Skip to contentSkip to conversation

init_key_ctx: key and iv arguments can (now) be const

PATCH In review Steffan Karger 3 participants 3 messages Jun 19, 2017 – Jun 27, 2017

lore
Share & tools
lore

Steffan Karger

author
#0 lore raw

PATCH 1/1 init_key_ctx: key and iv arguments can (now) be const

In older OpenSSL, the key and iv arguments of EVP_CipherInit_ex() were not const, which meant that our API could not be const either. Since we dropped support for OpenSSL 0.9.8, we can now fix our internal API.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/crypto.c         | 2 +-
 src/openvpn/crypto.h         | 2 +-
 src/openvpn/crypto_backend.h | 4 ++--
 src/openvpn/crypto_mbedtls.c | 4 ++--
 src/openvpn/crypto_openssl.c | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)
src/openvpn/crypto.c +1 -1
index 191fee8..6c405e7 100644
@@ -820,7 +820,7 @@ init_key_type(struct key_type *kt, const char *ciphername,
 
 /* given a key and key_type, build a key_ctx */
 void
-init_key_ctx(struct key_ctx *ctx, struct key *key,
+init_key_ctx(struct key_ctx *ctx, const struct key *key,
              const struct key_type *kt, int enc,
              const char *prefix)
 {
src/openvpn/crypto.h +1 -1
index 8e2f2b1..fec2eea 100644
@@ -312,7 +312,7 @@ void init_key_type(struct key_type *kt, const char *ciphername,
  * Key context functions
  */
 
-void init_key_ctx(struct key_ctx *ctx, struct key *key,
+void init_key_ctx(struct key_ctx *ctx, const struct key *key,
                   const struct key_type *kt, int enc,
                   const char *prefix);
src/openvpn/crypto_backend.h +2 -2
index b7f519b..567fd9b 100644
@@ -323,7 +323,7 @@ void cipher_ctx_free(cipher_ctx_t *ctx);
  * @param enc           Whether to encrypt or decrypt (either
  *                      \c MBEDTLS_OP_ENCRYPT or \c MBEDTLS_OP_DECRYPT).
  */
-void cipher_ctx_init(cipher_ctx_t *ctx, uint8_t *key, int key_len,
+void cipher_ctx_init(cipher_ctx_t *ctx, const uint8_t *key, int key_len,
                      const cipher_kt_t *kt, int enc);
 
 /**

@@ -391,7 +391,7 @@ const cipher_kt_t *cipher_ctx_get_cipher_kt(const cipher_ctx_t *ctx);
  *
  * @return              \c 0 on failure, \c 1 on success.
  */
-int cipher_ctx_reset(cipher_ctx_t *ctx, uint8_t *iv_buf);
+int cipher_ctx_reset(cipher_ctx_t *ctx, const uint8_t *iv_buf);
 
 /**
  * Updates the given cipher context, providing additional data (AD) for
src/openvpn/crypto_mbedtls.c +2 -2
index 24bc315..30b51a5 100644
@@ -523,7 +523,7 @@ cipher_ctx_free(mbedtls_cipher_context_t *ctx)
 }
 
 void
-cipher_ctx_init(mbedtls_cipher_context_t *ctx, uint8_t *key, int key_len,
+cipher_ctx_init(mbedtls_cipher_context_t *ctx, const uint8_t *key, int key_len,
                 const mbedtls_cipher_info_t *kt, const mbedtls_operation_t operation)
 {
     ASSERT(NULL != kt && NULL != ctx);

@@ -597,7 +597,7 @@ cipher_ctx_get_cipher_kt(const cipher_ctx_t *ctx)
 }
 
 int
-cipher_ctx_reset(mbedtls_cipher_context_t *ctx, uint8_t *iv_buf)
+cipher_ctx_reset(mbedtls_cipher_context_t *ctx, const uint8_t *iv_buf)
 {
     if (!mbed_ok(mbedtls_cipher_reset(ctx)))
     {
src/openvpn/crypto_openssl.c +2 -2
index a55e65c..847843a 100644
@@ -665,7 +665,7 @@ cipher_ctx_free(EVP_CIPHER_CTX *ctx)
 }
 
 void
-cipher_ctx_init(EVP_CIPHER_CTX *ctx, uint8_t *key, int key_len,
+cipher_ctx_init(EVP_CIPHER_CTX *ctx, const uint8_t *key, int key_len,
                 const EVP_CIPHER *kt, int enc)
 {
     ASSERT(NULL != kt && NULL != ctx);

@@ -732,7 +732,7 @@ cipher_ctx_get_cipher_kt(const cipher_ctx_t *ctx)
 
 
 int
-cipher_ctx_reset(EVP_CIPHER_CTX *ctx, uint8_t *iv_buf)
+cipher_ctx_reset(EVP_CIPHER_CTX *ctx, const uint8_t *iv_buf)
 {
     return EVP_CipherInit_ex(ctx, NULL, NULL, NULL, iv_buf, -1);
 }
Signature · 1 line
2.7.4
Acked-by on v1 1/1
#1 lore raw
Quoted 5 lines · Steffan Karger

In older OpenSSL, the key and iv arguments of EVP_CipherInit_ex() were not const, which meant that our API could not be const either. Since we dropped support for OpenSSL 0.9.8, we can now fix our internal API.

Signed-off-by Steffan Karger <[email protected]...>

This patch is quite simple and just does what it says.

Acked-by Antonio Quartulli <[email protected]...>

Maybe we should spend some time checking for other potentially const arguments around the code ..

Cheers,

Signature · 1 line
Antonio Quartulli
#2 lore raw
In reply to Steffan Karger

Your patch has been applied to the master branch.

commit 5e6e4b7d21150ea2f0738948d5a9bd0c7d910e1a

Author: Steffan Karger
Date:   Mon Jun 19 13:51:05 2017 +0200
     init_key_ctx: key and iv arguments can (now) be const

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Antonio Quartulli <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg14881.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering