Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AMMOSGH-41 : Update user scripts with more explicit permissions, base64 len calc improvement #104

Merged
merged 2 commits into from
Apr 14, 2022
Merged

AMMOSGH-41 : Update user scripts with more explicit permissions, base64 len calc improvement #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
de7cec4
AMMOSGH-41: Update user permissions example script to limit sadb_user…
IbraheemYSaleh Apr 14, 2022
095e13f
AMMOSGH-XX: update base64 calculations to use exact sizes instead of …
IbraheemYSaleh Apr 14, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/crypto_sadb/sadb_mariadb_sql/create_sadb_user_grant_permissions.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
DROP USER IF EXISTS 'sadb_admin';
DROP USER IF EXISTS 'sadb_user';

CREATE USER IF NOT EXISTS sadb_admin IDENTIFIED BY 'sadb_admin_password';
CREATE USER IF NOT EXISTS sadb_user IDENTIFIED BY 'sadb_password';

GRANT ALL PRIVILEGES ON sadb.* TO 'sadb_user'@'%';
GRANT ALL PRIVILEGES ON sadb.* TO 'sadb_admin'@'%';

GRANT UPDATE (arsn) ON sadb.security_associations TO 'sadb_user'@'%';
GRANT UPDATE (iv) ON sadb.security_associations TO 'sadb_user'@'%';
GRANT SELECT ON sadb.security_associations TO 'sadb_user'@'%';
6 changes: 6 additions & 0 deletions src/src_cryptography/src_kmc_crypto_service/base64url.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,12 @@ int32_t base64urlDecode(const char_t* input, size_t inputLen, void* output,
#define ERROR_INVALID_CHARACTER 23
#define NO_ERROR 0

// https://stackoverflow.com/questions/13378815/base64-length-calculation
// calculate the size of 'output' buffer required for a 'input' buffer of length x during Base64 encoding operation
#define B64ENCODE_OUT_SAFESIZE(x) ((((x) + 3 - 1)/3) * 4 + 1)

// calculate the size of 'output' buffer required for a 'input' buffer of length x during Base64 decoding operation
#define B64DECODE_OUT_SAFESIZE(x) (((x)*3)/4)

//C++ guard
#ifdef __cplusplus
Expand Down
11 changes: 6 additions & 5 deletions ..._cryptography/src_kmc_crypto_service/cryptography_interface_kmc_crypto_service.template.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,7 +281,7 @@ static int32_t cryptography_authenticate(uint8_t* data_out, size_t len_data_out,

// Base64 URL encode IV for KMC REST Encrypt
// Not needed for CMAC/HMAC (only supported auth ciphers now)
// char* iv_base64 = (char*)calloc(1,iv_len*4);
// char* iv_base64 = (char*)calloc(1,B64ENCODE_OUT_SAFESIZE(iv_len)+1);
// base64urlEncode(iv,iv_len,iv_base64,NULL);

uint8_t* auth_payload = aad;
Expand Down Expand Up @@ -482,7 +482,8 @@ static int32_t cryptography_authenticate(uint8_t* data_out, size_t len_data_out,

/* JSON Response Handling End */

uint8_t* icv_decoded = malloc(strlen(icv_base64) + 1);
// https://stackoverflow.com/questions/13378815/base64-length-calculation
uint8_t* icv_decoded = calloc(1,B64DECODE_OUT_SAFESIZE(strlen(icv_base64)) + 1);
size_t icv_decoded_len = 0;
base64urlDecode(icv_base64,strlen(icv_base64),icv_decoded, &icv_decoded_len);
#ifdef DEBUG
Expand Down Expand Up @@ -539,7 +540,7 @@ static int32_t cryptography_validate_authentication(uint8_t* data_out, size_t le
size_t auth_payload_len = aad_len;

// Base64 URL encode MAC for KMC REST Encrypt
char* mac_base64 = (char*)calloc(1,mac_size*4);
char* mac_base64 = (char*)calloc(1,B64ENCODE_OUT_SAFESIZE(mac_size) + 1);
base64urlEncode(mac,mac_size,mac_base64,NULL);
#ifdef DEBUG
printf("MAC Base64 URL Encoded: %s\n",mac_base64);
Expand Down Expand Up @@ -721,7 +722,7 @@ static int32_t cryptography_aead_encrypt(uint8_t* data_out, size_t len_data_out,
configure_curl_connect_opts(curl);

// Base64 URL encode IV for KMC REST Encrypt
char* iv_base64 = (char*)calloc(1,iv_len*4);
char* iv_base64 = (char*)calloc(1,B64ENCODE_OUT_SAFESIZE(iv_len)+1);
base64urlEncode(iv,iv_len,iv_base64,NULL);

uint8_t* encrypt_payload = data_in;
Expand Down Expand Up @@ -977,7 +978,7 @@ static int32_t cryptography_aead_decrypt(uint8_t* data_out, size_t len_data_out,
configure_curl_connect_opts(curl);

// Base64 URL encode IV for KMC REST Encrypt
char* iv_base64 = (char*)calloc(1,iv_len*4);
char* iv_base64 = (char*)calloc(1,B64ENCODE_OUT_SAFESIZE(iv_len)+1);
base64urlEncode(iv,iv_len,iv_base64,NULL);

uint8_t* decrypt_payload = data_in;
Expand Down