openharmony/third_party_openhitls
1
0
Fork 0
mirror of https://github.com/openharmony/third_party_openhitls.git synced 2026-07-01 10:05:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden app command security handling

Browse Source 
Harden newly added app command paths and keep command-line behavior aligned with supported functionality.

- restrict enc output files and SM key-store files to owner-only permissions

- fail closed for explicitly configured CA files and enforce s_client host identity checks

- keep TLS app mode TLS-only and require client certificates when server verification is enabled

- validate SM key UUID inputs and preserve IPv4 split allocation bases during SAN parsing

- apply stdin size limits, cast ctype inputs safely, and honor errdecode -hex parsing

- reject unsupported GMAC/AES-WRAP/prime -safe command paths and update documentation

- apply pkcs12 algorithm options and add focused SDV coverage for the fixed paths

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1463

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
This commit is contained in:
dny
2026-05-18 20:36:54 +08:00
committed by Dongjianwei001
parent d52e42f5e1
commit df6b1a292c
24 changed files with 438 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/src/app_client.c
+9
View File
@@ -31,6 +31,7 @@
#include "app_keymgmt.h"
#include "app_utils.h"
#include "hitls.h"
#include "hitls_cert.h"
#include "hitls_cert_init.h"
#include "hitls_session.h"
#include "crypt_errno.h"
@@ -424,6 +425,14 @@ static HITLS_Config *CreateClientConfig(HITLS_ClientParams *params)
HITLS_CFG_FreeConfig(config);
return NULL;
}
if (!params->verifyNone) {
ret = HITLS_CFG_SetHost(config, params->host);
if (ret != HITLS_SUCCESS) {
AppPrintError("Failed to set verification host: 0x%x\n", ret);
HITLS_CFG_FreeConfig(config);
return NULL;
}
}
/* Configure client certificate if provided */
if (protocol == APP_PROTOCOL_TLCP || protocol == APP_PROTOCOL_DTLCP) {
apps/src/app_conf.c
+9 -6
View File
@@ -95,7 +95,7 @@ static X509KeyUsageMap g_exKuMap[] = {
static int32_t FindEndIdx(char *str, char separator, int32_t beginIdx, int32_t currIdx, bool allowEmpty)
{
while (currIdx >= 0 && (isspace(str[currIdx]) || str[currIdx] == separator)) {
while (currIdx >= 0 && (isspace((unsigned char)str[currIdx]) || str[currIdx] == separator)) {
currIdx--;
}
if (beginIdx < currIdx) {
@@ -112,7 +112,8 @@ static int32_t FindEndIdx(char *str, char separator, int32_t beginIdx, int32_t c
int32_t HITLS_APP_SplitString(const char *str, char separator, bool allowEmpty, char **strArr, uint32_t maxArrCnt,
uint32_t *realCnt)
{
if (str == NULL || strlen(str) == 0 || isspace(separator) || strArr == NULL || maxArrCnt == 0 || realCnt == NULL) {
if (str == NULL || strlen(str) == 0 || isspace((unsigned char)separator) || strArr == NULL || maxArrCnt == 0 ||
realCnt == NULL) {
return HITLS_APP_INVALID_ARG;
}
@@ -133,7 +134,7 @@ int32_t HITLS_APP_SplitString(const char *str, char separator, bool allowEmpty,
*realCnt = 0;
for (int32_t i = 0; i < len; i++) {
if (!hasBegin) {
if (isspace(res[i])) {
if (isspace((unsigned char)res[i])) {
continue;
}
if (*realCnt == maxArrCnt) {
@@ -509,6 +510,7 @@ static int32_t ParseIPValue(char *value, HITLS_X509_GeneralName *generalName)
struct sockaddr_in sockIpv4 = {};
struct sockaddr_in6 sockIpv6 = {};
char *ipv4ValueList[IPV4_VALUE_MAX_CNT] = {0};
char *ipv4ValueBase = NULL;
uint32_t ipSize = 0;
if (inet_pton(AF_INET, value, &(sockIpv4.sin_addr)) == 1) {
uint32_t valueCnt = 0;
@@ -516,9 +518,10 @@ static int32_t ParseIPValue(char *value, HITLS_X509_GeneralName *generalName)
if (ret != HITLS_APP_SUCCESS) {
return ret;
}
ipv4ValueBase = ipv4ValueList[0];
if (valueCnt != IPV4_VALUE_MAX_CNT) {
AppPrintError("Failed to split IP string, IP: %s.\n", value);
BSL_SAL_FREE(ipv4ValueList[0]);
BSL_SAL_FREE(ipv4ValueBase);
return HITLS_APP_INVALID_IP;
}
// Normalize IPv4 octets by removing leading zeros (cross-platform fix)
@@ -541,7 +544,7 @@ static int32_t ParseIPValue(char *value, HITLS_X509_GeneralName *generalName)
generalName->value.data = BSL_SAL_Calloc(ipSize, 1);
if (generalName->value.data == NULL) {
AppPrintError("Invalid IP format for directory name, IP: %s.\n", value);
BSL_SAL_FREE(ipv4ValueList[0]);
BSL_SAL_FREE(ipv4ValueBase);
return HITLS_APP_MEM_ALLOC_FAIL;
}
for (uint32_t i = 0; i < ipSize; i++) {
@@ -552,7 +555,7 @@ static int32_t ParseIPValue(char *value, HITLS_X509_GeneralName *generalName)
}
}
generalName->value.dataLen = ipSize;
BSL_SAL_FREE(ipv4ValueList[0]);
BSL_SAL_FREE(ipv4ValueBase);
return HITLS_APP_SUCCESS;
}
apps/src/app_enc.c
+42
View File
@@ -90,6 +90,15 @@ static const uint32_t CIPHER_IS_XTS[] = {
CRYPT_CIPHER_SM4_XTS,
};
static const uint32_t CIPHER_IS_AES_WRAP[] = {
CRYPT_CIPHER_AES128_WRAP_NOPAD,
CRYPT_CIPHER_AES128_WRAP_PAD,
CRYPT_CIPHER_AES192_WRAP_NOPAD,
CRYPT_CIPHER_AES192_WRAP_PAD,
CRYPT_CIPHER_AES256_WRAP_NOPAD,
CRYPT_CIPHER_AES256_WRAP_PAD,
};
typedef struct {
char *pass;
uint32_t passLen;
@@ -185,6 +194,16 @@ static int32_t GetMacId(const char *name)
return HITLS_APP_GetCidByName(name, HITLS_APP_LIST_OPT_MD_TO_MAC_ALG);
}
static bool IsAesWrapCipher(int32_t cipherId)
{
for (uint32_t i = 0; i < sizeof(CIPHER_IS_AES_WRAP) / sizeof(CIPHER_IS_AES_WRAP[0]); ++i) {
if ((uint32_t)cipherId == CIPHER_IS_AES_WRAP[i]) {
return true;
}
}
return false;
}
// process for the ENC to receive subordinate options
static int32_t HandleOpt(EncCmdOpt *encOpt)
{
@@ -274,6 +293,10 @@ static int32_t CheckParam(EncCmdOpt *encOpt)
