Skip to content

Template Typestate Analysis #654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fabianbs96 merged 3 commits into from
Aug 15, 2023
Merged

Template Typestate Analysis #654

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f1a9511
Make IDETypeStateDescription a template to allow for type-safe type s…
fabianbs96 Aug 4, 2023
6bc4f02
Implement JoinLatticeTraits for CSTDFILEIOState
fabianbs96 Aug 4, 2023
27b9a41
Move TSA flow functions to source file again
fabianbs96 Aug 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
601 changes: 504 additions & 97 deletions include/phasar/PhasarLLVM/DataFlow/IfdsIde/Problems/IDETypeStateAnalysis.h
View file
Open in desktop

Large diffs are not rendered by default.

49 changes: 41 additions & 8 deletions ...asarLLVM/DataFlow/IfdsIde/Problems/TypeStateDescriptions/CSTDFILEIOTypeStateDescription.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
#ifndef PHASAR_PHASARLLVM_DATAFLOW_IFDSIDE_PROBLEMS_TYPESTATEDESCRIPTIONS_CSTDFILEIOTYPESTATEDESCRIPTION_H
#define PHASAR_PHASARLLVM_DATAFLOW_IFDSIDE_PROBLEMS_TYPESTATEDESCRIPTIONS_CSTDFILEIOTYPESTATEDESCRIPTION_H

#include "phasar/PhasarLLVM/DataFlow/IfdsIde/Problems/IDETypeStateAnalysis.h"
#include "phasar/PhasarLLVM/DataFlow/IfdsIde/Problems/TypeStateDescriptions/TypeStateDescription.h"

#include <map>
Expand All @@ -18,31 +19,63 @@

namespace psr {

enum class CSTDFILEIOState {
TOP = 42,
UNINIT = 0,
OPENED = 1,
CLOSED = 2,
ERROR = 3,
BOT = 4
};
llvm::StringRef to_string(CSTDFILEIOState State) noexcept;
template <> struct JoinLatticeTraits<CSTDFILEIOState> {
static constexpr CSTDFILEIOState top() noexcept {
return CSTDFILEIOState::TOP;
}
static constexpr CSTDFILEIOState bottom() noexcept {
return CSTDFILEIOState::BOT;
}
static constexpr CSTDFILEIOState join(CSTDFILEIOState L,
CSTDFILEIOState R) noexcept {
if (L == top() || R == bottom()) {
return R;
}
if (L == bottom() || R == top()) {
return L;
}
return bottom();
}
};

/**
* A type state description for C's file I/O API. The finite state machine
* is encoded by a two-dimensional array with rows as function tokens and
* columns as states.
*/
class CSTDFILEIOTypeStateDescription : public TypeStateDescription {
class CSTDFILEIOTypeStateDescription
: public TypeStateDescription<CSTDFILEIOState> {
public:
[[nodiscard]] bool isFactoryFunction(const std::string &F) const override;
[[nodiscard]] bool isConsumingFunction(const std::string &F) const override;
[[nodiscard]] bool isAPIFunction(const std::string &F) const override;
using TypeStateDescription::getNextState;
[[nodiscard]] bool isFactoryFunction(llvm::StringRef F) const override;
[[nodiscard]] bool isConsumingFunction(llvm::StringRef F) const override;
[[nodiscard]] bool isAPIFunction(llvm::StringRef F) const override;
[[nodiscard]] TypeStateDescription::State
getNextState(std::string Tok, TypeStateDescription::State S) const override;
getNextState(llvm::StringRef Tok,
TypeStateDescription::State S) const override;
[[nodiscard]] std::string getTypeNameOfInterest() const override;
[[nodiscard]] std::set<int>
getConsumerParamIdx(const std::string &F) const override;
getConsumerParamIdx(llvm::StringRef F) const override;
[[nodiscard]] std::set<int>
getFactoryParamIdx(const std::string &F) const override;
[[nodiscard]] auto getStateToString() const -> std::string (*)(int) override;
getFactoryParamIdx(llvm::StringRef F) const override;
[[nodiscard]] TypeStateDescription::State bottom() const override;
[[nodiscard]] TypeStateDescription::State top() const override;
[[nodiscard]] TypeStateDescription::State uninit() const override;
[[nodiscard]] TypeStateDescription::State start() const override;
[[nodiscard]] TypeStateDescription::State error() const override;
};

extern template class IDETypeStateAnalysis<CSTDFILEIOTypeStateDescription>;

