This repository was archived by the owner on Jun 16, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 38
This repository was archived by the owner on Jun 16, 2021. It is now read-only.
Add padding to EVP_Cipher #43
Copy link
Copy link
Open
Labels
Description
Rather than forcing aes_cbc_cipher
using OPENSSL_ia32cap=~0x200000200000000
so that we don't have to deal with padding in EVP_Cipher
, we could just implement the padding scheme.
See the mailing list thread starting here:
shadow/shadow#638
More info here:
- Disable TLS encryption in Scallion shadow#136
shadow-plugin-tor/src/tor/shadowtor-preload.c
Lines 99 to 120 in 064c460
* There is a corner case on certain machines that causes padding-related errors * when the EVP_Cipher is set to use aesni_cbc_hmac_sha1_cipher. Our memmove * implementation does not handle padding. * * We attempt to disable the use of aesni_cbc_hmac_sha1_cipher with the environment * variable OPENSSL_ia32cap=~0x200000200000000, and by default intercept EVP_Cipher * in order to skip the encryption. * * If that doesn't work, the user can request that we let the application perform * the encryption by defining SHADOW_ENABLE_EVPCIPHER, which means we will not * intercept EVP_Cipher and instead let OpenSSL do its thing. */ #ifndef SHADOW_ENABLE_EVPCIPHER /* * EVP_CIPHER_CTX *ctx * The ctx parameter has been voided to avoid requiring Openssl headers */ int EVP_Cipher(struct evp_cipher_ctx_st* ctx, unsigned char *out, const unsigned char *in, unsigned int inl){ memmove(out, in, (size_t)inl); return 1; } #endif
Thanks @rwails!