Skip to content

Commit

Permalink
error code fixes:
Browse files Browse the repository at this point in the history 
* fix TLS layer to consistently use WOLFSSL_FATAL_ERROR for error retvals, rather than literal -1.
* add WC_NO_ERR_TRACE() wrapper around LENGTH_ONLY_E (it does not signify an error condition).
* refactor errcode handling for traceability in wolfSSL_DSA_do_sign(), wolfSSL_DH_size(), wolfSSL_EC_KEY_get_conv_form(), wolfSSL_d2i_DSA_SIG(), wolfSSL_DSA_do_sign(), SetDhInternal(), and wolfSSL_EC_KEY_get_conv_form().
  • Loading branch information
@douzzer
douzzer committed Sep 7, 2024
1 parent 398f8c9 commit c81c9be
Show file tree
Hide file tree
Showing 36 changed files with 551 additions and 545 deletions.
10 changes: 5 additions & 5 deletions src/bio.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1849,13 +1849,13 @@ int wolfSSL_BIO_seek(WOLFSSL_BIO *bio, int ofs)
WOLFSSL_ENTER("wolfSSL_BIO_seek");

if (bio == NULL) {
return -1;
return WOLFSSL_FATAL_ERROR;
}

/* offset ofs from beginning of file */
if (bio->type == WOLFSSL_BIO_FILE &&
XFSEEK(bio->ptr.fh, ofs, SEEK_SET) < 0) {
return -1;
return WOLFSSL_FATAL_ERROR;
}

return 0;
Expand All @@ -1872,7 +1872,7 @@ int wolfSSL_BIO_tell(WOLFSSL_BIO* bio)
WOLFSSL_ENTER("wolfSSL_BIO_tell");

if (bio == NULL) {
return -1;
return WOLFSSL_FATAL_ERROR;
}

if (bio->type != WOLFSSL_BIO_FILE) {
Expand All @@ -1881,7 +1881,7 @@ int wolfSSL_BIO_tell(WOLFSSL_BIO* bio)

pos = (int)XFTELL(bio->ptr.fh);
if (pos < 0)
return -1;
return WOLFSSL_FATAL_ERROR;
else
return pos;
}
Expand Down Expand Up @@ -3246,7 +3246,7 @@ int wolfSSL_BIO_vprintf(WOLFSSL_BIO* bio, const char* format, va_list args)
#if !defined(NO_FILESYSTEM)
case WOLFSSL_BIO_FILE:
if (bio->ptr.fh == XBADFILE) {
return -1;
return WOLFSSL_FATAL_ERROR;
}
ret = XVFPRINTF(bio->ptr.fh, format, args);
break;
Expand Down
28 changes: 14 additions & 14 deletions src/crl.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
wolfSSL_d2i_X509_NAME(&crle->issuer, (unsigned char**)&dcrl->issuer,
dcrl->issuerSz);
if (crle->issuer == NULL) {
return -1;
return WOLFSSL_FATAL_ERROR;
}
#endif
#ifdef CRL_STATIC_REVOKED_LIST
Expand All @@ -141,13 +141,13 @@ static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
crle->toBeSigned = (byte*)XMALLOC(crle->tbsSz, heap,
DYNAMIC_TYPE_CRL_ENTRY);
if (crle->toBeSigned == NULL)
return -1;
return WOLFSSL_FATAL_ERROR;
crle->signature = (byte*)XMALLOC(crle->signatureSz, heap,
DYNAMIC_TYPE_CRL_ENTRY);
if (crle->signature == NULL) {
XFREE(crle->toBeSigned, heap, DYNAMIC_TYPE_CRL_ENTRY);
crle->toBeSigned = NULL;
return -1;
return WOLFSSL_FATAL_ERROR;
}

