From 3c4d5f2ff5ce5f69fb50ff1c5c15ba52c72395f1 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 17 Aug 2022 11:24:24 +0200 Subject: [PATCH 1/3] sha256: change digest buffer type to uint8_t[] This way we can specify a size with "static". All users use uint8_t already, hence this comes at no price. --- src/fundamental/sha256.c | 4 ++-- src/fundamental/sha256.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/fundamental/sha256.c b/src/fundamental/sha256.c index 31d9674d09..7ead5f169c 100644 --- a/src/fundamental/sha256.c +++ b/src/fundamental/sha256.c @@ -104,7 +104,7 @@ void sha256_init_ctx(struct sha256_ctx *ctx) { /* Process the remaining bytes in the internal buffer and the usual prolog according to the standard and write the result to RESBUF. */ -void *sha256_finish_ctx(struct sha256_ctx *ctx, void *resbuf) { +uint8_t *sha256_finish_ctx(struct sha256_ctx *ctx, uint8_t resbuf[static SHA256_DIGEST_SIZE]) { /* Take yet unprocessed bytes into account. */ uint32_t bytes = ctx->buflen; size_t pad; @@ -129,7 +129,7 @@ void *sha256_finish_ctx(struct sha256_ctx *ctx, void *resbuf) { /* Put result from CTX in first 32 bytes following RESBUF. */ for (size_t i = 0; i < 8; ++i) if (UNALIGNED_P(resbuf)) - memcpy((uint8_t*) resbuf + i * sizeof(uint32_t), (uint32_t[]) { SWAP(ctx->H[i]) }, sizeof(uint32_t)); + memcpy(resbuf + i * sizeof(uint32_t), (uint32_t[]) { SWAP(ctx->H[i]) }, sizeof(uint32_t)); else ((uint32_t *) resbuf)[i] = SWAP(ctx->H[i]); diff --git a/src/fundamental/sha256.h b/src/fundamental/sha256.h index f296f76ae8..337e746c49 100644 --- a/src/fundamental/sha256.h +++ b/src/fundamental/sha256.h @@ -25,5 +25,5 @@ struct sha256_ctx { }; void sha256_init_ctx(struct sha256_ctx *ctx); -void *sha256_finish_ctx(struct sha256_ctx *ctx, void *resbuf); +uint8_t *sha256_finish_ctx(struct sha256_ctx *ctx, uint8_t resbuf[static SHA256_DIGEST_SIZE]); void sha256_process_bytes(const void *buffer, size_t len, struct sha256_ctx *ctx); From 00b4663813829ad3391d03383b82eee5d439de70 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 17 Aug 2022 11:31:45 +0200 Subject: [PATCH 2/3] random-seed: use SHA256_DIGEST_SIZE --- src/random-seed/random-seed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/random-seed/random-seed.c b/src/random-seed/random-seed.c index b265b7f85c..dedbdb2667 100644 --- a/src/random-seed/random-seed.c +++ b/src/random-seed/random-seed.c @@ -293,7 +293,7 @@ static int run(int argc, char *argv[]) { * and replace the last 32 bytes of the seed with the hash output, so that the * new seed file can't regress in entropy. */ if (hashed_old_seed) { - uint8_t hash[32]; + uint8_t hash[SHA256_DIGEST_SIZE]; sha256_process_bytes(&k, sizeof(k), &hash_state); /* Hash length to distinguish from old seed. */ sha256_process_bytes(buf, k, &hash_state); sha256_finish_ctx(&hash_state, hash); From 558d96240bea7d910144fa2cad1fe2f8061ffa74 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 17 Aug 2022 11:32:38 +0200 Subject: [PATCH 3/3] sha256: add sha256_direct()/SHA256_DIRECT() helpers --- src/basic/hmac.c | 4 +--- src/boot/efi/random-seed.c | 13 ++----------- src/fundamental/sha256.c | 7 +++++++ src/fundamental/sha256.h | 4 ++++ 4 files changed, 14 insertions(+), 14 deletions(-) diff --git a/src/basic/hmac.c b/src/basic/hmac.c index 1e4e380aaa..a5f66d5605 100644 --- a/src/basic/hmac.c +++ b/src/basic/hmac.c @@ -29,9 +29,7 @@ void hmac_sha256(const void *key, /* The key needs to be block size length or less, hash it if it's longer. */ if (key_size > HMAC_BLOCK_SIZE) { - sha256_init_ctx(&hash); - sha256_process_bytes(key, key_size, &hash); - sha256_finish_ctx(&hash, replacement_key); + sha256_direct(key, key_size, replacement_key); key = replacement_key; key_size = SHA256_DIGEST_SIZE; } diff --git a/src/boot/efi/random-seed.c b/src/boot/efi/random-seed.c index 652634bdc9..aea4f7e532 100644 --- a/src/boot/efi/random-seed.c +++ b/src/boot/efi/random-seed.c @@ -215,17 +215,8 @@ static void validate_sha256(void) { 0xaf, 0xac, 0x45, 0x03, 0x7a, 0xfe, 0xe9, 0xd1 }}, }; - for (UINTN i = 0; i < ELEMENTSOF(array); i++) { - struct sha256_ctx hash; - uint8_t result[HASH_VALUE_SIZE]; - - sha256_init_ctx(&hash); - sha256_process_bytes(array[i].string, strlen8(array[i].string), &hash); - sha256_finish_ctx(&hash, result); - - assert(memcmp(result, array[i].hash, HASH_VALUE_SIZE) == 0); - } - + for (UINTN i = 0; i < ELEMENTSOF(array); i++) + assert(memcmp(SHA256_DIRECT(array[i].string, strlen8(array[i].string)), array[i].hash, HASH_VALUE_SIZE) == 0); #endif } diff --git a/src/fundamental/sha256.c b/src/fundamental/sha256.c index 7ead5f169c..43ee996b6f 100644 --- a/src/fundamental/sha256.c +++ b/src/fundamental/sha256.c @@ -289,3 +289,10 @@ static void sha256_process_block(const void *buffer, size_t len, struct sha256_c ctx->H[6] = g; ctx->H[7] = h; } + +uint8_t* sha256_direct(const void *buffer, size_t sz, uint8_t result[static SHA256_DIGEST_SIZE]) { + struct sha256_ctx ctx; + sha256_init_ctx(&ctx); + sha256_process_bytes(buffer, sz, &ctx); + return sha256_finish_ctx(&ctx, result); +} diff --git a/src/fundamental/sha256.h b/src/fundamental/sha256.h index 337e746c49..31790c2ebd 100644 --- a/src/fundamental/sha256.h +++ b/src/fundamental/sha256.h @@ -27,3 +27,7 @@ struct sha256_ctx { void sha256_init_ctx(struct sha256_ctx *ctx); uint8_t *sha256_finish_ctx(struct sha256_ctx *ctx, uint8_t resbuf[static SHA256_DIGEST_SIZE]); void sha256_process_bytes(const void *buffer, size_t len, struct sha256_ctx *ctx); + +uint8_t* sha256_direct(const void *buffer, size_t sz, uint8_t result[static SHA256_DIGEST_SIZE]); + +#define SHA256_DIRECT(buffer, sz) sha256_direct(buffer, sz, (uint8_t[SHA256_DIGEST_SIZE]) {})