From 93c72a77269249cf3f9ef4b9e1b85212e2d2e4b2 Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Sun, 11 Oct 2020 17:29:54 +0100 Subject: [PATCH] ITS#9364 add sample for authenticated encryption --- libraries/liblmdb/Makefile | 5 +- libraries/liblmdb/crypto.c | 62 +++++++++++ libraries/liblmdb/lmdb.h | 29 ++++- libraries/liblmdb/mdb.c | 10 +- libraries/liblmdb/mtest_enc2.c | 188 +++++++++++++++++++++++++++++++++ 5 files changed, 288 insertions(+), 6 deletions(-) create mode 100644 libraries/liblmdb/crypto.c create mode 100644 libraries/liblmdb/mtest_enc2.c diff --git a/libraries/liblmdb/Makefile b/libraries/liblmdb/Makefile index 292b0fa..b8c03cf 100644 --- a/libraries/liblmdb/Makefile +++ b/libraries/liblmdb/Makefile @@ -42,7 +42,7 @@ ILIBS = liblmdb.a liblmdb$(SOEXT) IPROGS = mdb_stat mdb_copy mdb_dump mdb_load mdb_drop IDOCS = mdb_stat.1 mdb_copy.1 mdb_dump.1 mdb_load.1 mdb_drop.1 PROGS = $(IPROGS) mtest mtest2 mtest3 mtest4 mtest5 -RPROGS = mtest_remap mtest_enc +RPROGS = mtest_remap mtest_enc mtest_enc2 all: $(ILIBS) $(PROGS) # Requires CPPFLAGS=-DMDB_VL32 and/or -DMDB_RPAGE_CACHE @@ -85,6 +85,9 @@ mtest5: mtest5.o liblmdb.a mtest6: mtest6.o liblmdb.a mtest_remap: mtest_remap.o liblmdb.a mtest_enc: mtest_enc.o chacha8.o liblmdb.a +mtest_enc2: mtest_enc2.o crypto.o liblmdb.a + $(CC) $(LDFLAGS) -pthread -o $@ $^ -lcrypto + mdb.o: mdb.c lmdb.h midl.h $(CC) $(CFLAGS) $(CPPFLAGS) -c mdb.c diff --git a/libraries/liblmdb/crypto.c b/libraries/liblmdb/crypto.c new file mode 100644 index 0000000..db7620e --- /dev/null +++ b/libraries/liblmdb/crypto.c @@ -0,0 +1,62 @@ +#include + +#include + +#include "lmdb.h" + +MDB_crypto_hooks MDB_crypto; + +static EVP_CIPHER *cipher; + +static int str2key(const char *passwd, MDB_val *key) +{ + unsigned int size; + EVP_MD_CTX *mdctx = EVP_MD_CTX_new(); + EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL); + EVP_DigestUpdate(mdctx, "Just a Constant", sizeof("Just a Constant")); + EVP_DigestUpdate(mdctx, passwd, strlen(passwd)); + EVP_DigestFinal_ex(mdctx, key->mv_data, &size); + EVP_MD_CTX_free(mdctx); + return 0; +} + +static int encfunc(const MDB_val *src, MDB_val *dst, const MDB_val *key, int encdec) +{ + unsigned char iv[12]; + int ivl, outl, rc; + mdb_size_t *ptr; + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); + + ptr = key[1].mv_data; + ivl = ptr[0] & 0xffffffff; + memcpy(iv, &ivl, 4); + memcpy(iv+4, ptr+1, sizeof(mdb_size_t)); + EVP_CipherInit_ex(ctx, cipher, NULL, key[0].mv_data, iv, encdec); + EVP_CIPHER_CTX_set_padding(ctx, 0); + if (!encdec) { + EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, key[2].mv_size, key[2].mv_data); + } + rc = EVP_CipherUpdate(ctx, dst->mv_data, &outl, src->mv_data, src->mv_size); + if (rc) + rc = EVP_CipherFinal_ex(ctx, key[2].mv_data, &outl); + if (rc && encdec) { + EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, key[2].mv_size, key[2].mv_data); + } + EVP_CIPHER_CTX_free(ctx); + return