#ifdef WC_RSA_PSS
Expand All @@ -160,7 +160,7 @@ static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
crle->toBeSigned = NULL;
XFREE(crle->signature, heap, DYNAMIC_TYPE_CRL_ENTRY);
crle->signature = NULL;
return -1;
return WOLFSSL_FATAL_ERROR;
}
XMEMCPY(crle->sigParams, buff + dcrl->sigParamsIndex,
crle->sigParamsSz);
Expand Down Expand Up @@ -563,7 +563,7 @@ static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl, const byte* buff,
WOLFSSL_ENTER("AddCRL");

if (crl == NULL)
return -1;
return WOLFSSL_FATAL_ERROR;

crle = crl->currentEntry;

Expand All @@ -578,7 +578,7 @@ static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl, const byte* buff,
if (InitCRL_Entry(crle, dcrl, buff, verified, crl->heap) < 0) {
WOLFSSL_MSG("Init CRL Entry failed");
CRL_Entry_free(crle, crl->heap);
return -1;
return WOLFSSL_FATAL_ERROR;
}

if (wc_LockRwLock_Wr(&crl->crlLock) != 0) {
Expand Down Expand Up @@ -625,7 +625,7 @@ int BufferLoadCRL(WOLFSSL_CRL* crl, const byte* buff, long sz, int type,
else {
WOLFSSL_MSG("Pem to Der failed");
FreeDer(&der);
return -1;
return WOLFSSL_FATAL_ERROR;
}
#else
ret = NOT_COMPILED_IN;
Expand Down Expand Up @@ -1018,7 +1018,7 @@ static int SwapLists(WOLFSSL_CRL* crl)
#ifdef WOLFSSL_SMALL_STACK
XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
return -1;
return WOLFSSL_FATAL_ERROR;
}

if (crl->monitors[0].path) {
Expand All @@ -1029,7 +1029,7 @@ static int SwapLists(WOLFSSL_CRL* crl)
#ifdef WOLFSSL_SMALL_STACK
XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
return -1;
return WOLFSSL_FATAL_ERROR;
}
}

Expand All @@ -1041,7 +1041,7 @@ static int SwapLists(WOLFSSL_CRL* crl)
#ifdef WOLFSSL_SMALL_STACK
XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
return -1;
return WOLFSSL_FATAL_ERROR;
}
}

Expand All @@ -1051,7 +1051,7 @@ static int SwapLists(WOLFSSL_CRL* crl)
#ifdef WOLFSSL_SMALL_STACK
XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
#endif
return -1;
return WOLFSSL_FATAL_ERROR;
}

newList = tmp->crlList;
Expand Down Expand Up @@ -1103,7 +1103,7 @@ static int StopMonitor(wolfSSL_CRL_mfd_t mfd)
EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, 0, NOTE_TRIGGER, 0, NULL);
if (kevent(mfd, &change, 1, NULL, 0, NULL) < 0) {
WOLFSSL_MSG("kevent trigger customer event failed");
return -1;
return WOLFSSL_FATAL_ERROR;
}

return 0;
Expand Down Expand Up @@ -1235,7 +1235,7 @@ static int StopMonitor(wolfSSL_CRL_mfd_t mfd)
/* write to our custom event */
if (write(mfd, &w64, sizeof(w64)) < 0) {
WOLFSSL_MSG("StopMonitor write failed");
return -1;
return WOLFSSL_FATAL_ERROR;
}

return 0;
Expand Down Expand Up @@ -1378,7 +1378,7 @@ static int StopMonitor(wolfSSL_CRL_mfd_t mfd)
{
if (SetEvent(mfd) == 0) {
WOLFSSL_MSG("SetEvent custom event trigger failed");
return -1;
return WOLFSSL_FATAL_ERROR;
}
return 0;
}
Expand Down
2 changes: 1 addition & 1 deletion src/dtls13.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2585,7 +2585,7 @@ int Dtls13RtxTimeout(WOLFSSL* ssl)

