Skip to content

Commit defe995

Browse files
jbjjbj
authored
Merge pull request #2113 from raulgarciamsft/users/raulga/boost
Users/raulga/boost
2 parents afcde14 + 446763d commit defe995

File tree

11 files changed

+919
-0
lines changed

11 files changed

+919
-0
lines changed

‎cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.qhelp‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>Using TLS or SSLv23 protool from the boost::asio library, but not disabling deprecated protocols or disabling minimum-recommended protocols.</p>
7+
</overview>
8+
9+
<references>
10+
<li>
11+
<a href="https://www.boost.org/doc/libs/1_71_0/doc/html/boost_asio.html">Boost.Asio documentation</a>.
12+
</li>
13+
</references>
14+
</qhelp>
15+

‎cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
/**
2+
* @name Boost_asio TLS Settings Misconfiguration
3+
* @description Using TLS or SSLv23 protool from the boost::asio library, but not disabling deprecated protocols or disabling minimum-recommended protocols
4+
* @kind problem
5+
* @problem.severity error
6+
* @id cpp/boost/tls_settings_misconfiguration
7+
* @tags security
8+
*/
9+
10+
import cpp
11+
import semmle.code.cpp.security.boostorg.asio.protocols
12+
13+
class ExistsAnyFlowConfig extends DataFlow::Configuration {
14+
ExistsAnyFlowConfig() { this = "ExistsAnyFlowConfig" }
15+
16+
override predicate isSource(DataFlow::Node source) { any() }
17+
18+
override predicate isSink(DataFlow::Node sink) { any() }
19+
}
20+
21+
bindingset[flag]
22+
predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
23+
exists(
24+
BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig,
25+
Expr optionsSink
26+
|
27+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
28+
exists(VariableAccess contextSetOptions |
29+
testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
30+
exists(BoostorgAsio::SslSetOptionsFunction f | f.getACallToThisFunction() = fcSetOptions |
31+
contextSetOptions = fcSetOptions.getQualifier() and
32+
forall(
33+
Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig,
34+
Expr optionArgumentSource
35+
|
36+
optionArgument = fcSetOptions.getArgument(0) and
37+
optionArgConfig
38+
.hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument))
39+
|
40+
optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
41+
)
42+
)
43+
)
44+
)
45+
}
46+
47+
bindingset[flag]
48+
predicate isOptionNotSet(ConstructorCall cc, int flag) {
49+
not exists(
50+
BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig,
51+
Expr optionsSink
52+
|
53+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
54+
exists(VariableAccess contextSetOptions |
55+
testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
56+
exists(FunctionCall fcSetOptions, BoostorgAsio::SslSetOptionsFunction f |
57+
f.getACallToThisFunction() = fcSetOptions
58+
|
59+
contextSetOptions = fcSetOptions.getQualifier() and
60+
forall(
61+
Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig,
62+
Expr optionArgumentSource
63+
|
64+
optionArgument = fcSetOptions.getArgument(0) and
65+
optionArgConfig
66+
.hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument))
67+
|
68+
optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
69+
)
70+
)
71+
)
72+
)
73+
}
74+
75+
from
76+
BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor,
77+
BoostorgAsio::SslContextFlowsToSetOptionConfig config, Expr protocolSource, Expr protocolSink,
78+
ConstructorCall cc, Expr e, string msg
79+
where
80+
configConstructor.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
81+
cc.getArgument(0) = protocolSink and
82+
(
83+
BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
84+
not exists(Expr optionsSink |
85+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
86+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoSsl3(), _) and
87+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
88+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
89+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2())
90+
)
91+
or
92+
BoostorgAsio::isExprTlsBoostProtocol(protocolSource) and
93+
not BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
94+
not exists(Expr optionsSink |
95+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
96+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
97+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
98+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2())
99+
)
100+
) and
101+
(
102+
BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
103+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoSsl3()) and
104+
e = cc and
105+
msg = "no_sslv3 has not been set"
106+
or
107+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1()) and
108+
e = cc and
109+
msg = "no_tlsv1 has not been set"
110+
or
111+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1()) and
112+
e = cc and
113+
msg = "no_tlsv1_1 has not been set"
114+
or
115+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2(), e) and
116+
msg = "no_tlsv1_2 was set"
117+
)
118+
select cc, "Usage of $@ with protocol $@ is not configured correctly: The option $@.", cc,
119+
"boost::asio::ssl::context::context", protocolSource, protocolSource.toString(), e, msg

‎cpp/ql/src/Likely Bugs/Protocols/boostorg/UseOfDeprecatedHardcodedProtocol.qhelp‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>Using boost::asio library but specifying a deprecated hardcoded protocol.</p>
7+
<p>Using a deprecated hardcoded protocol instead of negotiting would lock your application to a protocol that has known vulnerabilities or weaknesses.</p>
8+
</overview>
9+
10+
<references>
11+
<li>
12+
<a href="https://www.boost.org/doc/libs/1_71_0/doc/html/boost_asio.html">Boost.Asio documentation</a>.
13+
</li>
14+
</references>
15+
</qhelp>
16+

‎cpp/ql/src/Likely Bugs/Protocols/boostorg/UseOfDeprecatedHardcodedProtocol.ql‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* @name boost::asio Use of deprecated hardcoded Protocol
3+
* @description Using a deprecated hard-coded protocol using the boost::asio library.
4+
* @kind problem
5+
* @problem.severity error
6+
* @id cpp/boost/use-of-deprecated-hardcoded-security-protocol
7+
* @tags security
8+
*/
9+
10+
import cpp
11+
import semmle.code.cpp.security.boostorg.asio.protocols
12+
13+
from
14+
BoostorgAsio::SslContextCallConfig config, Expr protocolSource, Expr protocolSink,
15+
ConstructorCall cc
16+
where
17+
config.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
18+
not exists(BoostorgAsio::SslContextCallTlsProtocolConfig tlsConfig |
19+
tlsConfig.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink))
20+
) and
21+
cc.getArgument(0) = protocolSink and
22+
exists(BoostorgAsio::SslContextCallBannedProtocolConfig bannedConfig |
23+
bannedConfig.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink))
24+
)
25+
select protocolSink, "Usage of $@ specifying a deprecated hardcoded protocol $@ in function $@.",
26+
cc, "boost::asio::ssl::context::context", protocolSource, protocolSource.toString(),
27+
cc.getEnclosingFunction(), cc.getEnclosingFunction().toString()

0 commit comments

Comments
 (0)