AppPrintError("Use -help for summary.\n");
return HITLS_APP_OPT_VALUE_INVALID;
}
if (IsAesWrapCipher(encOpt->cipherId)) {
AppPrintError("enc: AES-WRAP algorithms are not supported.\n");
return HITLS_APP_OPT_VALUE_INVALID;
}
// if the user does not specify the encryption or decryption mode,
// an error is reported and the user is prompted to enter the following information
if (encOpt->encTag != 1 && encOpt->encTag != 0) {
@@ -307,6 +330,18 @@ static int32_t CheckParam(EncCmdOpt *encOpt)
return HITLS_APP_SUCCESS;
}
static int32_t SetOutputFilePermission(const char *outFile)
{
if (outFile == NULL) {
return HITLS_APP_SUCCESS;
}
if (chmod(outFile, S_IRUSR | S_IWUSR) != 0) {
AppPrintError("enc: Failed to set output file permission.\n");
return HITLS_APP_UIO_FAIL;
}
return HITLS_APP_SUCCESS;
}
// enc determines the input and output paths
static int32_t HandleIO(EncCmdOpt *encOpt)
{
@@ -327,6 +362,13 @@ static int32_t HandleIO(EncCmdOpt *encOpt)
AppPrintError("enc: Failed to create the output pipeline.\n");
return HITLS_APP_UIO_FAIL;
}
if (SetOutputFilePermission(encOpt->outFile) != HITLS_APP_SUCCESS) {
BSL_UIO_Free(encOpt->encUio->rUio);
BSL_UIO_Free(encOpt->encUio->wUio);
encOpt->encUio->rUio = NULL;
encOpt->encUio->wUio = NULL;
return HITLS_APP_UIO_FAIL;
}
return HITLS_APP_SUCCESS;
}
apps/src/app_keymgmt.c
+100 -5
View File
@@ -18,6 +18,7 @@
#include <stdbool.h>
#include <dirent.h>
#include <limits.h>
#include <sys/stat.h>
#include "securec.h"
#include "bsl_uio.h"
#include "crypt_eal_rand.h"
@@ -156,6 +157,68 @@ static char *GetPubKeyFilePath(const char *workPath, const char *uuid)
return GetKeyFullPath(workPath, uuid, "-pub.pem");
}
static bool IsUuidHexChar(char c)
{
return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
}
static bool IsValidKeyUuid(const char *uuid)
{
if (uuid == NULL) {
return false;
}
for (uint32_t i = 0; i < APP_KEYMGMT_UUID_STR_SIZE - 1; i++) {
if (!IsUuidHexChar(uuid[i])) {
return false;
}
}
return uuid[APP_KEYMGMT_UUID_STR_SIZE - 1] == '\0';
}
static bool IsValidKeyUuidList(const char *uuidList)
{
if (uuidList == NULL || uuidList[0] == '\0') {
return false;
}
uint32_t uuidLen = 0;
for (const char *cur = uuidList; ; cur++) {
if (*cur == ',' || *cur == '\0') {
if (uuidLen != APP_KEYMGMT_UUID_STR_SIZE - 1) {
return false;
}
if (*cur == '\0') {
return true;
}
uuidLen = 0;
continue;
}
if (!IsUuidHexChar(*cur) || uuidLen >= APP_KEYMGMT_UUID_STR_SIZE - 1) {
return false;
}
uuidLen++;
}
}
static int32_t CheckUuid(const char *uuid)
{
if (!IsValidKeyUuid(uuid)) {
AppPrintError("keymgmt: Invalid uuid, expect %u hex characters.\n", APP_KEYMGMT_UUID_STR_SIZE - 1);
return HITLS_APP_INVALID_ARG;
}
return HITLS_APP_SUCCESS;
}
static int32_t CheckUuidList(const char *uuidList)
{
if (!IsValidKeyUuidList(uuidList)) {
AppPrintError("keymgmt: Invalid uuid list, expect comma-separated %u-hex-character uuid values.\n",
APP_KEYMGMT_UUID_STR_SIZE - 1);
return HITLS_APP_INVALID_ARG;
}
return HITLS_APP_SUCCESS;
}
static int32_t WriteKeyFile(KeyMgmtCmdOpt *keyMgmtOpt, const char *uuid, HITLS_PKCS12 *p12)
{
CRYPT_Pbkdf2Param pbkdf2Param = {0};
@@ -194,11 +257,17 @@ static int32_t WriteKeyFile(KeyMgmtCmdOpt *keyMgmtOpt, const char *uuid, HITLS_P
}
int32_t ret = HITLS_PKCS12_GenFile(BSL_FORMAT_ASN1, p12, &encodeParam, true, path);
BSL_SAL_Free(path);
if (ret != HITLS_PKI_SUCCESS) {
BSL_SAL_Free(path);
AppPrintError("keymgmt: Failed to generate pkcs12 key file, errCode: 0x%x.\n", ret);
return HITLS_APP_X509_FAIL;
}
if (chmod(path, S_IRUSR | S_IWUSR) != 0) {
BSL_SAL_Free(path);
AppPrintError("keymgmt: Failed to set key file permission.\n");
return HITLS_APP_UIO_FAIL;
}
BSL_SAL_Free(path);
return HITLS_APP_SUCCESS;
}
@@ -483,12 +552,16 @@ static int32_t EraseKeyFile(char *path)
static int32_t HITLS_APP_RmvKey(KeyMgmtCmdOpt *keyMgmtOpt, const char *uuid)
{
int32_t ret = CheckUuid(uuid);
if (ret != HITLS_APP_SUCCESS) {
return ret;
}
char *path = GetKeyFilePath(keyMgmtOpt->smParam->workPath, uuid);
if (path == NULL) {
return HITLS_APP_INVALID_ARG;
}
keyMgmtOpt->smParam->status = HITLS_APP_SM_STATUS_APPORVED;
int32_t ret = EraseKeyFile(path);
ret = EraseKeyFile(path);
if (ret != HITLS_APP_SUCCESS) {
BSL_SAL_Free(path);
return ret;
@@ -622,6 +695,11 @@ static int32_t CheckOptParam(KeyMgmtCmdOpt *keyMgmtOpt)
AppPrintError("keymgmt: The uuid is not specified.\n");
return HITLS_APP_OPT_VALUE_INVALID;
}
ret = keyMgmtOpt->deleteTag == 1 ? CheckUuidList(keyMgmtOpt->smParam->uuid) :
CheckUuid(keyMgmtOpt->smParam->uuid);
if (ret != HITLS_APP_SUCCESS) {
return HITLS_APP_OPT_VALUE_INVALID;
}
return HITLS_APP_SUCCESS;
}
@@ -663,6 +741,11 @@ static int32_t CreateKey(KeyMgmtCmdOpt *keyMgmtOpt)
static int32_t SplitUuidString(const char *uuid, BslList **uuidList)
{
int32_t ret = CheckUuidList(uuid);
if (ret != HITLS_APP_SUCCESS) {
return ret;
}
char *src = BSL_SAL_Dump(uuid, strlen(uuid) + 1);
if (src == NULL) {
AppPrintError("keymgmt: Failed to dump uuid string.\n");
@@ -687,7 +770,7 @@ static int32_t SplitUuidString(const char *uuid, BslList **uuidList)
AppPrintError("keymgmt: Failed to dump single uuid string.\n");
return HITLS_APP_MEM_ALLOC_FAIL;
}
int32_t ret = BSL_LIST_AddElement(list, singleUuid, BSL_LIST_POS_END);
ret = BSL_LIST_AddElement(list, singleUuid, BSL_LIST_POS_END);
if (ret != BSL_SUCCESS) {
BSL_SAL_FREE(singleUuid);
BSL_SAL_FREE(src);
@@ -735,7 +818,15 @@ static bool IsP12File(const char *file)
if (fileLen != 2 * HITLS_APP_UUID_LEN + strlen(suffix)) { // 2: one byte to two hex chars.
