Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| if (out == NULL) { | ||
| return 0; | ||
| } | ||
| memset(out, 0, sizeof(*out)); |
There was a problem hiding this comment.
warning: Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memset_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
memset(out, 0, sizeof(*out));
^Additional context
provider/backend/errors.c:35: Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memset_s' in case of C11
memset(out, 0, sizeof(*out));
^| static int awslc_prov_sha2_init_op(void *dctx, const OSSL_PARAM params[], | ||
| awslc_prov_sha2_init_fn init) { | ||
| AWSLC_PROV_SHA2_CTX *ctx = (AWSLC_PROV_SHA2_CTX *)dctx; | ||
| int ok; |
There was a problem hiding this comment.
warning: variable 'ok' is not initialized [cppcoreguidelines-init-variables]
| int ok; | |
| int ok = 0; |
| size_t inl, | ||
| awslc_prov_sha2_update_fn update) { | ||
| AWSLC_PROV_SHA2_CTX *ctx = (AWSLC_PROV_SHA2_CTX *)dctx; | ||
| int ok; |
There was a problem hiding this comment.
warning: variable 'ok' is not initialized [cppcoreguidelines-init-variables]
| int ok; | |
| int ok = 0; |
961b477 to
2682ae8
Compare
Bridge AWS-LC's pull-only error queue onto OpenSSL's. The back side drains each record and translates it into a boundary-neutral form; the front side re-raises it under a private "awslc" error library that the core allocates for this load, since OpenSSL owns the reason-string tables for its own library ids and the two forks pack their codes differently. Reason codes occupy three disjoint ranges beneath that library. AWS-LC's cross-library reasons pass through untagged, the provider's own three reasons sit at 100 to 4095, and an AWS-LC library-specific reason is tagged with the library that raised it, since AWS-LC reason numbers repeat across libraries. Only the provider's own reasons are registered with the core. An AWS-LC-origin reason carries its library and reason text in the record's detail instead, composed on the side that can resolve AWS-LC's own tables, so nothing here duplicates data AWS-LC already resolves at runtime. Every dispatch slot reaching AWS-LC brackets its backend calls: mark on entry, then hand the slot's own result to AWSLC_PROV_ERROR_SETTLE, which discards on success and translates or falls back to the slot's reason on failure. A failed call never leaves the queue empty, and a successful one never leaks the records AWS-LC queues on recoverable internal paths.
2682ae8 to
fc6f113
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## feat/provider-fips #3488 +/- ##
=====================================================
Coverage ? 78.34%
=====================================================
Files ? 700
Lines ? 125598
Branches ? 17378
=====================================================
Hits ? 98396
Misses ? 26331
Partials ? 871 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
🔒 Security Review — View Report Please review before merging. |
2 participants
Context and motivation
This wires up error reporting for the provider so users can get feedback on failed operations. We align the implementation strategy around the ACCP precedent of marking and draining the error queues on each border-crossing.
Two properties of the two libraries shape what is possible here:
collected around a call that has already returned.
each library numbers its reasons independently, so an AWS-LC code filed under an OpenSSL library id
resolves against the wrong per-library table and renders as another library's reason.
Description of changes
A private error library. The provider files everything under its own
awslcerror library through thecore error upcalls, and publishes reason strings for its own codes via
OSSL_FUNC_PROVIDER_GET_REASON_STRINGS.A reason namespace with three disjoint ranges (
internal/backend.h):AWSLC_PROV_R_*.A bracket around every call into AWS-LC.
awslc_prov_error_mark()before, thenAWSLC_PROV_ERROR_SETTLE(...)with the slot's own result, which comes back unchanged:call must not leak those to the application.
slot's own reason and detail if AWS-LC queued none. A failed dispatch call never leaves the queue empty.
Detail composed on the AWS-LC side.
backend/errors.crendersAWS-LC <library>: <reason>: <data>,because only that translation unit can see AWS-LC's reason tables.
First integration. SHA-2 brackets its
init,update,final, and context allocation, and raisesAWSLC_PROV_R_INVALID_PARAMETERfor its own argument rejections andAWSLC_PROV_R_UNAPPROVED_OPERATIONwhen an indicator callback vetoes a result.
Testing
Backend suite (
test/backend/errors_test.cc, 8 tests). Only the AWS-LC-linked binary can force arecord onto AWS-LC's queue, so the translation is covered there rather than through the provider interface.
Review considerations
SHA*_InitandSHA*_Updatedo not fail,EVP_DigestFinal_exalways passes the advertised size so thebackend bounds check is unreachable, and only the AWS-LC-linked binary can force an allocation failure
while that binary does not run dispatch functions. It closes with the first operation whose backend can
fail. The discard half, the raise half, and the substitution are each covered.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache
2.0 license and the ISC license.