Skip to content
This repository has been archived by the owner on Jun 16, 2021. It is now read-only.

Add padding to EVP_Cipher #43

Open
robgjansen opened this issue Jan 20, 2018 · 0 comments
Open

Add padding to EVP_Cipher #43

robgjansen opened this issue Jan 20, 2018 · 0 comments

Comments

@robgjansen
Copy link
Member

robgjansen commented Jan 20, 2018

Rather than forcing aes_cbc_cipher using OPENSSL_ia32cap=~0x200000200000000 so that we don't have to deal with padding in EVP_Cipher, we could just implement the padding scheme.

See the mailing list thread starting here:
shadow/shadow#638

More info here:

  • Disable TLS encryption in Scallion shadow#136
  • * There is a corner case on certain machines that causes padding-related errors
    * when the EVP_Cipher is set to use aesni_cbc_hmac_sha1_cipher. Our memmove
    * implementation does not handle padding.
    *
    * We attempt to disable the use of aesni_cbc_hmac_sha1_cipher with the environment
    * variable OPENSSL_ia32cap=~0x200000200000000, and by default intercept EVP_Cipher
    * in order to skip the encryption.
    *
    * If that doesn't work, the user can request that we let the application perform
    * the encryption by defining SHADOW_ENABLE_EVPCIPHER, which means we will not
    * intercept EVP_Cipher and instead let OpenSSL do its thing.
    */
    #ifndef SHADOW_ENABLE_EVPCIPHER
    /*
    * EVP_CIPHER_CTX *ctx
    * The ctx parameter has been voided to avoid requiring Openssl headers
    */
    int EVP_Cipher(struct evp_cipher_ctx_st* ctx, unsigned char *out, const unsigned char *in, unsigned int inl){
    memmove(out, in, (size_t)inl);
    return 1;
    }
    #endif

Thanks @rwails!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant