uint8_t draw_char(uint8_t start_row, uint8_t start_col, unsigned char ch, uint8_t fg_col, uint8_t bg_col, uint8_t width) { unsigned int w; unsigned int i, cpos, cnt; uint8 res = 0; // NOTE maybe print a ? or something if (ch > max_char) return 1; /* We print nothing, character not encoded */ cpos = char_pos[ch]; // Start of glyph bits in font_bits[] w = char_width(ch); // Width of the character without inter character space if (w > width) w = width; // w is now min(char_width(ch), width) // draw w columns into drawbuf // each column is copied (with correct color) to drawbuf directly from font_bits for (cnt = 0; cnt < w; cnt++, cpos+=bytes_per_col) store_buf(cnt, font_bits[cpos] | (font_bits[cpos+1] << 8), fg_col, bg_col); if ( (width - cnt) >= ic_space ){ for (i=0; i<ic_space; i++) store_buf(cnt++, 0, fg_col, bg_col); // inter character space res = cnt; }; write_buf(start_row, start_col, cnt, font_height); return res; }
extern void nonce_proxy(unsigned char * N) { nonce(N); symL("nonce", "nonce", SIZE_NONCE, FALSE); store_buf(N); }
static void store_char_ref (struct xml_encode_state *cp, unsigned wc) { char buf[11]; snprintf (buf, sizeof buf, "&#x%x;", wc); store_buf (cp, buf, strlen (buf)); }
void make_sym(const unsigned char * buf, size_t len, const char * s) { SymN(s, 0); assume_len(&len, false, sizeof(len)); Hint(s); Nondet(); store_buf(buf); }
extern size_t decrypt_len_proxy(unsigned char * key, size_t keylen, unsigned char * in, size_t inlen) { size_t ret = decrypt_len(key, keylen, in, inlen); symL("decrypt_len", "len", sizeof(ret), FALSE); store_buf(&ret); if(ret < 0) exit(1); return ret; }
/** * \brief Accept a connection from a remote client * * \param bind_fd Relevant socket * \param client_fd Will contain the connected client socket * \param client_ip Will contain the client IP address * * \return 0 if successful, POLARSSL_ERR_NET_ACCEPT_FAILED, or * POLARSSL_ERR_NET_WOULD_BLOCK is bind_fd was set to * non-blocking and accept() is blocking. */ int net_accept_proxy( int bind_fd, int *client_fd, void *client_ip ) { mute(); int ret = net_accept(bind_fd, client_fd, client_ip); unmute(); SymN("socket", 0); Nondet(); assume_intype("bitstring"); size_t len = sizeof(*client_fd); assume_len(&len, false, sizeof(len)); store_buf(client_fd); // Let the attacker decide what this function returns. input("client_ip", MAX_PRINCIPAL_LENGTH); store_buf(client_ip); input("net_accept_result", sizeof(ret)); store_buf(&ret); return ret; }
extern size_t decrypt_proxy(unsigned char * key, size_t keylen, unsigned char * in, size_t inlen, unsigned char * out) { size_t ret = decrypt(key, keylen, in, inlen, out); load_buf(key, keylen, "key"); load_buf(in, inlen, "cipher"); symN("D", "msg", &ret, TRUE); store_buf(out); if(ret > decrypt_len_proxy(key, keylen, in, inlen)) fail("decrypt_proxy: bad length"); return ret; }
/** * \brief Create a listening socket on bind_ip:port. * If bind_ip == NULL, all interfaces are binded. * * \param fd Socket to use * \param bind_ip IP to bind to, can be NULL * \param port Port number to use * * \return 0 if successful, or one of: * POLARSSL_ERR_NET_SOCKET_FAILED, * POLARSSL_ERR_NET_BIND_FAILED, * POLARSSL_ERR_NET_LISTEN_FAILED */ int net_bind_proxy( int *fd, const char *bind_ip, int port ) { mute(); int ret = net_bind(fd, bind_ip, port); unmute(); SymN("socket", 0); Nondet(); assume_intype("bitstring"); size_t len = sizeof(*fd); assume_len(&len, false, sizeof(len)); store_buf(fd); load_buf(bind_ip, strlen_proxy(bind_ip), ""); output(); load_buf(&port, sizeof(port), ""); output(); // Let the attacker decide what this function returns. input("net_bind_result", sizeof(ret)); store_buf(&ret); return ret; }