return false;
}
return strcmp(file + fileLen - strlen(suffix), suffix) == 0;
if (strcmp(file + fileLen - strlen(suffix), suffix) != 0) {
return false;
}
for (uint32_t i = 0; i < APP_KEYMGMT_UUID_STR_SIZE - 1; i++) {
if (!IsUuidHexChar(file[i])) {
return false;
}
}
return true;
}
static int32_t GetAllKeyUuids(const char *workPath, BslList **fileList)
@@ -852,6 +943,10 @@ static int32_t SelfTest(KeyMgmtCmdOpt *keyMgmtOpt)
static int32_t ReadKeyFile(AppProvider *provider, HITLS_APP_SM_Param *smParam, HITLS_PKCS12 **p12)
{
int32_t ret = CheckUuid(smParam->uuid);
if (ret != HITLS_APP_SUCCESS) {
return ret;
}
char *path = GetKeyFilePath(smParam->workPath, smParam->uuid);
if (path == NULL) {
AppPrintError("keymgmt: Failed to get key full path.\n");
@@ -866,7 +961,7 @@ static int32_t ReadKeyFile(AppProvider *provider, HITLS_APP_SM_Param *smParam, H
pwdParam.encPwd = &encPwd;
pwdParam.macPwd = &encPwd;
int32_t ret = HITLS_PKCS12_ProviderParseFile(APP_GetCurrent_LibCtx(), provider->providerAttr, "ASN1", path,
ret = HITLS_PKCS12_ProviderParseFile(APP_GetCurrent_LibCtx(), provider->providerAttr, "ASN1", path,
&pwdParam, p12, true);
BSL_SAL_Free(path);
if (ret != HITLS_PKI_SUCCESS) {
apps/src/app_list.c
-9
View File
@@ -61,8 +61,6 @@ static const CidInfo g_allCipherAlgInfo [] = {
{CRYPT_CIPHER_AES128_ECB, "aes128_ecb"},
{CRYPT_CIPHER_AES128_GCM, "aes128_gcm"},
{CRYPT_CIPHER_AES128_OFB, "aes128_ofb"},
{CRYPT_CIPHER_AES128_WRAP_NOPAD, "aes128-wrap-nopad"},
{CRYPT_CIPHER_AES128_WRAP_PAD, "aes128-wrap-pad"},
{CRYPT_CIPHER_AES128_XTS, "aes128_xts"},
{CRYPT_CIPHER_AES192_CBC, "aes192_cbc"},
{CRYPT_CIPHER_AES192_CCM, "aes192_ccm"},
@@ -71,8 +69,6 @@ static const CidInfo g_allCipherAlgInfo [] = {
{CRYPT_CIPHER_AES192_ECB, "aes192_ecb"},
{CRYPT_CIPHER_AES192_GCM, "aes192_gcm"},
{CRYPT_CIPHER_AES192_OFB, "aes192_ofb"},
{CRYPT_CIPHER_AES192_WRAP_NOPAD, "aes192-wrap-nopad"},
{CRYPT_CIPHER_AES192_WRAP_PAD, "aes192-wrap-pad"},
{CRYPT_CIPHER_AES256_CBC, "aes256_cbc"},
{CRYPT_CIPHER_AES256_CCM, "aes256_ccm"},
{CRYPT_CIPHER_AES256_CFB, "aes256_cfb"},
@@ -80,8 +76,6 @@ static const CidInfo g_allCipherAlgInfo [] = {
{CRYPT_CIPHER_AES256_ECB, "aes256_ecb"},
{CRYPT_CIPHER_AES256_GCM, "aes256_gcm"},
{CRYPT_CIPHER_AES256_OFB, "aes256_ofb"},
{CRYPT_CIPHER_AES256_WRAP_NOPAD, "aes256-wrap-nopad"},
{CRYPT_CIPHER_AES256_WRAP_PAD, "aes256-wrap-pad"},
{CRYPT_CIPHER_AES256_XTS, "aes256_xts"},
{CRYPT_CIPHER_CHACHA20_POLY1305, "chacha20_poly1305"},
{CRYPT_CIPHER_SM4_CBC, "sm4_cbc"},
@@ -141,9 +135,6 @@ static const CidInfo g_allMacAlgInfo[] = {
{CRYPT_MAC_CMAC_AES128, "cmac_aes128"},
{CRYPT_MAC_CMAC_AES192, "cmac_aes192"},
{CRYPT_MAC_CMAC_AES256, "cmac_aes256"},
{CRYPT_MAC_GMAC_AES128, "gmac_aes128"},
{CRYPT_MAC_GMAC_AES192, "gmac_aes192"},
{CRYPT_MAC_GMAC_AES256, "gmac_aes256"},
{CRYPT_MAC_SIPHASH64, "siphash64"},
{CRYPT_MAC_SIPHASH128, "siphash128"},
{CRYPT_MAC_CBC_MAC_SM4, "sm4_cbc_mac"},
apps/src/app_mac.c
+5
View File
@@ -148,6 +148,11 @@ static int32_t MacOptAlg(MacOpt *macOpt)
if (macOpt->algId == BSL_CID_UNKNOWN) {
return HITLS_APP_OPT_VALUE_INVALID;
}
if (macOpt->algId == CRYPT_MAC_GMAC_AES128 || macOpt->algId == CRYPT_MAC_GMAC_AES192 ||
macOpt->algId == CRYPT_MAC_GMAC_AES256) {
AppPrintError("mac: GMAC is not supported by this command.\n");
return HITLS_APP_OPT_VALUE_INVALID;
}
return HITLS_APP_SUCCESS;
}
apps/src/app_pkcs12.c
+3
View File
@@ -201,6 +201,7 @@ static int32_t ParseKeyPbe(Pkcs12OptCtx *opt)
HITLS_APP_PrintStdoutUioUnInit();
return HITLS_APP_OPT_VALUE_INVALID;
}
opt->keyPbe = ret;
return HITLS_APP_SUCCESS;
}
@@ -215,6 +216,7 @@ static int32_t ParseCertPbe(Pkcs12OptCtx *opt)
HITLS_APP_PrintStdoutUioUnInit();
return HITLS_APP_OPT_VALUE_INVALID;
}
opt->certPbe = ret;
return HITLS_APP_SUCCESS;
}
@@ -229,6 +231,7 @@ static int32_t ParseMacAlg(Pkcs12OptCtx *opt)
HITLS_APP_PrintStdoutUioUnInit();
return HITLS_APP_OPT_VALUE_INVALID;
}
opt->macAlg = ret;
return HITLS_APP_SUCCESS;
}
apps/src/app_prime.c
+4 -15
View File
@@ -30,14 +30,12 @@
#include "app_function.h"
#include "crypt_bn.h"
#define MIN_SAFE_PRIME_BITS 16 // Minimum bits for safe prime generation
#define DEFAULT_PRIME_CHECKS 64 // Default number of primality checks
typedef struct {
int32_t hex;
int32_t generate;
int32_t bits;
int32_t safe;
int32_t checks;
} AppPrimeCtx;
@@ -48,8 +46,7 @@ typedef enum OptionChoice {
OPT_BITS = 2,
OPT_HEX = 3,
OPT_GENERATE = 4,
OPT_SAFE = 5,
OPT_CHECKS = 6,
OPT_CHECKS = 5,
} OPTION_CHOICE;
static const HITLS_CmdOption g_primeOpts[] = {
