4:29 a.m.
URL: https://github.com/SSSD/sssd/pull/846
Author: pbrezina
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
Action: opened
PR body:
"""
The key parameter was made const in 8aa0dfdf6e36fa90855c0f35a4dfa57139ad6504
but it produces errors:
```
CC src/util/crypto/libsss_crypt_la-sss_crypto.lo
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c: In function ‘sss_encrypt’:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:96:38: error: passing
argument 3 of ‘nss_ctx_init’ discards ‘const’ qualifier from pointer target type
[-Werror=discarded-qualifiers]
ret = nss_ctx_init(tmp_ctx, enc, key, keylen, out, ivlen, &cctx);
^~~
In file included from /home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:30:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_crypto.h:61:27: note: expected
‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘const uint8_t *’ {aka ‘const
unsigned char *’}
uint8_t *key, int keylen,
~~~~~~~~~^~~
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:133:39: error: passing
argument 3 of ‘nss_ctx_init’ discards ‘const’ qualifier from pointer target type
[-Werror=discarded-qualifiers]
ret = nss_ctx_init(tmp_ctx, hmac, key, keylen, NULL, 0, &hctx);
^~~
In file included from /home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:30:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_crypto.h:61:27: note: expected
‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘const uint8_t *’ {aka ‘const
unsigned char *’}
uint8_t *key, int keylen,
~~~~~~~~~^~~
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c: In function ‘sss_decrypt’:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:221:39: error: passing
argument 3 of ‘nss_ctx_init’ discards ‘const’ qualifier from pointer target type
[-Werror=discarded-qualifiers]
ret = nss_ctx_init(tmp_ctx, hmac, key, keylen, NULL, 0, &hctx);
^~~
In file included from /home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:30:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_crypto.h:61:27: note: expected
‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘const uint8_t *’ {aka ‘const
unsigned char *’}
uint8_t *key, int keylen,
~~~~~~~~~^~~
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:268:38: error: passing
argument 3 of ‘nss_ctx_init’ discards ‘const’ qualifier from pointer target type
[-Werror=discarded-qualifiers]
ret = nss_ctx_init(tmp_ctx, enc, key, keylen, ivbuf, ivlen, &cctx);
^~~
In file included from /home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:30:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_crypto.h:61:27: note: expected
‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘const uint8_t *’ {aka ‘const
unsigned char *’}
uint8_t *key, int keylen,
```
Making the parameter const also in `nss_ctx_init` will produce another error which is out
of our control thus removing the const.
```
In file included from /home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_util.c:33:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_util.c: In function ‘nss_ctx_init’:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_crypto.h:33:19: error: assignment
discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
(sitem)->data = (sdata); \
^
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_util.c:180:13: note: in expansion of
macro ‘MAKE_SECITEM’
MAKE_SECITEM(key, keylen, cctx->key);
```
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/846/head:pr846
git checkout pr846
7:20 a.m.
New subject: [sssd PR#846][comment] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
alexey-tikhonov commented:
"""
The key parameter was made const in
[8aa0dfd](https://github.com/SSSD/sssd/commit/8aa0dfdf6e36fa90855c0f35a4df...
but it produces errors:
/home/pbrezina/workspace/sssd/src/util/crypto/nss/nss_nite.c:96:38: error: passing
argument 3 of ‘nss_ctx_init’ discards ‘const’ qualifier from pointer target type
[-Werror=discarded-qualifiers]
Thanks for the catch.
I guess it wasn't caught by CI because it produces warning (not an error) with configs
of CI machines. But I wonder how did it pass covscan check. I was pretty sure I checked
both nss and openssl builds...
But anyway, this has to be fixed, of course.
Making the parameter const also in `nss_ctx_init` will produce
another error which is out of our control thus removing the const.
I don't think this the best solution.
Making `key` parameter to be non-const in public API says that function is eligible to
modify this parameter and imposes additional burden on user of those functions. But
that's not the case.
This is especially pity as we are going to drop NSS support soon anyway.
I would offer to change `MAKE_SECITEM` macro instead to make copy of sdata (if non NULL)
in sitem context (and would move this macro inside `nss_util.c`). This context is freed
along with `sss_nss_crypto_ctx`.
This is sub-optimal performance wise, but really doesn't matter here. And again, we I
going to drop NSS support anyway. So I think it is better to keep API sane instead of
tweaking it for NSS codepath needs.
Please, let me know what do you think and if I should make those changes.
"""
See the full comment at https://github.com/SSSD/sssd/pull/846#issuecomment-509202699
7:21 a.m.
New subject: [sssd PR#846][+Changes requested] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
Label: +Changes requested
7:57 a.m.
New subject: [sssd PR#846][comment] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
pbrezina commented:
"""
Sure, feel free to implement your suggestion. I agree with you.
"""
See the full comment at https://github.com/SSSD/sssd/pull/846#issuecomment-509214181
3:21 a.m.
New subject: [sssd PR#846][closed] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Author: pbrezina
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
Action: closed
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/846/head:pr846
git checkout pr846
3:21 a.m.
New subject: [sssd PR#846][comment] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
pbrezina commented:
"""
@alexey-tikhonov I'm closing this PR. Please, open a new one when you have patch
ready.
"""
See the full comment at https://github.com/SSSD/sssd/pull/846#issuecomment-509542447
3:22 a.m.
New subject: [sssd PR#846][+superseded] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
Label: +superseded
3:22 a.m.
New subject: [sssd PR#846][-Changes requested] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
Label: -Changes requested
11:15 a.m.
New subject: [sssd PR#846][comment] crypto: unconst key in sss_encrypt and sss_decrypt
URL: https://github.com/SSSD/sssd/pull/846
Title: #846: crypto: unconst key in sss_encrypt and sss_decrypt
alexey-tikhonov commented:
"""
Sure, feel free to implement your suggestion. I agree with you.
https://github.com/SSSD/sssd/pull/848
"""
See the full comment at https://github.com/SSSD/sssd/pull/846#issuecomment-509708541
1762
days inactive
1763
days old
sssd-devel@lists.fedorahosted.org
8 comments
2 participants
participants (2)
-
alexey-tikhonov -
pbrezina