/** * \brief Initiate a TCP connection with host:port * * \param fd Socket to use * \param host Host to connect to * \param port Port to connect to * * \return 0 if successful, or one of: * POLARSSL_ERR_NET_SOCKET_FAILED, * POLARSSL_ERR_NET_UNKNOWN_HOST, * POLARSSL_ERR_NET_CONNECT_FAILED */ int net_connect_proxy( int *fd, const char *host, int port ) { mute(); int ret = net_connect(fd, host, port); unmute(); load_buf(host, strlen_proxy(host), ""); output(); load_buf(&port, sizeof(port), ""); output(); // Let the attacker decide what this function returns. input("net_connect_result", sizeof(ret)); store_buf(&ret); return ret; }
int net_recv_proxy( void *ctx, unsigned char *buf, int len ) { mute(); int ret = net_recv(ctx, buf, len); unmute(); mute(); if(ret != len) { fail("read_proxy: ret != len not handled yet, ret = %d, len = %d", ret, len); } unmute(); ret = len; input("msg", ret); store_buf((unsigned char*) buf); return ret; }
extern size_t encrypt_proxy(unsigned char * key, size_t keylen, unsigned char * in, size_t inlen, unsigned char * out) { size_t ret = encrypt(key, keylen, in, inlen, out); unsigned char nonce[SIZE_NONCE]; nonce_proxy(nonce); load_buf(key, keylen, "key"); // hm, it would be sensible to set length to keylen here, but right now I don't allow len() inside lens symN("isek", "key", NULL, TRUE); load_buf(in, inlen, "msg"); load_buf(nonce, SIZE_NONCE, "nonce"); symN("E", "cipher", &ret, TRUE); store_buf(out); if(ret > encrypt_len_proxy(key, keylen, in, inlen)) fail("encrypt_proxy: bad length"); return ret; }
void hint(const unsigned char * buf, size_t len, const char * name) { load_buf(buf, len, ""); Hint(name); store_buf(buf); }
void typehint(const unsigned char * buf, size_t len, const char * type) { load_buf(buf, len, ""); TypeHint(type); store_buf(buf); }
static enum mu_filter_result _xml_encoder (void *xd, enum mu_filter_command cmd, struct mu_filter_io *iobuf) { struct xml_encode_state *cp = xd; const unsigned char *iptr; size_t isize; char *optr; size_t osize; switch (cmd) { case mu_filter_init: cp->idx = -1; return mu_filter_ok; case mu_filter_done: return mu_filter_ok; default: break; } iptr = (unsigned char*) iobuf->input; isize = iobuf->isize; optr = iobuf->output; osize = iobuf->osize; while (osize) { if (cp->idx > 0) { *optr++ = cp->buf[--cp->idx]; --osize; } else if (isize == 0) break; else { struct transcode_map *p; unsigned int c = *iptr; p = ch2ent (c); if (p) { store_buf (cp, p->ent, p->len); ++iptr; --isize; } else { int count = utf8_char_width (c); if (count == 0) { store_char_ref (cp, *iptr); ++iptr; --isize; } else if (count > isize) { if (cmd == mu_filter_lastbuf) { store_buf (cp, (char*) iptr, isize); iptr += isize; isize = 0; } else break; } else { unsigned wc; int rc; rc = utf8_mbtowc (iptr, isize, &wc); if (rc == -1) { store_char_ref (cp, *iptr); ++iptr; --isize; } else { /* http://www.w3.org/TR/xml/#dt-charref: Character Range Char ::= #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF] (any Unicode character, excluding the surrogate blocks, FFFE, and FFFF) */ if (wc == 0x9 || wc == 0xa || wc == 0xd || (wc >= 0x20 && wc < 0xd7ff) || (wc >= 0xe000 && wc < 0xfffd) || (wc >= 0x10000 && wc < 0x10FFFF)) { if (osize >= count) { memcpy (optr, iptr, count); optr += count; osize -= count; iptr += count; isize -= count; } else { store_buf (cp, (char*) iptr, count); iptr += count; isize -= count; } } else { store_char_ref (cp, wc); iptr += count; isize -= count; } } } } } } iobuf->isize -= isize; iobuf->osize -= osize; return mu_filter_ok; }