Skip to content
This repository was archived by the owner on Jun 16, 2021. It is now read-only.
This repository was archived by the owner on Jun 16, 2021. It is now read-only.

Add padding to EVP_Cipher #43

@robgjansen

Description

@robgjansen

Rather than forcing aes_cbc_cipher using OPENSSL_ia32cap=~0x200000200000000 so that we don't have to deal with padding in EVP_Cipher, we could just implement the padding scheme.

See the mailing list thread starting here:
shadow/shadow#638

More info here:

  • Disable TLS encryption in Scallion shadow#136
  • * There is a corner case on certain machines that causes padding-related errors
    * when the EVP_Cipher is set to use aesni_cbc_hmac_sha1_cipher. Our memmove
    * implementation does not handle padding.
    *
    * We attempt to disable the use of aesni_cbc_hmac_sha1_cipher with the environment
    * variable OPENSSL_ia32cap=~0x200000200000000, and by default intercept EVP_Cipher
    * in order to skip the encryption.
    *
    * If that doesn't work, the user can request that we let the application perform
    * the encryption by defining SHADOW_ENABLE_EVPCIPHER, which means we will not
    * intercept EVP_Cipher and instead let OpenSSL do its thing.
    */
    #ifndef SHADOW_ENABLE_EVPCIPHER
    /*
    * EVP_CIPHER_CTX *ctx
    * The ctx parameter has been voided to avoid requiring Openssl headers
    */
    int EVP_Cipher(struct evp_cipher_ctx_st* ctx, unsigned char *out, const unsigned char *in, unsigned int inl){
    memmove(out, in, (size_t)inl);
    return 1;
    }
    #endif

Thanks @rwails!

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions