Change pkey parse methods to return s2n_result #4271
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lrstewart
force-pushed
the
pkey_result
branch
from
168296b to
89f4c21
Compare
lrstewart
force-pushed
the
pkey_result
branch
from
89f4c21 to
6821995
Compare
lrstewart
force-pushed
the
pkey_result
branch
from
6cede2c to
73127f6
Compare
lrstewart
commented
Oct 30, 2023
Comment on lines
218
to
+230
| case EVP_PKEY_EC: | ||
| ret = s2n_ecdsa_pkey_init(pub_key); | ||
| if (ret != 0) { | ||
| break; | ||
| } | ||
| ret = s2n_evp_pkey_to_ecdsa_public_key(&pub_key->key.ecdsa_key, evp_public_key); | ||
| RESULT_GUARD(s2n_ecdsa_pkey_init(pub_key)); | ||
| RESULT_GUARD(s2n_evp_pkey_to_ecdsa_public_key(&pub_key->key.ecdsa_key, evp_public_key)); | ||
| *pkey_type_out = S2N_PKEY_TYPE_ECDSA; | ||
| break; | ||
| default: | ||
| POSIX_BAIL(S2N_ERR_DECODE_CERTIFICATE); | ||
| RESULT_BAIL(S2N_ERR_DECODE_CERTIFICATE); | ||
| } | ||
|
|
||
| pub_key->pkey = evp_public_key; | ||
| /* Reset to avoid DEFER_CLEANUP freeing our key */ | ||
| evp_public_key = NULL; | ||
| ZERO_TO_DISABLE_DEFER_CLEANUP(evp_public_key); | ||
|
|
||
| return ret; | ||
| return S2N_RESULT_OK; |
There was a problem hiding this comment.
This pattern of breaking on failure likely predates DEFER_CLEANUP. Without DEFER_CLEANUP, you'd want to break so that you can still set pkey and have the key cleaned up later, just like on success. With DEFER_CLEANUP, this is unnecessary.
| if (parsed_len != asn1der->size) { | ||
| POSIX_BAIL(S2N_ERR_DECODE_PRIVATE_KEY); | ||
| } | ||
| RESULT_ENSURE(parsed_len == asn1der->size, S2N_ERR_DECODE_PRIVATE_KEY); |
There was a problem hiding this comment.
This is the only non-trivial RESULT_ENSURE swap/refactor I did
goatgoose
approved these changes
Oct 31, 2023
maddeleine
approved these changes
Oct 31, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolved issues:
resolves #4270
Description of changes:
This is the change that really matters here:
To make sure that change was safe, I also swapped s2n_asn1der_to_public_key_and_type and its dependencies to return s2n_result instead of int. Then, for symmetry and because it shared many of the same dependencies, I also swapped s2n_asn1der_to_private_key to s2n_result.
This touches a lot of files, but it's an automated, trivial refactor with minimal manual intervention.
Testing:
I added a new test for the issue this resolves: 6cede2c I only test failure on awslc. I could also test for success on openssl-1.1.1, but unless I'm forgetting some trick, specifically checking for openssl-1.1.1 is pretty tricky in our code-- it's basically "1.1.1, and we don't detect that this is a known libcrypto other than openssl". I'm worried about failures with conditional compilation like that. But I have at least manually verified that it passes with openssl-1.1.1.
Mostly I just changed return values, and any errors related to that should be compile-time.
However, I also swapped some S2N_ERROR_IF to RESULT_ENSURE, which inverts the check. Existing tests still pass, and I doubled checked all those swaps-- they were all pretty simple.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.