Skip to content

Commit

Permalink
add type for allowed cipher operations
Browse files Browse the repository at this point in the history
  • Loading branch information
@qmuntal
qmuntal committed Aug 25, 2023
1 parent ed65759 commit 8145bd7
Show file tree
Hide file tree
Showing 5 changed files with 28 additions and 19 deletions.
4 changes: 2 additions & 2 deletions aes.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,11 +64,11 @@ func (c *aesCipher) Decrypt(dst, src []byte) {
}

func (c *aesCipher) NewCBCEncrypter(iv []byte) cipher.BlockMode {
return c.newCBC(iv, true)
return c.newCBC(iv, cipherOpEncrypt)
}

func (c *aesCipher) NewCBCDecrypter(iv []byte) cipher.BlockMode {
return c.newCBC(iv, false)
return c.newCBC(iv, cipherOpEncrypt)
}

func (c *aesCipher) NewCTR(iv []byte) cipher.Stream {
Expand Down
34 changes: 21 additions & 13 deletions cipher.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,18 @@ const (
cipherModeGCM
)

// cipherOp is the allowed operations for a cipher,
// as documented in [EVP_CipherInit_ex].
//
// [EVP_CipherInit_ex]: https://www.openssl.org/docs/man3.0/man3/EVP_CipherInit_ex.html
type cipherOp int8

const (
cipherOpNone cipherOp = -1 // leaves the value of the previous call, if any.
cipherOpDecrypt cipherOp = 0
cipherOpEncrypt cipherOp = 1
)

// cacheCipher is a cache of cipherKind to GO_EVP_CIPHER_PTR.
var cacheCipher sync.Map

Expand Down Expand Up @@ -168,7 +180,7 @@ func (c *evpCipher) encrypt(dst, src []byte) {
}
if c.enc_ctx == nil {
var err error
c.enc_ctx, err = newCipherCtx(c.kind, cipherModeECB, 1, c.key, nil)
c.enc_ctx, err = newCipherCtx(c.kind, cipherModeECB, cipherOpEncrypt, c.key, nil)

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx

Check failure on line 183 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx
if err != nil {
panic(err)
}
Expand All @@ -194,7 +206,7 @@ func (c *evpCipher) decrypt(dst, src []byte) {
}
if c.dec_ctx == nil {
var err error
c.dec_ctx, err = newCipherCtx(c.kind, cipherModeECB, 0, c.key, nil)
c.dec_ctx, err = newCipherCtx(c.kind, cipherModeECB, cipherOpDecrypt, c.key, nil)

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx

Check failure on line 209 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx
if err != nil {
panic(err)
}
Expand Down Expand Up @@ -240,21 +252,17 @@ func (x *cipherCBC) SetIV(iv []byte) {
if len(iv) != x.blockSize {
panic("cipher: incorrect length IV")
}
if C.go_openssl_EVP_CipherInit_ex(x.ctx, nil, nil, nil, base(iv), -1) != 1 {
if C.go_openssl_EVP_CipherInit_ex(x.ctx, nil, nil, nil, base(iv), C.int(cipherOpNone)) != 1 {
panic("cipher: unable to initialize EVP cipher ctx")
}
}

func (c *evpCipher) newCBC(iv []byte, encrypt bool) cipher.BlockMode {
enc := 1
if !encrypt {
enc = 0
}
ctx, err := newCipherCtx(c.kind, cipherModeCBC, enc, c.key, iv)
func (c *evpCipher) newCBC(iv []byte, op cipherOp) cipher.BlockMode {
ctx, err := newCipherCtx(c.kind, cipherModeCBC, op, c.key, iv)

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx

Check failure on line 261 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx
if err != nil {
panic(err)
}
x := &cipherCBC{ctx: ctx, blockSize: c.blockSize}
x := &cipherCBC{ctx: ctx, blockSize: c.blockSize()}

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

invalid operation: cannot call non-function c.blockSize (variable of type int)

Check failure on line 265 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

invalid operation: cannot call non-function c.blockSize (variable of type int)
runtime.SetFinalizer(x, (*cipherCBC).finalize)
if C.go_openssl_EVP_CIPHER_CTX_set_padding(x.ctx, 0) != 1 {
panic("cipher: unable to set padding")
Expand Down Expand Up @@ -283,7 +291,7 @@ func (x *cipherCTR) XORKeyStream(dst, src []byte) {
}

func (c *evpCipher) newCTR(iv []byte) cipher.Stream {
ctx, err := newCipherCtx(c.kind, cipherModeCTR, 1, c.key, iv)
ctx, err := newCipherCtx(c.kind, cipherModeCTR, cipherOpEncrypt, c.key, iv)

