE; 117 return ZEND_HASH_APPLY_REMOVE;
113 } 118 }
114 } 119 }
@@ -127,7 +132,8 @@ int decrypt_cookie(zval *pDest, int num_args, va_list args,
127*/ 132*/
128static zend_string *encrypt_data(char *data, unsigned long long data_len) { 133static zend_string *encrypt_data(char *data, unsigned long long data_len) {
129 const size_t encrypted_msg_len = crypto_secretbox_ZEROBYTES + data_len + 1; 134 const size_t encrypted_msg_len = crypto_secretbox_ZEROBYTES + data_len + 1;
130 const size_t emsg_and_nonce_len = encrypted_msg_len + crypto_secretbox_NONCEBYTES; 135 const size_t emsg_and_nonce_len =
136 encrypted_msg_len + crypto_secretbox_NONCEBYTES;
131 137
132 unsigned char key[crypto_secretbox_KEYBYTES] = {0}; 138 unsigned char key[crypto_secretbox_KEYBYTES] = {0};
133 unsigned char nonce[crypto_secretbox_NONCEBYTES] = {0}; 139 unsigned char nonce[crypto_secretbox_NONCEBYTES] = {0};
@@ -149,7 +155,7 @@ static zend_string *encrypt_data(char *data, unsigned long long data_len) {
149 } 155 }
150 } 156 }
151 nonce_d++; 157 nonce_d++;
152 sscanf((char*)nonce, "%ld", &nonce_d); 158 sscanf((char *)nonce, "%ld", &nonce_d);
153 159
154 memcpy(encrypted_data, nonce, crypto_secretbox_NONCEBYTES); 160 memcpy(encrypted_data, nonce, crypto_secretbox_NONCEBYTES);
155 crypto_secretbox(encrypted_data + crypto_secretbox_NONCEBYTES, 161 crypto_secretbox(encrypted_data + crypto_secretbox_NONCEBYTES,
@@ -161,15 +167,15 @@ static zend_string *encrypt_data(char *data, unsigned long long data_len) {
161} 167}
162 168
163PHP_FUNCTION(sp_setcookie) { 169PHP_FUNCTION(sp_setcookie) {
164 zval params[7] = { 0 }; 170 zval params[7] = {0};
165 zend_string *name = NULL, *value = NULL, *path = NULL, *domain = NULL, *samesite = NULL; 171 zend_string *name = NULL, *value = NULL, *path = NULL, *domain = NULL,
172 *samesite = NULL;
166 zend_long expires = 0; 173 zend_long expires = 0;
167 zend_bool secure = 0, httponly = 0; 174 zend_bool secure = 0, httponly = 0;
168 const sp_cookie *cookie_node = NULL; 175 const sp_cookie *cookie_node = NULL;
169 zval func_name; 176 zval func_name;
170 char *cookie_samesite; 177 char *cookie_samesite;
171 178
172
173 // LCOV_EXCL_BR_START 179 // LCOV_EXCL_BR_START
174 ZEND_PARSE_PARAMETERS_START(1, 7) 180 ZEND_PARSE_PARAMETERS_START(1, 7)
175 Z_PARAM_STR(name) 181 Z_PARAM_STR(name)
@@ -197,7 +203,7 @@ PHP_FUNCTION(sp_setcookie) {
197 203
198 /* lookup existing configuration for said cookie */ 204 /* lookup existing configuration for said cookie */
199 cookie_node = sp_lookup_cookie_config(ZSTR_VAL(name)); 205 cookie_node = sp_lookup_cookie_config(ZSTR_VAL(name));
200 206
201 /* If the cookie's value is encrypted, it won't be usable by 207 /* If the cookie's value is encrypted, it won't be usable by
202 * javascript anyway. 208 * javascript anyway.
203 */ 209 */
@@ -233,12 +239,15 @@ PHP_FUNCTION(sp_setcookie) {
233 if (!path) { 239 if (!path) {
234 path = zend_string_init("", 0, 0); 240 path = zend_string_init("", 0, 0);
235 } 241 }
236 cookie_samesite = (cookie_node->samesite == lax) ? SAMESITE_COOKIE_FORMAT SP_TOKEN_SAMESITE_LAX 242 cookie_samesite = (cookie_node->samesite == lax)
237 : SAMESITE_COOKIE_FORMAT SP_TOKEN_SAMESITE_STRICT; 243 ? SAMESITE_COOKIE_FORMAT SP_TOKEN_SAMESITE_LAX
244 : SAMESITE_COOKIE_FORMAT SP_TOKEN_SAMESITE_STRICT;
238 /* Concatenating everything, as is in PHP internals */ 245 /* Concatenating everything, as is in PHP internals */
239 samesite = zend_string_init(ZSTR_VAL(path), ZSTR_LEN(path), 0); 246 samesite = zend_string_init(ZSTR_VAL(path), ZSTR_LEN(path), 0);
240 samesite = zend_string_extend(samesite, ZSTR_LEN(path) + strlen(cookie_samesite) + 1, 0); 247 samesite = zend_string_extend(
241 memcpy(ZSTR_VAL(samesite) + ZSTR_LEN(path), cookie_samesite, strlen(cookie_samesite) + 1); 248 samesite, ZSTR_LEN(path) + strlen(cookie_samesite) + 1, 0);
249 memcpy(ZSTR_VAL(samesite) + ZSTR_LEN(path), cookie_samesite,
250 strlen(cookie_samesite) + 1);
242 ZVAL_STR_COPY(&params[3], samesite); 251 ZVAL_STR_COPY(&params[3], samesite);
243 } else if (path) { 252 } else if (path) {
244 ZVAL_STR_COPY(&params[3], path); 253 ZVAL_STR_COPY(&params[3], path);
@@ -250,20 +259,22 @@ PHP_FUNCTION(sp_setcookie) {
250 This is why were replacing our hook with the original function, calling 259 This is why were replacing our hook with the original function, calling
251 the function, and then re-hooking it. */ 260 the function, and then re-hooking it. */
252 void (*handler)(INTERNAL_FUNCTION_PARAMETERS); 261 void (*handler)(INTERNAL_FUNCTION_PARAMETERS);
253 handler = zend_hash_str_find_ptr(SNUFFLEUPAGUS_G(sp_internal_functions_hook), "setcookie", 262 handler = zend_hash_str_find_ptr(SNUFFLEUPAGUS_G(sp_internal_functions_hook),
254 strlen("setcookie")); 263 "setcookie", strlen("setcookie"));
255 zend_internal_function *func = zend_hash_str_find_ptr( 264 zend_internal_function *func = zend_hash_str_find_ptr(
256 CG(function_table), "setcookie", strlen("setcookie")); 265 CG(function_table), "setcookie", strlen("setcookie"));
257 func->handler = handler; 266 func->handler = handler;
258 267
259 call_user_function(CG(function_table), NULL, &func_name, return_value, 7, params); 268 call_user_function(CG(function_table), NULL, &func_name, return_value, 7,
269 params);
260 270
261 func->handler = PHP_FN(sp_setcookie); 271 func->handler = PHP_FN(sp_setcookie);
262 RETURN_TRUE; 272 RETURN_TRUE;
263} 273}
264 274
265int hook_cookies() { 275int hook_cookies() {
266 HOOK_FUNCTION("setcookie", sp_internal_functions_hook, PHP_FN(sp_setcookie), false); 276 HOOK_FUNCTION("setcookie", sp_internal_functions_hook, PHP_FN(sp_setcookie),
277 false);
267 278
268 return SUCCESS; 279 return SUCCESS;
269} 280}