Skip to content

Commit cb844d1

Browse files
danielinuxdanielinux
committed
Fixed HOKE legacy wolfssl support + minor CI issues
1 parent 15d04f4 commit cb844d1

3 files changed

Lines changed: 107 additions & 33 deletions

File tree

‎Makefile‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,32 +4,32 @@ BINDIR ?= $(PREFIX)/sbin
44
MANDIR ?= $(PREFIX)/share/man
55

66
build:
7-
make -C src
8-
make -C ns2dohd
9-
make -C proxy
10-
make -C tools
7+
$(MAKE) -C src
8+
$(MAKE) -C ns2dohd
9+
$(MAKE) -C proxy
10+
$(MAKE) -C tools
1111

1212
debug:
13-
make -C src debug
14-
make -C ns2dohd debug
15-
make -C proxy debug
16-
make -C tools debug
13+
$(MAKE) -C src debug
14+
$(MAKE) -C ns2dohd debug
15+
$(MAKE) -C proxy debug
16+
$(MAKE) -C tools debug
1717

1818
dmalloc:
19-
make -C src dmalloc
19+
$(MAKE) -C src dmalloc
2020

2121
asan:
22-
make -C src asan
23-
make -C ns2dohd asan
24-
make -C proxy asan
25-
make -C tools asan
22+
$(MAKE) -C src asan
23+
$(MAKE) -C ns2dohd asan
24+
$(MAKE) -C proxy asan
25+
$(MAKE) -C tools asan
2626

2727
clean:
28-
make -C src clean
29-
make -C ns2dohd clean
30-
make -C proxy clean
31-
make -C tools clean
32-
make -C test clean
28+
$(MAKE) -C src clean
29+
$(MAKE) -C ns2dohd clean
30+
$(MAKE) -C proxy clean
31+
$(MAKE) -C tools clean
32+
$(MAKE) -C test clean
3333

3434
docker-build:
3535
docker build -f devops/Dockerfile . -t dyne/dohd:${VERSION}
@@ -42,38 +42,38 @@ docker-run:
4242

4343
# Run all unit tests
4444
check:
45-
make -C test check
45+
$(MAKE) -C test check
4646

4747
# Run unit tests with ASAN (for leak detection)
4848
check-asan: asan
49-
make -C test check
49+
$(MAKE) -C test check
5050

5151
# Run integration tests (requires running dohd instance)
5252
check-integration:
53-
make -C test integration
53+
$(MAKE) -C test integration
5454

5555
# Run valgrind leak detection test
5656
check-valgrind:
57-
make -C test valgrind
57+
$(MAKE) -C test valgrind
5858

5959
# Stress tests (auto-launch dohd, bombard until failure)
6060
stress:
61-
make -C test stress
61+
$(MAKE) -C test stress
6262

6363
stress-escalate:
64-
make -C test stress-escalate
64+
$(MAKE) -C test stress-escalate
6565

6666
stress-flood:
67-
make -C test stress-flood
67+
$(MAKE) -C test stress-flood
6868

6969
stress-chaos:
70-
make -C test stress-chaos
70+
$(MAKE) -C test stress-chaos
7171

7272
stress-all:
73-
make -C test stress-all
73+
$(MAKE) -C test stress-all
7474

7575
stress-asan:
76-
make -C test stress-asan
76+
$(MAKE) -C test stress-asan
7777

7878
# requires https://github.com/DNS-OARC/flamethrower
7979
# default upstream GENERATOR: -g randomlabel lblsize=10 lblcount=4 count=1000

‎src/libevquick.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -456,7 +456,10 @@ void evquick_loop(void)
456456
/* NULL ptr means time_machine pipe for timer wakeups */
457457
if (e == NULL) {
458458
char discard;
459-
read(ctx->time_machine[0], &discard, 1);
459+
if (read(ctx->time_machine[0], &discard, 1) < 0) {
460+
if (errno != EINTR && errno != EAGAIN)
461+
perror("time_machine read");
462+
}
460463
timer_check(ctx);
461464
continue;
462465
}