@@ -57,7 +54,6 @@ static const HITLS_CmdOption g_primeOpts[] = {
{"bits", OPT_BITS, HITLS_APP_OPT_VALUETYPE_POSITIVE_INT, "Size of number in bits"},
{"hex", OPT_HEX, HITLS_APP_OPT_VALUETYPE_NO_VALUE, "Hex output"},
{"generate", OPT_GENERATE, HITLS_APP_OPT_VALUETYPE_NO_VALUE, "Generate a prime"},
{"safe", OPT_SAFE, HITLS_APP_OPT_VALUETYPE_NO_VALUE, "Generate a safe prime"},
{"checks", OPT_CHECKS, HITLS_APP_OPT_VALUETYPE_POSITIVE_INT, "Number of checks"},
{NULL, 0, 0, NULL}
};
@@ -128,7 +124,7 @@ static int32_t ConvertPrimeToString(BN_BigNum *bn, int32_t hex)
return HITLS_APP_SUCCESS;
}
static int32_t GeneratePrime(int32_t bits, int32_t hex, int32_t safe)
static int32_t GeneratePrime(int32_t bits, int32_t hex)
{
int32_t ret;
BN_BigNum *bn = NULL;
@@ -147,13 +143,9 @@ static int32_t GeneratePrime(int32_t bits, int32_t hex, int32_t safe)
goto EXIT;
}
ret = BN_GenPrime(bn, NULL, (uint32_t)bits, (bool)safe, optimizer, NULL);
ret = BN_GenPrime(bn, NULL, (uint32_t)bits, false, optimizer, NULL);
if (ret != CRYPT_SUCCESS) {
AppPrintError("prime: Failed to generate prime, errCode: 0x%x\n", ret);
if (safe && bits < MIN_SAFE_PRIME_BITS) {
AppPrintError("prime: Safe prime generation may require more bits (minimum %d)\n",
MIN_SAFE_PRIME_BITS);
}
ret = HITLS_APP_CRYPTO_FAIL;
goto EXIT;
}
@@ -203,9 +195,6 @@ static int32_t ProcessOptionSwitch(OPTION_CHOICE option, AppPrimeCtx *ctx)
case OPT_GENERATE:
ctx->generate = 1;
return HITLS_APP_SUCCESS;
case OPT_SAFE:
ctx->safe = 1;
return HITLS_APP_SUCCESS;
case OPT_CHECKS:
return HandleOptionChecks(&ctx->checks);
default:
@@ -293,7 +282,7 @@ int32_t HITLS_PrimeMain(int32_t argc, char **argv)
}
if (ctx.generate) {
ret = GeneratePrime(ctx.bits, ctx.hex, ctx.safe);
ret = GeneratePrime(ctx.bits, ctx.hex);
} else {
ret = CheckPrime(checkNumber, ctx.hex, ctx.checks);
}
apps/src/app_sm.c
+5
View File
@@ -18,6 +18,7 @@
#include <stddef.h>
#include <stdbool.h>
#ifdef HITLS_APP_SM_MODE
#include <sys/stat.h>
#include <unistd.h>
#endif
#include <securec.h>
@@ -294,6 +295,10 @@ static int32_t WriteUserFile(char *userFile, UserInfo *userInfo)
return HITLS_APP_UIO_FAIL;
}
BSL_UIO_Free(uio);
if (chmod(userFile, S_IRUSR | S_IWUSR) != 0) {
AppPrintError("Failed to set userFile permission: %s\n", userFile);
return HITLS_APP_UIO_FAIL;
}
return HITLS_APP_SUCCESS;
}
apps/src/app_tls_common.c
+46 -25
View File
@@ -89,6 +89,14 @@ HITLS_Config *CreateProtocolConfig(APP_ProtocolType protocol, AppProvider *provi
if (config == NULL) {
AppPrintError("Failed to create protocol configuration\n");
}
if (protocol == APP_PROTOCOL_TLS) {
int32_t ret = HITLS_CFG_SetVersionForbid(config, TLCP_VERSION_BITS);
if (ret != HITLS_SUCCESS) {
HITLS_CFG_FreeConfig(config);
AppPrintError("Failed to disable TLCP for TLS protocol, errCode: 0x%x.\n", ret);
return NULL;
}
}
#ifdef HITLS_APP_SM_MODE
int32_t ret = HITLS_CFG_SetSessionTicketSupport(config, false);
if (ret != HITLS_SUCCESS) {
@@ -407,20 +415,23 @@ int ConfCertVerification(HITLS_Config *config, APP_CertConfig *certConfig,
int ret = HITLS_SUCCESS;
bool hasLoadedCA = false;
/* Load CA certificates */
if (certConfig && certConfig->caFile) {
HITLS_X509_Cert *ca_cert = LoadCertFromFile(certConfig->caFile, certConfig->certFormat, certConfig->provider);
if (ca_cert != NULL) {
ret = HITLS_CFG_AddCertToStore(config, ca_cert, TLS_CERT_STORE_TYPE_DEFAULT, true);
if (ret != HITLS_SUCCESS) {
AppPrintError("Failed to add CA certificate to store: 0x%x\n", ret);
HITLS_X509_CertFree(ca_cert);
return HITLS_APP_ERR_LOAD_CA;
}
HITLS_X509_CertFree(ca_cert);
hasLoadedCA = true;
}
}
/* Load CA certificates */
if (certConfig && certConfig->caFile) {
HITLS_X509_Cert *ca_cert = LoadCertFromFile(certConfig->caFile, certConfig->certFormat, certConfig->provider);
if (ca_cert == NULL) {
AppPrintError("Failed to load CA certificate from %s\n", certConfig->caFile);
return HITLS_APP_ERR_LOAD_CA;
}
ret = HITLS_CFG_AddCertToStore(config, ca_cert, TLS_CERT_STORE_TYPE_DEFAULT, true);
if (ret != HITLS_SUCCESS) {
AppPrintError("Failed to add CA certificate to store: 0x%x\n", ret);
HITLS_X509_CertFree(ca_cert);
return HITLS_APP_ERR_LOAD_CA;
}
HITLS_X509_CertFree(ca_cert);
hasLoadedCA = true;
}
if (certConfig && certConfig->caChain) {
HITLS_X509_List *certlist = NULL;
@@ -440,9 +451,12 @@ int ConfCertVerification(HITLS_Config *config, APP_CertConfig *certConfig,
}
}
BSL_LIST_FREE(certlist, (BSL_LIST_PFUNC_FREE)HITLS_X509_CertFree);
hasLoadedCA = true;
}
BSL_LIST_FREE(certlist, (BSL_LIST_PFUNC_FREE)HITLS_X509_CertFree);