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx

Check failure on line 294 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx
if err != nil {
panic(err)
}
Expand Down Expand Up @@ -341,7 +349,7 @@ func (c *evpCipher) newGCMChecked(nonceSize, tagSize int) (cipher.AEAD, error) {
}

func (c *evpCipher) newGCM(tls bool) (cipher.AEAD, error) {
ctx, err := newCipherCtx(c.kind, cipherModeGCM, -1, c.key, nil)
ctx, err := newCipherCtx(c.kind, cipherModeGCM, cipherOpNone, c.key, nil)

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx

Check failure on line 352 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

not enough arguments in call to newCipherCtx
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -469,7 +477,7 @@ func sliceForAppend(in []byte, n int) (head, tail []byte) {
return
}

func newCipherCtx(kind cipherKind, mode cipherMode, encrypt int, key, iv []byte) (C.GO_EVP_CIPHER_CTX_PTR, error) {
func newCipherCtx(kind cipherKind, mode cipherMode, encrypt int, encrypt cipherOp, key, iv []byte) (C.GO_EVP_CIPHER_CTX_PTR, error) {

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.0) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.1.1) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 1.0.2) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.1) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

other declaration of encrypt

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

encrypt redeclared in this block

Check failure on line 480 in cipher.go

View workflow job for this annotation

GitHub Actions / test (1.20.x, 3.0.9) 

other declaration of encrypt
cipher := loadCipher(kind, mode)
if cipher == nil {
panic("crypto/cipher: unsupported cipher: " + kind.String())
Expand Down
4 changes: 2 additions & 2 deletions des.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,9 +69,9 @@ func (c *desCipher) Decrypt(dst, src []byte) {
}

func (c *desCipher) NewCBCEncrypter(iv []byte) cipher.BlockMode {
return c.newCBC(iv, true)
return c.newCBC(iv, cipherOpEncrypt)
}

func (c *desCipher) NewCBCDecrypter(iv []byte) cipher.BlockMode {
return c.newCBC(iv, false)
return c.newCBC(iv, cipherOpDecrypt)
}
4 changes: 2 additions & 2 deletions goopenssl.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ go_openssl_EVP_CIPHER_CTX_seal_wrapper(const GO_EVP_CIPHER_CTX_PTR ctx,
if (in_len == 0) in = "";
if (aad_len == 0) aad = "";

if (go_openssl_EVP_CipherInit_ex(ctx, NULL, NULL, NULL, nonce, 1) != 1)
if (go_openssl_EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, nonce) != 1)
return 0;

int discard_len, out_len;
Expand Down Expand Up @@ -147,7 +147,7 @@ go_openssl_EVP_CIPHER_CTX_open_wrapper(const GO_EVP_CIPHER_CTX_PTR ctx,
if (in_len == 0) in = "";
if (aad_len == 0) aad = "";

if (go_openssl_EVP_CipherInit_ex(ctx, NULL, NULL, NULL, nonce, 0) != 1)
if (go_openssl_EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, nonce) != 1)
return 0;

int discard_len, out_len;
Expand Down
1 change: 1 addition & 0 deletions shims.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,7 @@ DEFINEFUNC(int, EVP_CipherUpdate, (GO_EVP_CIPHER_CTX_PTR ctx, unsigned char *out
DEFINEFUNC(int, EVP_EncryptInit_ex, (GO_EVP_CIPHER_CTX_PTR ctx, const GO_EVP_CIPHER_PTR type, GO_ENGINE_PTR impl, const unsigned char *key, const unsigned char *iv), (ctx, type, impl, key, iv)) \
DEFINEFUNC(int, EVP_EncryptUpdate, (GO_EVP_CIPHER_CTX_PTR ctx, unsigned char *out, int *outl, const unsigned char *in, int inl), (ctx, out, outl, in, inl)) \
DEFINEFUNC(int, EVP_EncryptFinal_ex, (GO_EVP_CIPHER_CTX_PTR ctx, unsigned char *out, int *outl), (ctx, out, outl)) \
DEFINEFUNC(int, EVP_DecryptInit_ex, (GO_EVP_CIPHER_CTX_PTR ctx, const GO_EVP_CIPHER_PTR type, GO_ENGINE_PTR impl, const unsigned char *key, const unsigned char *iv), (ctx, type, impl, key, iv)) \
DEFINEFUNC(int, EVP_DecryptUpdate, (GO_EVP_CIPHER_CTX_PTR ctx, unsigned char *out, int *outl, const unsigned char *in, int inl), (ctx, out, outl, in, inl)) \
DEFINEFUNC(int, EVP_DecryptFinal_ex, (GO_EVP_CIPHER_CTX_PTR ctx, unsigned char *outm, int *outl), (ctx, outm, outl)) \
DEFINEFUNC_3_0(GO_EVP_CIPHER_PTR, EVP_CIPHER_fetch, (GO_OSSL_LIB_CTX_PTR ctx, const char *algorithm, const char *properties), (ctx, algorithm, properties)) \
Expand Down

0 comments on commit 8145bd7

Please sign in to comment.