rc == 0; +} + +static const MDB_crypto_funcs table = { + str2key, + encfunc, + NULL, + 32, + 16, + 0 +}; + +MDB_crypto_funcs *MDB_crypto() +{ + cipher = (EVP_CIPHER *)EVP_chacha20_poly1305(); + return (MDB_crypto_funcs *)&table; +} diff --git a/libraries/liblmdb/lmdb.h b/libraries/liblmdb/lmdb.h index 2c23b33..2fba3a5 100644 --- a/libraries/liblmdb/lmdb.h +++ b/libraries/liblmdb/lmdb.h @@ -522,8 +522,10 @@ typedef enum MDB_cursor_op { #define MDB_BAD_CHECKSUM (-30778) /** Encryption/decryption failed */ #define MDB_CRYPTO_FAIL (-30777) + /** Environment encryption mismatch */ +#define MDB_ENV_ENCRYPTION (-30776) /** The last defined error code */ -#define MDB_LAST_ERRCODE MDB_CRYPTO_FAIL +#define MDB_LAST_ERRCODE MDB_ENV_ENCRYPTION /** @} */ /** @brief Statistics for a database in the environment */ @@ -1723,6 +1725,31 @@ int mdb_reader_list(MDB_env *env, MDB_msg_func *func, void *ctx); int mdb_reader_check(MDB_env *env, int *dead); /** @} */ +/** @defgroup crypto LMDB Encryption Helper API + * @{ + * @brief Helpers for setting up encryption + */ + + /** @brief A function for converting a string into an encryption key. + * + * @param[in] passwd The string to be converted. + * @param[in,out] key The resulting key. The caller must + * provide the space for the key. + * @return 0 on success, non-zero on failure. + */ +typedef int (MDB_str2key_func)(const char *passwd, MDB_val *key); + +typedef struct MDB_crypto_funcs { + MDB_str2key_func *mcf_str2key; + MDB_enc_func *mcf_encfunc; + MDB_sum_func *mcf_sumfunc; + int mcf_keysize; + int mcf_esumsize; + int mcf_sumsize; +} MDB_crypto_funcs; + +typedef MDB_crypto_funcs *(MDB_crypto_hooks)(); + #ifdef __cplusplus } #endif diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c index 80f1762..b82c144 100644 --- a/libraries/liblmdb/mdb.c +++ b/libraries/liblmdb/mdb.c @@ -1830,6 +1830,7 @@ static char *const mdb_errstr[] = { "MDB_PROBLEM: Unexpected problem - txn should abort", "MDB_BAD_CHECKSUM: Page checksum mismatch", "MDB_CRYPTO_FAIL: Page encryption or decryption failed", + "MDB_ENV_ENCRYPTION: Environment encryption mismatch", }; char * @@ -5338,7 +5339,7 @@ mdb_env_open2(MDB_env *env, int prev) } } if ((env->me_flags ^ env->me_metas[0]->mm_flags) & MDB_ENCRYPT) - return MDB_INCOMPATIBLE; + return MDB_ENV_ENCRYPTION; #if MDB_RPAGE_CACHE if (!newenv && env->me_sumfunc) { @@ -6933,16 +6934,17 @@ static int mdb_page_encrypt(MDB_env *env, MDB_page *dp, MDB_page *encp, size_t s int xsize = sizeof(pgno_t) + sizeof(txnid_t); in.mv_size = size - xsize; in.mv_data = (char *)dp + xsize; + out.mv_size = in.mv_size; + out.mv_data = (char *)encp + xsize; if (env->me_esumsize) { in.mv_size -= env->me_esumsize; + out.mv_size -= env->me_esumsize; enckeys[2].mv_size = env->me_esumsize; - enckeys[2].mv_data = in.mv_data + in.mv_size; + enckeys[2].mv_data = out.mv_data + out.mv_size; } else { enckeys[2].mv_size = 0; enckeys[2].mv_data = 0; } - out.mv_size = in.mv_size; - out.mv_data = (char *)encp + xsize; encp->mp_pgno = dp->mp_pgno; encp->mp_txnid = dp->mp_txnid; enckeys[0] = env->me_enckey; diff --git a/libraries/liblmdb/mtest_enc2.c b/libraries/liblmdb/mtest_enc2.c new file mode 100644 index 0000000..c99663d --- /dev/null +++ b/libraries/liblmdb/mtest_enc2.c @@ -0,0 +1,188 @@ +/* mtest_enc.c - memory-mapped database tester/toy with encryption */ +/* + * Copyright 2011-2017 Howard Chu, Symas Corp. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the Symas + * Dual-Use License. + * + * A copy of this license is available in the file LICENSE in the + * source distribution. + */ +#include +#include +#include +#include "lmdb.h" + +#define E(expr) CHECK((rc = (expr)) == MDB_SUCCESS, #expr) +#define RES(err, expr) ((rc = expr) == (err) || (CHECK(!rc, #expr), 0)) +#define CHECK(test, msg) ((test) ? (void)0 : ((void)fprintf(stderr, \ + "%s:%d: %s: %s\n", __FILE__, __LINE__, msg, mdb_strerror(rc)), abort())) + +extern MDB_crypto_hooks MDB_crypto; +MDB_crypto_funcs *cf; + +int main(int argc,char * argv[]) +{ + int i = 0, j = 0, rc; + MDB_env *env; + MDB_dbi dbi; + MDB_val key, data; + MDB_txn *txn; + MDB_stat mst; + MDB_cursor *cursor, *cur2; + MDB_cursor_op op; + MDB_val enckey; + int count; + int *values; + char sval[32] = ""; + char password[] = "This is my passphrase for now"; + char ekey[32]; + + srand(time(NULL)); + + count = (rand()%384) + 64; + values = (int *)malloc(count*sizeof(int)); + + for(i = 0;imcf_str2key(password, &enckey); + + E(mdb_env_create(&env)); + E(mdb_env_set_maxreaders(env, 1)); + E(mdb_env_set_mapsize(env, 10485760)); + E(mdb_env_set_encrypt(env, cf->mcf_encfunc, &enckey, cf->mcf_esumsize)); + E(mdb_env_open(env, "./testdb", 0 /*|MDB_NOSYNC*/, 0664)); + + E(mdb_txn_begin(env, NULL, 0, &txn)); + E(mdb_dbi_open(txn, NULL, 0, &dbi)); + + key.mv_size = sizeof(int); + key.mv_data = sval; + + printf("Adding %d values\n", count); + for (i=0;i in each iteration, since MDB_NOOVERWRITE may modify it */ + data.mv_size = sizeof(sval); + data.mv_data = sval; + if (RES(MDB_KEYEXIST, mdb_put(txn, dbi, &key, &data, MDB_NOOVERWRITE))) { + j++; + data.mv_size = sizeof(sval); + data.mv_data = sval; + } + } + if (j) printf("%d duplicates skipped\n", j); + E(mdb_txn_commit(txn)); + E(mdb_env_stat(env, &mst)); + + E(mdb_txn_begin(env, NULL, MDB_RDONLY, &txn)); + E(mdb_cursor_open(txn, dbi, &cursor)); + while ((rc = mdb_cursor_get(cursor, &key, &data, MDB_NEXT)) == 0) { + printf("key: %p %.*s, data: %p %.