if (ret != HITLS_SUCCESS) {
return ret;
}
hasLoadedCA = true;
}
/* If no CA certificate is configured, load default CA path */
if (!hasLoadedCA) {
@@ -458,14 +472,21 @@ int ConfCertVerification(HITLS_Config *config, APP_CertConfig *certConfig,
AppPrintError("Failed to disable server verification: 0x%x\n", ret);
return HITLS_APP_ERR_SET_VERIFY;
}
ret = HITLS_CFG_SetClientVerifySupport(config, verifyPeer);
if (ret != HITLS_SUCCESS) {
AppPrintError("Failed to set client verification: 0x%x\n", ret);
return HITLS_APP_ERR_SET_VERIFY;
}
/* Set verification depth */
if (verifyDepth > 0) {
ret = HITLS_CFG_SetClientVerifySupport(config, verifyPeer);
if (ret != HITLS_SUCCESS) {
AppPrintError("Failed to set client verification: 0x%x\n", ret);
return HITLS_APP_ERR_SET_VERIFY;
}
if (verifyPeer) {
ret = HITLS_CFG_SetNoClientCertSupport(config, false);
if (ret != HITLS_SUCCESS) {
AppPrintError("Failed to require client certificate: 0x%x\n", ret);
return HITLS_APP_ERR_SET_VERIFY;
}
}
/* Set verification depth */
if (verifyDepth > 0) {
ret = HITLS_CFG_SetVerifyDepth(config, verifyDepth);
if (ret != HITLS_SUCCESS) {
AppPrintError("Failed to set verification depth: 0x%x\n", ret);
apps/src/app_utils.c
+15 -8
View File
@@ -705,11 +705,12 @@ static int32_t ReadPemByUioSymbol(BSL_UIO *memUio, BSL_UIO *rUio, BSL_PEM_Symbol
return ret;
}
static int32_t ReadBlockFromStdin(BSL_UIO *memUio, BSL_UIO *rUio)
static int32_t ReadBlockFromStdin(BSL_UIO *memUio, BSL_UIO *rUio, uint32_t maxSize)
{
int32_t ret = HITLS_APP_UIO_FAIL;
uint32_t readLen;
uint32_t writeLen;
uint64_t totalLen = 0;
uint8_t *buf = (uint8_t *)BSL_SAL_Calloc(MAX_DIGEST_SIZE + 1, 1);
if (buf == NULL) {
return HITLS_APP_MEM_ALLOC_FAIL;
@@ -725,15 +726,20 @@ static int32_t ReadBlockFromStdin(BSL_UIO *memUio, BSL_UIO *rUio)
ret = HITLS_APP_SUCCESS;
break;
}
if (totalLen + readLen > maxSize) {
AppPrintError("The maximum file size is %ukb.\n", maxSize / 1024);
break;
}
if (BSL_UIO_Write(memUio, buf, readLen, &writeLen) != BSL_SUCCESS || writeLen != readLen) {
break;
}
totalLen += readLen;
}
BSL_SAL_FREE(buf);
return ret;
}
static int32_t ReadPemFromStdin(BSL_BufMem **data, BSL_PEM_Symbol *symbol)
static int32_t ReadPemFromStdin(BSL_BufMem **data, BSL_PEM_Symbol *symbol, uint32_t maxSize)
{
int32_t ret = HITLS_APP_UIO_FAIL;
BSL_UIO *memUio = BSL_UIO_New(BSL_UIO_MemMethod());
@@ -748,7 +754,7 @@ static int32_t ReadPemFromStdin(BSL_BufMem **data, BSL_PEM_Symbol *symbol)
return ret;
}
if (symbol == NULL || symbol->head == NULL || symbol->tail == NULL) {
ret = ReadBlockFromStdin(memUio, rUio);
ret = ReadBlockFromStdin(memUio, rUio, maxSize);
} else {
ret = ReadPemByUioSymbol(memUio, rUio, symbol);
}
@@ -786,7 +792,7 @@ int32_t HITLS_APP_ReadData(const char *path, BSL_PEM_Symbol *symbol, char *fileN
}
if (path == NULL) {
BSL_BufMem *buf = NULL;
if (ReadPemFromStdin(&buf, symbol) != HITLS_APP_SUCCESS) {
if (ReadPemFromStdin(&buf, symbol, APP_FILE_MAX_SIZE) != HITLS_APP_SUCCESS) {
AppPrintError("Failed to read %s from stdin.\n", fileName);
return HITLS_APP_UIO_FAIL;
}
@@ -1060,14 +1066,15 @@ int32_t HITLS_APP_ReadFileOrStdin(uint8_t **buf, uint64_t *bufLen, const char *i
// Special handling for stdin
if (inFile == NULL) {
BSL_Buffer data = {0};
int32_t ret = HITLS_APP_ReadData(NULL, NULL, "data", &data);
BSL_BufMem *data = NULL;
int32_t ret = ReadPemFromStdin(&data, NULL, maxSize);
if (ret != HITLS_APP_SUCCESS) {
AppPrintError("%s: Failed to read content from stdin\n", module);
return ret;
}
*buf = data.data;
*bufLen = data.dataLen;
*buf = (uint8_t *)data->data;
*bufLen = data->length;
BSL_SAL_Free(data);
return HITLS_APP_SUCCESS;
}
docs/en/4_User Guide/5_Command Line Guide.md
+6 -6
View File
@@ -31,7 +31,7 @@ The openHiTLS command source code is located in the apps directory, and the comp
||s_server|SSL/TLS server tool|
|**Other Utility Tools**|| |
||rand|Generate random numbers of specified length, supporting hexadecimal and Base64 encoded output|
||prime|Generate and test primes, support hexadecimal input/output, and generate safe primes|
||prime|Generate and test primes, support hexadecimal input/output|
## 1.2 Command Usage
@@ -106,9 +106,13 @@ hitls list -all-curves
### 3.2.1 enc
Symmetric encryption and decryption operations, supporting multiple symmetric algorithms
AES-WRAP algorithms are not supported by the `enc` command.
### 3.2.2 mac
Message authentication code calculation and verification
GMAC algorithms are not supported by the `mac` command.
### 3.2.3 dgst
Message digest calculation and digital signature operations
@@ -201,7 +205,7 @@ hitls rand -algorithm hmac-sha256 -hex 10
**Usage**:
```
hitls prime [-help] [-generate] [-bits num] [-safe] [-hex] [-checks num] [number]
hitls prime [-help] [-generate] [-bits num] [-hex] [-checks num] [number]
```
**Supported Options**:
@@ -210,7 +214,6 @@ hitls prime [-help] [-generate] [-bits num] [-safe] [-hex] [-checks num] [number
- `-bits <n>`: Specify the bit length of the prime to be generated
- `-hex`: Use hexadecimal format for input/output (decimal by default)
- `-generate`: Enable prime generation mode
- `-safe`: Generate a safe prime
- `-check <n>`: Number of iterations for primality testing (default: 64)
**Examples**:
@@ -228,9 +231,6 @@ hitls prime [-help] [-generate] [-bits num] [-safe] [-hex] [-checks num] [number
# Generate a 256-bit prime
./hitls prime -generate -bits 256
# Generate a 512-bit safe prime
./hitls prime -generate -bits 512 -safe
# Output in hexadecimal format
./hitls prime -generate -bits 128 -hex
```
docs/zh/4_使用指南/5_命令行指南.md
+6 -6
View File
@@ -31,7 +31,7 @@ openHiTLS命令源码位于apps目录下，编译结果为hitls，用户可运
||s_server|SSL/TLS服务端工具 |
|**其他实用工具**|| |
||rand|生成指定长度的随机数，支持十六进制和Base64编码输出 |
||prime|生成和检测素数，支持十六进制输入/输出和安全素数生成 |
||prime|生成和检测素数，支持十六进制输入/输出 |
## 1.2 命令使用方式
@@ -106,9 +106,13 @@ hitls list -all-curves
### 3.2.1 enc
对称加密和解密操作，支持多种对称算法
`enc` 命令不支持 AES-WRAP 算法。
### 3.2.2 mac
消息认证码计算和验证
`mac` 命令不支持 GMAC 算法。
### 3.2.3 dgst
消息摘要计算和数字签名操作
@@ -201,7 +205,7 @@ hitls rand -algorithm hmac-sha256 -hex 10
**用法**：
```
hitls prime [-help] [-generate] [-bits num] [-safe] [-hex] [-checks num] [number]
hitls prime [-help] [-generate] [-bits num] [-hex] [-checks num] [number]
```
**支持的选项**：
@@ -210,7 +214,6 @@ hitls prime [-help] [-generate] [-bits num] [-safe] [-hex] [-checks num] [number
- `-bits <n>`：指定生成素数的位数
- `-hex`：使用十六进制格式输入/输出，默认十进制格式
- `-generate`：生成素数模式
- `-safe`：生成安全素数
- `-checks <n>`：素数检测的迭代轮数，默认64轮
**示例**：
@@ -228,9 +231,6 @@ hitls prime [-help] [-generate] [-bits num] [-safe] [-hex] [-checks num] [number
# 生成 256 位素数
./hitls prime -generate -bits 256
# 生成 512 位安全素数
./hitls prime -generate -bits 512 -safe
# 以十六进制格式输出
./hitls prime -generate -bits 128 -hex
```
testcode/sdv/testcase/apps/test_suite_ut_app_conf.c
+6
View File
@@ -15,6 +15,7 @@
/* BEGIN_HEADER */
#include <stdint.h>
#include <string.h>
#include "hitls_pki_errno.h"
#include "hitls_csr_local.h"
@@ -155,6 +156,11 @@ void UT_HITLS_APP_conf_X509Ext_TC001(char *confPath, int expectLoadRet, int expe
ASSERT_NE(conf, NULL);
ASSERT_EQ(BSL_CONF_Load(conf, confPath), expectLoadRet);
if (expectLoadRet == HITLS_APP_SUCCESS) {
#if !(defined(__APPLE__) || defined(__MACH__))
if (strstr(confPath, "test_x509_ext_san_leading_zero_ipv4.cnf") != NULL) {
expectResult = HITLS_APP_INVALID_IP;
}
#endif
ASSERT_EQ(HITLS_APP_CONF_ProcExt(conf, "SAN", ProcExt, ext), expectResult);
if (expectResult == HITLS_APP_SUCCESS) {
ASSERT_EQ(HITLS_X509_EncodeExt(BSL_ASN1_TAG_CONSTRUCTED | BSL_ASN1_TAG_SET, ext->extList, &asnExt),
testcode/sdv/testcase/apps/test_suite_ut_app_conf.data
+3
View File
@@ -94,6 +94,9 @@ UT_HITLS_APP_conf_subj_TC002:
UT_HITLS_APP_conf_X509Ext_TC001
UT_HITLS_APP_conf_X509Ext_TC001:"../testdata/apps/app_conf/test_x509_ext_withsan.cnf":BSL_SUCCESS:HITLS_APP_SUCCESS:"3082011C3081B00603551D110481A83081A5810741414140636F6D810742424240636F6D861A485454503A2F2F736F6D65686F73742E636F6D2F434E3D666F6F820358585887040A0A0A0A871000A00000000000000000000000000000A4583056310B300906035504061302554B31233021060355040A0C1A4D79204F7267616E697A6174696F6E2C434E3D4D79204E616D653110300E060355040B0C074D7920556E69743110300E06035504030C074D79204E616D65300F0603551D130101FF040530030101FF300C0603551D0F0405030307FF8030480603551D250101FF043E303C06082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030806082B06010505070309"
UT_HITLS_APP_conf_X509Ext_TC001 IPv4 leading zero first octet
UT_HITLS_APP_conf_X509Ext_TC001:"../testdata/apps/app_conf/test_x509_ext_san_leading_zero_ipv4.cnf":BSL_SUCCESS:HITLS_APP_SUCCESS:"3082011C3081B00603551D110481A83081A5810741414140636F6D810742424240636F6D861A485454503A2F2F736F6D65686F73742E636F6D2F434E3D666F6F820358585887040A0A0A0A871000A00000000000000000000000000000A4583056310B300906035504061302554B31233021060355040A0C1A4D79204F7267616E697A6174696F6E2C434E3D4D79204E616D653110300E060355040B0C074D7920556E69743110300E06035504030C074D79204E616D65300F0603551D130101FF040530030101FF300C0603551D0F0405030307FF8030480603551D250101FF043E303C06082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030806082B06010505070309"
UT_HITLS_APP_conf_X509Ext_TC001 IPv4 test1
UT_HITLS_APP_conf_X509Ext_TC001:"../testdata/apps/app_conf/test_x509_ext_san_errorIpv4_1.cnf":BSL_SUCCESS:HITLS_APP_INVALID_IP:"00"
testcode/sdv/testcase/apps/test_suite_ut_app_keymgmt.c
+23 -2
View File
@@ -21,6 +21,7 @@
#include <dirent.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include "app_enc.h"
#include "app_keymgmt.h"
#include "app_dgst.h"
@@ -410,6 +411,9 @@ void UT_HITLS_APP_KEYMGMT_TC001(void)
STUB_REPLACE(HITLS_APP_SM_RootUserCheck, STUB_HITLS_APP_SM_RootUserCheck);
char *uuid = NULL;
char keyPath[1024] = {0};
struct stat st = {0};
mode_t oldMask = umask(0022);
char *argv[] = {"keymgmt", "-create", "-algid", "sm4", SM_PARAM, NULL};
ASSERT_EQ(AppTestInit(), HITLS_APP_SUCCESS);
@@ -419,6 +423,9 @@ void UT_HITLS_APP_KEYMGMT_TC001(void)
uuid = GetUuidFromP12(WORK_PATH);
ASSERT_TRUE(uuid != NULL);
snprintf(keyPath, sizeof(keyPath), "%s/%s.p12", WORK_PATH, uuid);
ASSERT_EQ(stat(keyPath, &st), 0);
ASSERT_EQ(st.st_mode & 0777, S_IRUSR | S_IWUSR);
ret = EncryptAndDecrypt(uuid, "sm4_cbc");
ASSERT_EQ(ret, HITLS_APP_SUCCESS);
@@ -439,6 +446,7 @@ void UT_HITLS_APP_KEYMGMT_TC001(void)
ASSERT_EQ(ret, HITLS_APP_SUCCESS);
EXIT:
(void)umask(oldMask);
BSL_SAL_FREE(uuid);
AppTestUninit();
STUB_RESTORE(BSL_UI_ReadPwdUtil);
@@ -646,6 +654,19 @@ void UT_HITLS_APP_KEYMGMT_TC005(void)
ret = HITLS_KeyMgmtMain(sizeof(argv7) / sizeof(argv7[0]) - 1, argv7);
ASSERT_EQ(ret, HITLS_APP_OPT_VALUE_INVALID);
// Case 8: Reject UUIDs that are not exactly 64 hex characters.