} // namespace psr

#endif
86 changes: 44 additions & 42 deletions .../PhasarLLVM/DataFlow/IfdsIde/Problems/TypeStateDescriptions/OpenSSLEVPKDFCTXDescription.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
#include "phasar/DataFlow/IfdsIde/Solver/IDESolver.h"
#include "phasar/Domain/AnalysisDomain.h"
#include "phasar/PhasarLLVM/DataFlow/IfdsIde/Problems/IDETypeStateAnalysis.h"
#include "phasar/PhasarLLVM/DataFlow/IfdsIde/Problems/TypeStateDescriptions/TypeStateDescription.h"
#include "phasar/PhasarLLVM/DataFlow/IfdsIde/Problems/TypeStateDescriptions/OpenSSLEVPKDFDescription.h"

#include <map>
#include <set>
Expand All @@ -26,32 +26,35 @@ class Value;

namespace psr {

/**
* We use the following lattice
* BOT = all information
*
* UNINIT CTX_ATTACHED PARAM_INIT DERIVED ERROR
*
* TOP = no information
*/
enum class OpenSSLEVPKDFCTXState {
TOP = 42,
UNINIT = 5,
CTX_ATTACHED = 1,
PARAM_INIT = 2,
DERIVED = 3,
ERROR = 4,
BOT = 0 // It is VERY IMPORTANT, athat BOT has value 0, since this is the
// default value
};

llvm::StringRef to_string(OpenSSLEVPKDFCTXState State) noexcept;

/**
* A type state description for OpenSSL's EVP Key Derivation functions. The
* finite state machine is encoded by a two-dimensional array with rows as
* function tokens and columns as states.
*/
class OpenSSLEVPKDFCTXDescription : public TypeStateDescription {
class OpenSSLEVPKDFCTXDescription
: public TypeStateDescription<OpenSSLEVPKDFCTXState> {
private:
/**
* We use the following lattice
* BOT = all information
*
* UNINIT CTX_ATTACHED PARAM_INIT DERIVED ERROR
*
* TOP = no information
*/
enum OpenSSLEVPKDFState {
TOP = 42,
UNINIT = 5,
CTX_ATTACHED = 1,
PARAM_INIT = 2,
DERIVED = 3,
ERROR = 4,
BOT = 0 // It is VERY IMPORTANT, athat BOT has value 0, since this is the
// default value
};

/**
* The STAR token represents all functions besides EVP_KDF_fetch(),
* EVP_KDF_CTX_new(), EVP_KDF_CTX_set_params() ,derive() and
Expand All @@ -65,41 +68,40 @@ class OpenSSLEVPKDFCTXDescription : public TypeStateDescription {
STAR = 4
};

static const std::map<std::string, std::set<int>> OpenSSLEVPKDFFuncs;
// Delta matrix to implement the state machine's Delta function
static const OpenSSLEVPKDFState Delta[5][6];
static const OpenSSLEVPKDFCTXState Delta[5][6];

// std::map<std::pair<const llvm::Instruction *, const llvm::Value *>, int>
// requiredKDFState;
IDESolver<IDETypeStateAnalysisDomain> &KDFAnalysisResults;
static OpenSSLEVTKDFToken funcNameToToken(const std::string &F);
IDESolver<IDETypeStateAnalysisDomain<OpenSSLEVPKDFDescription>>
&KDFAnalysisResults;
static OpenSSLEVTKDFToken funcNameToToken(llvm::StringRef F);

public:
using TypeStateDescription::getNextState;
OpenSSLEVPKDFCTXDescription(
IDESolver<IDETypeStateAnalysisDomain> &KDFAnalysisResults)
IDESolver<IDETypeStateAnalysisDomain<OpenSSLEVPKDFDescription>>
&KDFAnalysisResults)
: KDFAnalysisResults(KDFAnalysisResults) {}