/* Increase timeout on long timeout */
if (DtlsMsgPoolTimeout(ssl) != 0)
return -1;
return WOLFSSL_FATAL_ERROR;

return Dtls13RtxSendBuffered(ssl);
}
Expand Down
34 changes: 17 additions & 17 deletions src/internal.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2108,7 +2108,7 @@ int wolfSSL_session_export_internal(WOLFSSL* ssl, byte* buf, word32* sz,
if (type == WOLFSSL_EXPORT_TLS) {
*sz += AES_BLOCK_SIZE*2;
}
ret = LENGTH_ONLY_E;
ret = WC_NO_ERR_TRACE(LENGTH_ONLY_E);
}

if (ret == 0) {
Expand Down Expand Up @@ -10467,7 +10467,7 @@ static int wolfSSLReceive(WOLFSSL* ssl, byte* buf, word32 sz)

if (ssl->CBIORecv == NULL) {
WOLFSSL_MSG("Your IO Recv callback is null, please set");
return -1;
return WOLFSSL_FATAL_ERROR;
}

retry:
Expand All @@ -10486,7 +10486,7 @@ static int wolfSSLReceive(WOLFSSL* ssl, byte* buf, word32 sz)
}
#endif
#endif
return -1;
return WOLFSSL_FATAL_ERROR;

case WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ):
if (retryLimit > 0 && ssl->ctx->autoRetry &&
Expand All @@ -10503,7 +10503,7 @@ static int wolfSSLReceive(WOLFSSL* ssl, byte* buf, word32 sz)
}
#endif
ssl->options.connReset = 1;
return -1;
return WOLFSSL_FATAL_ERROR;

case WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_ISR): /* interrupt */
/* see if we got our timeout */
Expand All @@ -10527,7 +10527,7 @@ static int wolfSSLReceive(WOLFSSL* ssl, byte* buf, word32 sz)

case WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_CONN_CLOSE):
ssl->options.isClosed = 1;
return -1;
return WOLFSSL_FATAL_ERROR;

case WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_TIMEOUT):
#ifdef WOLFSSL_DTLS
Expand All @@ -10537,7 +10537,7 @@ static int wolfSSLReceive(WOLFSSL* ssl, byte* buf, word32 sz)
if (Dtls13RtxTimeout(ssl) < 0) {
WOLFSSL_MSG(
"Error trying to retransmit DTLS buffered message");
return -1;
return WOLFSSL_FATAL_ERROR;
}
goto retry;
}
Expand All @@ -10552,7 +10552,7 @@ static int wolfSSLReceive(WOLFSSL* ssl, byte* buf, word32 sz)
goto retry;
}
#endif
return -1;
return WOLFSSL_FATAL_ERROR;

default:
WOLFSSL_MSG("Unexpected recv return code");
Expand Down Expand Up @@ -27580,7 +27580,7 @@ static int CmpEccStrength(int hashAlgo, int curveSz)
{
int dgstSz = GetMacDigestSize((byte)hashAlgo);
if (dgstSz <= 0)
return -1;
return WOLFSSL_FATAL_ERROR;
return dgstSz - (curveSz & (~0x3));
}
#endif
Expand Down Expand Up @@ -38207,7 +38207,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
diff -= ticketSeen;
if (diff > timeout * 1000 ||
diff > (sword64)TLS13_MAX_TICKET_AGE * 1000)
return -1;
return WOLFSSL_FATAL_ERROR;
#else
sword64 diff;
sword64 ticketSeen; /* Time ticket seen (ms) */
Expand All @@ -38225,7 +38225,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
diff -= ticketSeen;
if (diff > timeout * 1000 ||
diff > (sword64)TLS13_MAX_TICKET_AGE * 1000)
return -1;
return WOLFSSL_FATAL_ERROR;
#endif
ato32(psk->it->ageAdd, &ticketAdd);
/* Subtract client's ticket age and unobfuscate. */
Expand All @@ -38235,26 +38235,26 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
* Allow +/- 1000 milliseconds on ticket age.
*/
if (diff < -1000 || diff - MAX_TICKET_AGE_DIFF * 1000 > 1000)
return -1;
return WOLFSSL_FATAL_ERROR;

