Skip to content

Commit 4e705e7

Browse files
Easton97-JensEaston97-Jens
committed
SHA-256 Implementierung on ModSecurity (mbed TLS 4.x)
1 parent 5dab580 commit 4e705e7

File tree

4 files changed

+92
-57
lines changed

4 files changed

+92
-57
lines changed

‎src/unique_id.cc‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,9 @@
5656
#endif
5757
#include <string.h>
5858

59-
#include "src/utils/sha1.h"
59+
/*#include "src/utils/sha1.h"*/
60+
#include "src/utils/sha256.h"
61+
6062

6163
namespace modsecurity {
6264

@@ -72,7 +74,9 @@ void UniqueId::fillUniqueId() {
7274

7375
data = macAddress + name;
7476

75-
this->uniqueId_str = Utils::Sha1::hexdigest(data);
77+
/*this->uniqueId_str = Utils::Sha1::hexdigest(data);*/
78+
this->uniqueId_str = Utils::Sha256::hexdigest(data);
79+
7680
}
7781

7882
// Based on:
@@ -235,4 +239,4 @@ std::string UniqueId::ethernetMacAddress() {
235239
}
236240

237241

238-
} // namespace modsecurity
242+
} // namespace modsecurity

‎src/utils/md5.h‎

Lines changed: 9 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -8,27 +8,20 @@
88
#ifndef SRC_UTILS_MD5_H_
99
#define SRC_UTILS_MD5_H_
1010

11-
#include "src/utils/sha1.h" // bringt DigestImpl und psa/crypto.h rein
11+
#include "src/utils/sha1.h" // nutzt DigestImpl + detail::ensure_psa_init()
1212
#include <string>
1313

14+
#include <psa/crypto.h> // optional (weil sha1.h es schon inkludiert), aber ok
15+
1416
namespace modsecurity::Utils {
1517

16-
// Wrapper mit gleicher Signatur wie mbedtls_md5,
17-
// intern aber PSA-API.
18+
// PSA-Wrapper mit alter Signatur
1819
inline int modsec_psa_md5(const unsigned char *input,
1920
size_t ilen,
2021
unsigned char output[16])
2122
{
22-
// sha1.h macht bereits ein lazy psa_crypto_init() in modsec_psa_sha1,
23-
// aber falls MD5 vor SHA1 benutzt wird, sorgen wir hier auch nochmal vor.
24-
static bool psa_initialized = false;
25-
26-
if (!psa_initialized) {
27-
psa_status_t init_status = psa_crypto_init();
28-
if (init_status != PSA_SUCCESS) {
29-
return -1;
30-
}
31-
psa_initialized = true;
23+
if (!detail::ensure_psa_init()) {
24+
return -1;
3225
}
3326

3427
size_t out_len = 0;
@@ -41,17 +34,11 @@ inline int modsec_psa_md5(const unsigned char *input,
4134
&out_len
4235
);
4336

44-
if (status != PSA_SUCCESS || out_len != 16) {
45-
return -1;
46-
}
47-
48-
return 0;
37+
return (status == PSA_SUCCESS && out_len == 16) ? 0 : -1;
4938
}
5039

51-
// Statt &mbedtls_md5 benutzen wir jetzt &modsec_psa_md5.
52-
class Md5 : public DigestImpl<&modsec_psa_md5, 16> {
53-
};
40+
class Md5 : public DigestImpl<&modsec_psa_md5, 16> {};
5441

5542
} // namespace modsecurity::Utils
5643

57-
#endif // SRC_UTILS_MD5_H_
44+
#endif // SRC_UTILS_MD5_H_

‎src/utils/sha1.h‎

Lines changed: 42 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -10,69 +10,85 @@
1010

1111
#include <string>
1212
#include <string_view>
13-
#include <cassert>
13+
#include <mutex> // NEW: std::once_flag, std::call_once
1414

1515
#include "src/utils/string.h"
1616

17-
// NEU: PSA statt mbedtls/sha1.h
17+
// PSA statt mbedtls/sha1.h
1818
#include <psa/crypto.h>
1919

2020
namespace modsecurity::Utils {
2121

2222
using DigestOp = int (*)(const unsigned char *, size_t, unsigned char []);
2323

24+
// Gemeinsamer, thread-sicherer PSA-Init für alle Digests
25+
namespace detail {
26+
inline bool ensure_psa_init() {
27+
static std::once_flag once;
28+
static psa_status_t init_status = PSA_ERROR_GENERIC_ERROR;
29+
30+
std::call_once(once, []() {
31+
init_status = psa_crypto_init();
32+
});
33+
34+
return init_status == PSA_SUCCESS;
35+
}
36+
} // namespace detail
37+
2438

