* Encrypt the string given as per the current config. * * Returns APR_SUCCESS if successful. */
| 244 | * Returns APR_SUCCESS if successful. |
| 245 | */ |
| 246 | static apr_status_t encrypt_string(request_rec * r, const apr_crypto_t *f, |
| 247 | session_crypto_dir_conf *dconf, const char *in, char **out) |
| 248 | { |
| 249 | apr_status_t res; |
| 250 | apr_crypto_key_t *key = NULL; |
| 251 | apr_size_t ivSize = 0; |
| 252 | apr_crypto_block_t *block = NULL; |
| 253 | unsigned char *encrypt = NULL; |
| 254 | unsigned char *combined = NULL; |
| 255 | apr_size_t encryptlen, tlen, combinedlen; |
| 256 | char *base64; |
| 257 | apr_size_t blockSize = 0; |
| 258 | const unsigned char *iv = NULL; |
| 259 | apr_uuid_t salt; |
| 260 | apr_crypto_block_key_type_e *cipher; |
| 261 | const char *passphrase; |
| 262 | apr_size_t passlen; |
| 263 | |
| 264 | /* use a uuid as a salt value, and prepend it to our result */ |
| 265 | apr_uuid_get(&salt); |
| 266 | res = crypt_init(r, f, &cipher, dconf); |
| 267 | if (res != APR_SUCCESS) { |
| 268 | return res; |
| 269 | } |
| 270 | |
| 271 | /* encrypt using the first passphrase in the list */ |
| 272 | passphrase = APR_ARRAY_IDX(dconf->passphrases, 0, const char *); |
| 273 | passlen = strlen(passphrase); |
| 274 | res = apr_crypto_passphrase(&key, &ivSize, passphrase, passlen, |
| 275 | (unsigned char *) (&salt), sizeof(apr_uuid_t), |
| 276 | *cipher, APR_MODE_CBC, 1, 4096, f, r->pool); |
| 277 | if (APR_STATUS_IS_ENOKEY(res)) { |
| 278 | ap_log_rerror(APLOG_MARK, APLOG_ERR, res, r, APLOGNO(01825) |
| 279 | "failure generating key from passphrase"); |
| 280 | } |
| 281 | if (APR_STATUS_IS_EPADDING(res)) { |
| 282 | ap_log_rerror(APLOG_MARK, APLOG_ERR, res, r, APLOGNO(01826) |
| 283 | "padding is not supported for cipher"); |
| 284 | } |
| 285 | if (APR_STATUS_IS_EKEYTYPE(res)) { |
| 286 | ap_log_rerror(APLOG_MARK, APLOG_ERR, res, r, APLOGNO(01827) |
| 287 | "the key type is not known"); |
| 288 | } |
| 289 | if (APR_SUCCESS != res) { |
| 290 | ap_log_rerror(APLOG_MARK, APLOG_ERR, res, r, APLOGNO(01828) |
| 291 | "encryption could not be configured."); |
| 292 | return res; |
| 293 | } |
| 294 | |
| 295 | res = apr_crypto_block_encrypt_init(&block, &iv, key, &blockSize, r->pool); |
| 296 | if (APR_SUCCESS != res) { |
| 297 | ap_log_rerror(APLOG_MARK, APLOG_ERR, res, r, APLOGNO(01829) |
| 298 | "apr_crypto_block_encrypt_init failed"); |
| 299 | return res; |
| 300 | } |
| 301 | |
| 302 | /* encrypt the given string */ |
| 303 | res = apr_crypto_block_encrypt(&encrypt, &encryptlen, |
no test coverage detected