#if !defined(WOLFSSL_PSK_ONE_ID) && !defined(WOLFSSL_PRIORITIZE_PSK)
/* Check whether resumption is possible based on suites in SSL and
* ciphersuite in ticket.
*/
(void)ssl;
if (XMEMCMP(suite, psk->it->suite, SUITE_LEN) != 0)
return -1;
return WOLFSSL_FATAL_ERROR;
#else
(void)suite;
if (!FindSuiteSSL(ssl, psk->it->suite))
return -1;
return WOLFSSL_FATAL_ERROR;
#endif
#ifdef OPENSSL_EXTRA
if (ssl->sessionCtxSz > 0 &&
(psk->it->sessionCtxSz != ssl->sessionCtxSz ||
XMEMCMP(psk->it->sessionCtx, ssl->sessionCtx,
ssl->sessionCtxSz) != 0))
return -1;
return WOLFSSL_FATAL_ERROR;
#endif
return 0;
}
Expand Down Expand Up @@ -41086,15 +41086,15 @@ int wolfSSL_sk_BY_DIR_HASH_find(
}
next = next->next;
}
return -1;
return WOLFSSL_FATAL_ERROR;
}
/* return a number of WOLFSSL_BY_DIR_HASH in stack */
int wolfSSL_sk_BY_DIR_HASH_num(const WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *sk)
{
WOLFSSL_ENTER("wolfSSL_sk_BY_DIR_HASH_num");

if (sk == NULL)
return -1;
return WOLFSSL_FATAL_ERROR;
return (int)sk->num;
}
/* return WOLFSSL_BY_DIR_HASH instance at i */
Expand Down Expand Up @@ -41277,7 +41277,7 @@ int wolfSSL_sk_BY_DIR_entry_num(const WOLF_STACK_OF(WOLFSSL_BY_DIR_entry) *sk)
WOLFSSL_ENTER("wolfSSL_sk_BY_DIR_entry_num");

if (sk == NULL)
return -1;
return WOLFSSL_FATAL_ERROR;
return (int)sk->num;
}
/* return WOLFSSL_BY_DIR_entry instance at i */
Expand Down
6 changes: 3 additions & 3 deletions src/ocsp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1641,7 +1641,7 @@ int wolfSSL_OCSP_REQ_CTX_nbio(WOLFSSL_OCSP_REQ_CTX *ctx)
reqLen - ctx->sent);
if (sent <= 0) {
if (wolfSSL_BIO_should_retry(ctx->bio))
return -1;
return WOLFSSL_FATAL_ERROR;
WOLFSSL_MSG("wolfSSL_BIO_write error");
ctx->ioState = ORIOS_INVALID;
return 0;
Expand Down Expand Up @@ -1670,7 +1670,7 @@ int wolfSSL_OCSP_REQ_CTX_nbio(WOLFSSL_OCSP_REQ_CTX *ctx)
if (ret == WC_NO_ERR_TRACE(WOLFSSL_CBIO_ERR_WANT_READ) ||
ret == WC_NO_ERR_TRACE(OCSP_WANT_READ))
{
return -1;
return WOLFSSL_FATAL_ERROR;
}
return WOLFSSL_FAILURE;
}
Expand Down Expand Up @@ -1898,7 +1898,7 @@ int wolfSSL_OCSP_check_nonce(OcspRequest* req, WOLFSSL_OCSP_BASICRESP* bs)

/* nonce present in req only */
if (reqNonce != NULL && rspNonce == NULL)
return -1;
return WOLFSSL_FATAL_ERROR;

/* nonces are present and equal, return 1. Extra NULL check for fixing
scan-build warning. */
Expand Down
Loading

0 comments on commit c81c9be

Please sign in to comment.