2539
template<DigestOp digestOp, int DigestSize>
2640
class DigestImpl {
2741
public:
2842
static std::string digest(const std::string& input) {
29-
return digestHelper(input, [](const auto digest) {
43+
return digestHelper(input, [](std::string_view digest) {
3044
return std::string(digest);
3145
});
3246
}
3347

3448
static void digestReplace(std::string& value) {
35-
digestHelper(value, [&value](const auto digest) mutable {
36-
value = digest;
49+
digestHelper(value, [&value](std::string_view digest) mutable {
50+
value.assign(digest.data(), digest.size());
3751
});
3852
}
3953

4054
static std::string hexdigest(const std::string &input) {
41-
return digestHelper(input, [](const auto digest) {
55+
return digestHelper(input, [](std::string_view digest) {
4256
return utils::string::string_to_hex(digest);
4357
});
4458
}
4559

4660
private:
4761
template<typename ConvertOp>
48-
static auto digestHelper(const std::string &input,
49-
ConvertOp convertOp) -> auto {
50-
char digest[DigestSize];
62+
static auto digestHelper(const std::string &input, ConvertOp convertOp)
63+
-> decltype(convertOp(std::string_view{})) {
5164

52-
const auto ret = (*digestOp)(
53-
reinterpret_cast<const unsigned char *>(input.c_str()),
65+
unsigned char digest[DigestSize];
66+
67+
const int ret = (*digestOp)(
68+
reinterpret_cast<const unsigned char *>(input.data()),
5469
input.size(),
55-
reinterpret_cast<unsigned char *>(digest)
70+
digest
5671
);
57-
assert(ret == 0);
5872

59-
return convertOp(std::string_view(digest, DigestSize));
73+
// NEW: kein assert-only; in Release sonst potentiell UB.
74+
if (ret != 0) {
75+
return convertOp(std::string_view{}); // leerer Digest signalisiert Fehler
76+
}
77+
78+
return convertOp(std::string_view(
79+
reinterpret_cast<const char*>(digest), DigestSize
80+
));
6081
}
6182
};
6283

63-
// NEU: Wrapper, der die PSA-API in die alte Signatur presst.
84+
85+
// PSA-Wrapper mit alter Signatur
6486
inline int modsec_psa_sha1(const unsigned char *input,
6587
size_t ilen,
6688
unsigned char output[20])
6789
{
68-
static bool psa_initialized = false;
69-
70-
if (!psa_initialized) {
71-
psa_status_t init_status = psa_crypto_init();
72-
if (init_status != PSA_SUCCESS) {
73-
return -1;
74-
}
75-
psa_initialized = true;
90+
if (!detail::ensure_psa_init()) {
91+
return -1;
7692
}
7793

7894
size_t out_len = 0;
@@ -85,17 +101,11 @@ inline int modsec_psa_sha1(const unsigned char *input,
85101
&out_len
86102
);
87103

88-
if (status != PSA_SUCCESS || out_len != 20) {
89-
return -1;
90-
}
91-
92-
return 0;
104+
return (status == PSA_SUCCESS && out_len == 20) ? 0 : -1;
93105
}
94106

95-
// Statt &mbedtls_sha1 nehmen wir jetzt unseren PSA-Wrapper
96-
class Sha1 : public DigestImpl<&modsec_psa_sha1, 20> {
97-
};
107+
class Sha1 : public DigestImpl<&modsec_psa_sha1, 20> {};
98108

99109
} // namespace modsecurity::Utils
100110

101-
#endif // SRC_UTILS_SHA1_H_
111+
#endif // SRC_UTILS_SHA1_H_

‎src/utils/sha256.h‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#ifndef SRC_UTILS_SHA256_H_
2+
#define SRC_UTILS_SHA256_H_
3+
4+
#include "src/utils/sha1.h" // bringt DigestImpl + detail::ensure_psa_init()
5+
#include <psa/crypto.h>
6+
7+
namespace modsecurity::Utils {
8+
9+
inline int modsec_psa_sha256(const unsigned char *input,
10+
size_t ilen,
11+
unsigned char output[32])
12+
{
13+
if (!detail::ensure_psa_init()) {
14+
return -1;
15+
}
16+
17+
size_t out_len = 0;
18+
psa_status_t status = psa_hash_compute(
19+
PSA_ALG_SHA_256,
20+
input,
21+
ilen,
22+
output,
23+
32,
24+
&out_len
25+
);
26+
27+
return (status == PSA_SUCCESS && out_len == 32) ? 0 : -1;
28+
}
29+
30+
class Sha256 : public DigestImpl<&modsec_psa_sha256, 32> {};
31+
32+
} // namespace modsecurity::Utils
33+
34+
#endif // SRC_UTILS_SHA256_H_

0 commit comments

Comments
 (0)