[[nodiscard]] bool isFactoryFunction(llvm::StringRef FuncName) const override;
[[nodiscard]] bool
isFactoryFunction(const std::string &FuncName) const override;
[[nodiscard]] bool
isConsumingFunction(const std::string &FuncName) const override;
[[nodiscard]] bool isAPIFunction(const std::string &FuncName) const override;
[[nodiscard]] TypeStateDescription::State
getNextState(std::string Tok, TypeStateDescription::State S) const override;
[[nodiscard]] TypeStateDescription::State
getNextState(const std::string &Tok, TypeStateDescription::State S,
isConsumingFunction(llvm::StringRef FuncName) const override;
[[nodiscard]] bool isAPIFunction(llvm::StringRef FuncName) const override;
[[nodiscard]] State getNextState(llvm::StringRef Tok, State S) const override;
[[nodiscard]] State
getNextState(llvm::StringRef Tok, State S,
const llvm::CallBase *CallSite) const override;
[[nodiscard]] std::string getTypeNameOfInterest() const override;
[[nodiscard]] std::set<int>
getConsumerParamIdx(const std::string &F) const override;
getConsumerParamIdx(llvm::StringRef F) const override;
[[nodiscard]] std::set<int>
getFactoryParamIdx(const std::string &F) const override;
[[nodiscard]] auto getStateToString() const -> std::string (*)(int) override;
[[nodiscard]] TypeStateDescription::State bottom() const override;
[[nodiscard]] TypeStateDescription::State top() const override;
[[nodiscard]] TypeStateDescription::State uninit() const override;
[[nodiscard]] TypeStateDescription::State start() const override;
[[nodiscard]] TypeStateDescription::State error() const override;
getFactoryParamIdx(llvm::StringRef F) const override;
[[nodiscard]] State bottom() const override;
[[nodiscard]] State top() const override;
[[nodiscard]] State uninit() const override;
[[nodiscard]] State start() const override;
[[nodiscard]] State error() const override;
/*
/// Checks all callSites, where a EVP_KDF object needs to be in a
/// certain state, such that the state transition for EVP_KDF_CTX is valid.
Expand Down
59 changes: 32 additions & 27 deletions ...sar/PhasarLLVM/DataFlow/IfdsIde/Problems/TypeStateDescriptions/OpenSSLEVPKDFDescription.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,24 +17,28 @@
#include <string>

namespace psr {
class OpenSSLEVPKDFDescription : public TypeStateDescription {
public:
/**
* We use the following lattice
* BOT = all information
*
* UNINIT KDF_FETCHED ERROR
*
* TOP = no information
*/
enum OpenSSLEVPKDFState {
TOP = 42,
UNINIT = 0,
KDF_FETCHED = 1,
ERROR = 2,
BOT = 3
};

/**
* We use the following lattice
* BOT = all information
*
* UNINIT KDF_FETCHED ERROR
*
* TOP = no information
*/
enum class OpenSSLEVPKDFState {
TOP = 42,
UNINIT = 0,
KDF_FETCHED = 1,
ERROR = 2,
BOT = 3
};

llvm::StringRef to_string(OpenSSLEVPKDFState State) noexcept;

class OpenSSLEVPKDFDescription
: public TypeStateDescription<OpenSSLEVPKDFState> {
public:
/**
* The STAR token represents all functions besides EVP_KDF_fetch(),
* EVP_KDF_fetch() and EVP_KDF_CTX_free().
Expand All @@ -45,31 +49,32 @@ class OpenSSLEVPKDFDescription : public TypeStateDescription {
STAR = 2
};

using State = OpenSSLEVPKDFState;

private:
static const std::map<std::string, std::set<int>> OpenSSLEVPKDFFuncs;
// delta matrix to implement the state machine's delta function
static const OpenSSLEVPKDFState Delta[3][4];
static OpenSSLEVTKDFToken funcNameToToken(const std::string &F);
static OpenSSLEVTKDFToken funcNameToToken(llvm::StringRef F);

public:
[[nodiscard]] bool isFactoryFunction(const std::string &F) const override;
using TypeStateDescription::getNextState;
[[nodiscard]] bool isFactoryFunction(llvm::StringRef F) const override;

[[nodiscard]] bool isConsumingFunction(const std::string &F) const override;
[[nodiscard]] bool isConsumingFunction(llvm::StringRef F) const override;

[[nodiscard]] bool isAPIFunction(const std::string &F) const override;
[[nodiscard]] bool isAPIFunction(llvm::StringRef F) const override;