char invalidUuid[] = "../../target";
char *argv8[] = {"keymgmt", "-delete", SM_PARAM, "-uuid", invalidUuid, NULL};
ret = HITLS_KeyMgmtMain(sizeof(argv8) / sizeof(argv8[0]) - 1, argv8);
ASSERT_EQ(ret, HITLS_APP_OPT_VALUE_INVALID);
// Case 9: Reject invalid UUID elements in comma-separated lists.
char invalidUuidList[] =
"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef,../../target";
char *argv9[] = {"keymgmt", "-delete", SM_PARAM, "-uuid", invalidUuidList, NULL};
ret = HITLS_KeyMgmtMain(sizeof(argv9) / sizeof(argv9[0]) - 1, argv9);
ASSERT_EQ(ret, HITLS_APP_OPT_VALUE_INVALID);
EXIT:
AppTestUninit();
STUB_RESTORE(BSL_UI_ReadPwdUtil);
@@ -774,7 +795,7 @@ void UT_HITLS_APP_KEYMGMT_TC008(void)
ASSERT_EQ(AppTestInit(), HITLS_APP_SUCCESS);
// Test deleting a non-existent key - pass a randomly generated UUID
char fakeUuid[] = "1234567890abcdef1234567890abcdef";
char fakeUuid[] = "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
char *argv_delete[] = {"keymgmt", "-delete", SM_PARAM, "-uuid", fakeUuid, NULL};
int ret = HITLS_KeyMgmtMain(sizeof(argv_delete) / sizeof(argv_delete[0]) - 1, argv_delete);
@@ -920,7 +941,7 @@ void UT_HITLS_APP_KEYMGMT_TC010(void)
fclose(fp1);
// Construct a list containing existing and non-existing UUIDs
char fakeUuid[] = "1234567890abcdef1234567890abcdef";
char fakeUuid[] = "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
char uuidList[256];
// Note: Put the existing UUID first and the non-existing one after, to verify ordered deletion logic
snprintf(uuidList, sizeof(uuidList), "%s,%s", uuid1, fakeUuid);
testcode/sdv/testcase/apps/test_suite_ut_app_mac.data
+3
View File
@@ -13,6 +13,9 @@ UT_HITLS_APP_MAC_InvalidOpt_TC001:"mac -name hmac_sha256 -hexkey 0x1234G -in ../
"-key and hexkey": both specified
UT_HITLS_APP_MAC_InvalidOpt_TC001:"mac -name hmac_sha256 -key 123456 -hexkey 0x1234 -in ../testdata/apps/mac/test.txt":HITLS_APP_OPT_VALUE_INVALID
"-name": unsupported GMAC
UT_HITLS_APP_MAC_InvalidOpt_TC001:"mac -name gmac_aes128 -hexkey 0x00000000000000000000000000000000 -in ../testdata/apps/mac/test.txt":HITLS_APP_OPT_VALUE_INVALID
normal mac
UT_HITLS_APP_MAC_NormalOpt_TC001:"mac -name hmac_sha256 -key 123456 -in ../testdata/apps/mac/test.txt -out mac_out.out":"mac_out.out":"f959b969e71d0f3778b6265a2b06a032c9ac9dd20b51d33a7adc700a3e5df20b"
testcode/sdv/testcase/apps/test_suite_ut_app_pkcs12.c
+8 -2
View File
@@ -342,13 +342,19 @@ void UT_HITLS_APP_PKCS12_TC006(void)
char *argv[][18] = {
{"pkcs12", "-export", "-in", CERT, "-inkey", PRI_KEY, "-passin", "pass:12345678", "-chain", "-CAfile",
CHAIN, "-passout", "pass:12345678", "-out", "out.pfx", "-macalg", "sha224"},
{"pkcs12", "-export", "-in", CERT, "-inkey", PRI_KEY, "-passin", "pass:12345678", "-chain", "-CAfile",
CHAIN, "-passout", "pass:12345678", "-out", "out.pfx", "-macalg", "sha512"},
{"pkcs12", "-export", "-in", CERT, "-inkey", PRI_KEY, "-passin", "pass:12345678", "-chain", "-CAfile",
CHAIN, "-passout", "pass:12345678", "-out", "out.pfx", "-macalg", "INVALID_ALG"},
{"pkcs12", "-in", "out.pfx", "-passin", "pass:12345678", "-passout", "pass:12345678", "-out",
"decode_pfx.pem"},
};
OptTestData testData[] = {
{17, argv[0], HITLS_APP_SUCCESS},
{17, argv[1], HITLS_APP_OPT_VALUE_INVALID},
{17, argv[1], HITLS_APP_SUCCESS},
{17, argv[2], HITLS_APP_OPT_VALUE_INVALID},
{9, argv[3], HITLS_APP_SUCCESS},
};
ASSERT_EQ(AppPrintErrorUioInit(stderr), HITLS_APP_SUCCESS);
@@ -597,4 +603,4 @@ EXIT:
AppPrintErrorUioUnInit();
return;
}
/* END_CASE */
/* END_CASE */
testcode/sdv/testcase/apps/test_suite_ut_app_prime.c
+2 -2
View File
@@ -86,7 +86,7 @@ EXIT:
/**
* @test UT_HITLS_APP_prime_TC002
* @spec -
* @title Test safe prime generation
* @title Test unsupported safe prime option
*/
/* BEGIN_CASE */
void UT_HITLS_APP_prime_TC002(void)
@@ -96,7 +96,7 @@ void UT_HITLS_APP_prime_TC002(void)
};
OptTestData testData[] = {
{5, argv[0], HITLS_APP_SUCCESS},
{5, argv[0], HITLS_APP_INVALID_ARG},
};
ASSERT_EQ(AppPrintErrorUioInit(stderr), HITLS_APP_SUCCESS);
testcode/sdv/testcase/apps/test_suite_ut_app_sm.c
+41
View File
@@ -298,6 +298,47 @@ EXIT:
}
/* END_CASE */
/**
* @test UT_HITLS_APP_SM_TC004
* @spec -
* @title Test SM user file permission; expect 0600 even with permissive umask
*/
/* BEGIN_CASE */
void UT_HITLS_APP_SM_TC004(void)
{
#ifndef HITLS_APP_SM_MODE
SKIP_TEST();
#else
char *password = NULL;
char userFilePath[1024] = {0};
struct stat st = {0};
mode_t oldMask = umask(0022);
STUB_REPLACE(BSL_UI_ReadPwdUtil, STUB_BSL_UI_ReadPwdUtil);
STUB_REPLACE(HITLS_APP_SM_IntegrityCheck, STUB_HITLS_APP_SM_IntegrityCheck);
STUB_REPLACE(HITLS_APP_SM_RootUserCheck, STUB_HITLS_APP_SM_RootUserCheck);
system("rm -rf " WORK_PATH);
system("mkdir -p " WORK_PATH);
ASSERT_EQ(AppTestInit(), HITLS_APP_SUCCESS);
int32_t status = 0;
ASSERT_EQ(HITLS_APP_SM_Init(&g_appProvider, WORK_PATH, &password, &status), HITLS_APP_SUCCESS);
snprintf(userFilePath, sizeof(userFilePath), "%s/openhitls_user", WORK_PATH);
ASSERT_EQ(stat(userFilePath, &st), 0);