*s\n", + key.mv_data, (int) key.mv_size, (char *) key.mv_data, + data.mv_data, (int) data.mv_size, (char *) data.mv_data); + } + CHECK(rc == MDB_NOTFOUND, "mdb_cursor_get"); + mdb_cursor_close(cursor); + mdb_txn_abort(txn); + + j=0; + key.mv_data = sval; + for (i= count - 1; i > -1; i-= (rand()%5)) { + j++; + txn=NULL; + E(mdb_txn_begin(env, NULL, 0, &txn)); + sprintf(sval, "%03x ", values[i]); + if (RES(MDB_NOTFOUND, mdb_del(txn, dbi, &key, NULL))) { + j--; + mdb_txn_abort(txn); + } else { + E(mdb_txn_commit(txn)); + } + } + free(values); + printf("Deleted %d values\n", j); + + E(mdb_env_stat(env, &mst)); + E(mdb_txn_begin(env, NULL, MDB_RDONLY, &txn)); + E(mdb_cursor_open(txn, dbi, &cursor)); + printf("Cursor next\n"); + while ((rc = mdb_cursor_get(cursor, &key, &data, MDB_NEXT)) == 0) { + printf("key: %.*s, data: %.*s\n", + (int) key.mv_size, (char *) key.mv_data, + (int) data.mv_size, (char *) data.mv_data); + } + CHECK(rc == MDB_NOTFOUND, "mdb_cursor_get"); + printf("Cursor last\n"); + E(mdb_cursor_get(cursor, &key, &data, MDB_LAST)); + printf("key: %.*s, data: %.*s\n", + (int) key.mv_size, (char *) key.mv_data, + (int) data.mv_size, (char *) data.mv_data); + printf("Cursor prev\n"); + while ((rc = mdb_cursor_get(cursor, &key, &data, MDB_PREV)) == 0) { + printf("key: %.*s, data: %.*s\n", + (int) key.mv_size, (char *) key.mv_data, + (int) data.mv_size, (char *) data.mv_data); + } + CHECK(rc == MDB_NOTFOUND, "mdb_cursor_get"); + printf("Cursor last/prev\n"); + E(mdb_cursor_get(cursor, &key, &data, MDB_LAST)); + printf("key: %.*s, data: %.*s\n", + (int) key.mv_size, (char *) key.mv_data, + (int) data.mv_size, (char *) data.mv_data); + E(mdb_cursor_get(cursor, &key, &data, MDB_PREV)); + printf("key: %.*s, data: %.*s\n", + (int) key.mv_size, (char *) key.mv_data, + (int) data.mv_size, (char *) data.mv_data); + + mdb_cursor_close(cursor); + mdb_txn_abort(txn); + + printf("Deleting with cursor\n"); + E(mdb_txn_begin(env, NULL, 0, &txn)); + E(mdb_cursor_open(txn, dbi, &cur2)); + for (i=0; i<50; i++) { + if (RES(MDB_NOTFOUND, mdb_cursor_get(cur2, &key, &data, MDB_NEXT))) + break; + printf("key: %p %.*s, data: %p %.*s\n", + key.mv_data, (int) key.mv_size, (char *) key.mv_data, + data.mv_data, (int) data.mv_size, (char *) data.mv_data); + E(mdb_del(txn, dbi, &key, NULL)); + } + + printf("Restarting cursor in txn\n"); + for (op=MDB_FIRST, i=0; i<=32; op=MDB_NEXT, i++) { + if (RES(MDB_NOTFOUND, mdb_cursor_get(cur2, &key, &data, op))) + break; + printf("key: %p %.*s, data: %p %.*s\n", + key.mv_data, (int) key.mv_size, (char *) key.mv_data, + data.mv_data, (int) data.mv_size, (char *) data.mv_data); + } + mdb_cursor_close(cur2); + E(mdb_txn_commit(txn)); + + printf("Restarting cursor outside txn\n"); + E(mdb_txn_begin(env, NULL, 0, &txn)); + E(mdb_cursor_open(txn, dbi, &cursor)); + for (op=MDB_FIRST, i=0; i<=32; op=MDB_NEXT, i++) { + if (RES(MDB_NOTFOUND, mdb_cursor_get(cursor, &key, &data, op))) + break; + printf("key: %p %.*s, data: %p %.*s\n", + key.mv_data, (int) key.mv_size, (char *) key.mv_data, + data.mv_data, (int) data.mv_size, (char *) data.mv_data); + } + mdb_cursor_close(cursor); + mdb_txn_abort(txn); + + mdb_dbi_close(env, dbi); + mdb_env_close(env); + + return 0; +}