[[nodiscard]] TypeStateDescription::State
getNextState(std::string Tok, TypeStateDescription::State S) const override;
getNextState(llvm::StringRef Tok,
TypeStateDescription::State S) const override;

[[nodiscard]] std::string getTypeNameOfInterest() const override;

[[nodiscard]] std::set<int>
getConsumerParamIdx(const std::string &F) const override;
getConsumerParamIdx(llvm::StringRef F) const override;

[[nodiscard]] std::set<int>
getFactoryParamIdx(const std::string &F) const override;

[[nodiscard]] auto getStateToString() const -> std::string (*)(int) override;
getFactoryParamIdx(llvm::StringRef F) const override;

[[nodiscard]] TypeStateDescription::State bottom() const override;

Expand Down
43 changes: 22 additions & 21 deletions ...PhasarLLVM/DataFlow/IfdsIde/Problems/TypeStateDescriptions/OpenSSLSecureHeapDescription.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,19 +18,20 @@
#include <string>

namespace psr {
enum class OpenSSLSecureHeapState {
TOP = 42,
BOT = 0,
UNINIT = 1,
ALLOCATED = 2,
ZEROED = 3,
FREED = 4,
ERROR = 5
};
llvm::StringRef to_string(OpenSSLSecureHeapState State) noexcept;

class OpenSSLSecureHeapDescription : public TypeStateDescription {
class OpenSSLSecureHeapDescription
: public TypeStateDescription<OpenSSLSecureHeapState> {
private:
enum OpenSSLSecureHeapState {
TOP = 42,
BOT = 0,
UNINIT = 1,
ALLOCATED = 2,
ZEROED = 3,
FREED = 4,
ERROR = 5
};

enum class OpenSSLSecureHeapToken {
SECURE_MALLOC = 0,
SECURE_ZALLOC = 1,
Expand All @@ -39,33 +40,33 @@ class OpenSSLSecureHeapDescription : public TypeStateDescription {
STAR = 4
};

static const std::map<std::string, std::set<int>> OpenSSLSecureHeapFuncs;
// Delta matrix to implement the state machine's Delta function
static const OpenSSLSecureHeapState Delta[5][6];

IDESolver<IDESecureHeapPropagationAnalysisDomain>
&SecureHeapPropagationResults;

static OpenSSLSecureHeapToken funcNameToToken(const std::string &F);
static OpenSSLSecureHeapToken funcNameToToken(llvm::StringRef F);

public:
using TypeStateDescription::getNextState;
OpenSSLSecureHeapDescription(IDESolver<IDESecureHeapPropagationAnalysisDomain>
&SecureHeapPropagationResults);

[[nodiscard]] bool isFactoryFunction(const std::string &F) const override;
[[nodiscard]] bool isConsumingFunction(const std::string &F) const override;
[[nodiscard]] bool isAPIFunction(const std::string &F) const override;
[[nodiscard]] bool isFactoryFunction(llvm::StringRef F) const override;
[[nodiscard]] bool isConsumingFunction(llvm::StringRef F) const override;
[[nodiscard]] bool isAPIFunction(llvm::StringRef F) const override;
[[nodiscard]] TypeStateDescription::State
getNextState(std::string Tok, TypeStateDescription::State S) const override;
getNextState(llvm::StringRef Tok,
TypeStateDescription::State S) const override;
[[nodiscard]] TypeStateDescription::State
getNextState(const std::string &Tok, TypeStateDescription::State S,
getNextState(llvm::StringRef Tok, TypeStateDescription::State S,
const llvm::CallBase *CallSite) const override;
[[nodiscard]] std::string getTypeNameOfInterest() const override;
[[nodiscard]] std::set<int>
getConsumerParamIdx(const std::string &F) const override;
getConsumerParamIdx(llvm::StringRef F) const override;
[[nodiscard]] std::set<int>
getFactoryParamIdx(const std::string &F) const override;
[[nodiscard]] auto getStateToString() const -> std::string (*)(int) override;
getFactoryParamIdx(llvm::StringRef F) const override;
[[nodiscard]] TypeStateDescription::State bottom() const override;
[[nodiscard]] TypeStateDescription::State top() const override;
[[nodiscard]] TypeStateDescription::State uninit() const override;
Expand Down
Loading