ASSERT_EQ(st.st_mode & 0777, S_IRUSR | S_IWUSR);
EXIT:
(void)umask(oldMask);
BSL_SAL_FREE(password);
AppTestUninit();
STUB_RESTORE(BSL_UI_ReadPwdUtil);
STUB_RESTORE(HITLS_APP_SM_IntegrityCheck);
STUB_RESTORE(HITLS_APP_SM_RootUserCheck);
#endif
}
/* END_CASE */
/**
* @test UT_HITLS_APP_SM_TC005
* @spec -
testcode/sdv/testcase/apps/test_suite_ut_app_sm.data
+3
View File
@@ -7,5 +7,8 @@ UT_HITLS_APP_SM_TC002:
UT_HITLS_APP_SM_TC003
UT_HITLS_APP_SM_TC003:
UT_HITLS_APP_SM_TC004
UT_HITLS_APP_SM_TC004:
UT_HITLS_APP_SM_TC005
UT_HITLS_APP_SM_TC005:
testcode/sdv/testcase/apps/test_suite_ut_enc.c
+78 -3
View File
@@ -18,11 +18,14 @@
#include <stdlib.h>
#include <string.h>
#include <stddef.h>
#include <sys/stat.h>
#include <unistd.h>
#include "app_enc.h"
#include "app_errno.h"
#include "app_help.h"
#include "app_print.h"
#include "app_opt.h"
#include "app_utils.h"
#include "app_provider.h"
#include "bsl_uio.h"
#include "crypt_eal_cipher.h"
@@ -167,7 +170,8 @@ void UT_HITLS_APP_ENC_TC003(void)
{"enc", "-enc", "-cipher", "aes128_cbc", "-in", "../testdata/apps/enc/test_encfile", "-pass", "file:../testdata/apps/pass/empty_pass", "-out", "../testdata/apps/enc/res_encfile"},
{"enc", "-enc", "-cipher", "aes128_cbc", "-md", "md_abc", "-in", "../testdata/apps/enc/test_encfile", "-pass", "pass:12345678", "-out", "../testdata/apps/enc/res_encfile"},
{"enc", "-enc", "-cipher", "aes128_cbc", "-in", "../testdata/apps/enc/test_encfile", "-pass", "pass:", "-out", "../testdata/apps/enc/res_encfile"},
{"enc", "-enc", "-cipher", "aes128_cbc", "-in", "../testdata/apps/enc/test_encfile", "-pass", "file:../testdata/apps/pass/size_1025_pass", "-out", "../testdata/apps/enc/res_encfile"}
{"enc", "-enc", "-cipher", "aes128_cbc", "-in", "../testdata/apps/enc/test_encfile", "-pass", "file:../testdata/apps/pass/size_1025_pass", "-out", "../testdata/apps/enc/res_encfile"},
{"enc", "-enc", "-cipher", "aes128-wrap-pad", "-in", "../testdata/apps/enc/test_encfile", "-pass", "pass:12345678", "-out", "../testdata/apps/enc/res_encfile"}
};
OptTestData testData[] = {
@@ -175,7 +179,8 @@ void UT_HITLS_APP_ENC_TC003(void)
{10, argv[1], HITLS_APP_PASSWD_FAIL},
{12, argv[2], HITLS_APP_OPT_VALUE_INVALID},
{10, argv[3], HITLS_APP_PASSWD_FAIL},
{10, argv[4], HITLS_APP_PASSWD_FAIL}
{10, argv[4], HITLS_APP_PASSWD_FAIL},
{10, argv[5], HITLS_APP_OPT_VALUE_INVALID}
};
ASSERT_EQ(AppInit(), HITLS_APP_SUCCESS);
@@ -188,4 +193,74 @@ EXIT:
AppUninit();
return;
}
/* END_CASE */
/* END_CASE */
/**
* @test UT_HITLS_APP_ENC_TC004
* @spec -
* @title Test enc named output file permission; expect 0600 even with permissive umask
*/
/* BEGIN_CASE */
void UT_HITLS_APP_ENC_TC004(void)
{
char outFile[] = "res_perm_tmpfile";
char *argv[] = {"enc", "-enc", "-cipher", "aes128_cbc", "-in", "../testdata/apps/enc/test_encfile",
"-pass", "pass:12345678", "-out", outFile};
struct stat st = {0};
mode_t oldMask = umask(0022);
ASSERT_EQ(AppInit(), HITLS_APP_SUCCESS);
(void)remove(outFile);
int ret = HITLS_EncMain(sizeof(argv) / sizeof(argv[0]), argv);
ASSERT_EQ(ret, HITLS_APP_SUCCESS);
ASSERT_EQ(stat(outFile, &st), 0);
ASSERT_EQ(st.st_mode & 0777, S_IRUSR | S_IWUSR);
EXIT:
(void)umask(oldMask);
(void)remove(outFile);
AppUninit();
return;
}
/* END_CASE */
/**
* @test UT_HITLS_APP_ENC_TC005
* @spec -
* @title Test stdin reads respect the caller supplied maximum size
*/
/* BEGIN_CASE */
void UT_HITLS_APP_ENC_TC005(void)
{
char inFile[] = "stdin_limit_tmpfile";
uint8_t *buf = NULL;
uint64_t bufLen = 0;
int stdinFd = -1;
FILE *fp = fopen(inFile, "wb");
ASSERT_NE(fp, NULL);
ASSERT_EQ(fwrite("12345", 1, 5, fp), 5);
ASSERT_EQ(fclose(fp), 0);
fp = NULL;
stdinFd = dup(STDIN_FILENO);
ASSERT_TRUE(stdinFd >= 0);
ASSERT_NE(freopen(inFile, "rb", stdin), NULL);
ASSERT_EQ(HITLS_APP_ReadFileOrStdin(&buf, &bufLen, NULL, 4, "enc"), HITLS_APP_UIO_FAIL);
EXIT:
BSL_SAL_FREE(buf);
if (fp != NULL) {
(void)fclose(fp);
}
if (stdinFd >= 0) {
(void)dup2(stdinFd, STDIN_FILENO);
(void)close(stdinFd);
clearerr(stdin);
}
(void)remove(inFile);
return;
}
/* END_CASE */
testcode/sdv/testcase/apps/test_suite_ut_enc.data
+7 -1
View File
@@ -5,4 +5,10 @@ UT_HITLS_APP_ENC_TC002
UT_HITLS_APP_ENC_TC002:
UT_HITLS_APP_ENC_TC003
UT_HITLS_APP_ENC_TC003:
UT_HITLS_APP_ENC_TC003:
UT_HITLS_APP_ENC_TC004
UT_HITLS_APP_ENC_TC004:
UT_HITLS_APP_ENC_TC005
UT_HITLS_APP_ENC_TC005:
testcode/testdata/apps/app_conf/test_x509_ext_san_leading_zero_ipv4.cnf
Vendored
+14
View File
@@ -0,0 +1,14 @@
[req]
distinguished_name=req_distinguished_name
req_extensions=SAN
[SAN]
subjectAltName=email : AAA@com,email: BBB@com,URI:HTTP://somehost.com/CN=foo,DNS:XXX,IP:010.10.10.10,IP:a0::,dirName:dir_sect
basicConstraints=critical,CA:TRUE
keyUsage=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,keyAgreement,keyCertSign,cRLSign,encipherOnly,decipherOnly
extendedKeyUsage=critical,serverAuth,clientAuth,codeSigning,emailProtection,timeStamping,OCSPSigning
[req_distinguished_name]
[dir_sect]
C=UK
O=My Organization,CN=My Name
OU=My Unit
CN=My Name