‎src/odoh.c‎

Lines changed: 75 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
#include <stdlib.h>
55
#include <string.h>
66

7+
#include <wolfssl/version.h>
78
#include <wolfssl/wolfcrypt/hmac.h>
89
#include <wolfssl/wolfcrypt/hash.h>
910
#include <wolfssl/wolfcrypt/aes.h>
@@ -16,6 +17,56 @@
1617
#define ODOH_LABEL_KEY "odoh key"
1718
#define ODOH_LABEL_NONCE "odoh nonce"
1819

20+
#if defined(LIBWOLFSSL_VERSION_HEX) && (LIBWOLFSSL_VERSION_HEX >= 0x05008000)
21+
#define ODOH_HAVE_HPKE_CONTEXT_API 1
22+
#else
23+
#define ODOH_HAVE_HPKE_CONTEXT_API 0
24+
#endif
25+
26+
static int odoh_hpke_init_seal_context(Hpke *hpke, HpkeBaseContext *ctx,
27+
void *eph, void *receiver, byte *info, word32 info_sz)
28+
{
29+
#if ODOH_HAVE_HPKE_CONTEXT_API
30+
return wc_HpkeInitSealContext(hpke, ctx, eph, receiver, info, info_sz);
31+
#else
32+
(void)hpke; (void)ctx; (void)eph; (void)receiver; (void)info; (void)info_sz;
33+
return -1;
34+
#endif
35+
}
36+
37+
static int odoh_hpke_context_seal_base(Hpke *hpke, HpkeBaseContext *ctx,
38+
byte *aad, word32 aad_sz, byte *pt, word32 pt_sz, byte *out)
39+
{
40+
#if ODOH_HAVE_HPKE_CONTEXT_API
41+
return wc_HpkeContextSealBase(hpke, ctx, aad, aad_sz, pt, pt_sz, out);
42+
#else
43+
(void)hpke; (void)ctx; (void)aad; (void)aad_sz; (void)pt; (void)pt_sz; (void)out;
44+
return -1;
45+
#endif
46+
}
47+
48+
static int odoh_hpke_init_open_context(Hpke *hpke, HpkeBaseContext *ctx,
49+
void *receiver, const byte *enc, word16 enc_sz, byte *info, word32 info_sz)
50+
{
51+
#if ODOH_HAVE_HPKE_CONTEXT_API
52+
return wc_HpkeInitOpenContext(hpke, ctx, receiver, enc, enc_sz, info, info_sz);
53+
#else
54+
(void)hpke; (void)ctx; (void)receiver; (void)enc; (void)enc_sz; (void)info; (void)info_sz;
55+
return -1;
56+
#endif
57+
}
58+
59+
static int odoh_hpke_context_open_base(Hpke *hpke, HpkeBaseContext *ctx,
60+
byte *aad, word32 aad_sz, byte *ct, word32 ct_sz, byte *out)
61+
{
62+
#if ODOH_HAVE_HPKE_CONTEXT_API
63+
return wc_HpkeContextOpenBase(hpke, ctx, aad, aad_sz, ct, ct_sz, out);
64+
#else
65+
(void)hpke; (void)ctx; (void)aad; (void)aad_sz; (void)ct; (void)ct_sz; (void)out;
66+
return -1;
67+
#endif
68+
}
69+
1970
static uint16_t be16(const uint8_t *p)
2071
{
2172
return (uint16_t)((p[0] << 8) | p[1]);
@@ -363,6 +414,10 @@ int odoh_client_encrypt_query(const odoh_config *cfg,
363414
uint8_t *out, uint16_t *out_len,
364415
odoh_client_ctx *client_ctx)
365416
{
417+
#if !ODOH_HAVE_HPKE_CONTEXT_API
418+
(void)cfg; (void)dns_msg; (void)dns_len; (void)out; (void)out_len; (void)client_ctx;
419+
return -1;
420+
#else
366421
uint8_t plain[ODOH_MAX_MESSAGE];
367422
uint16_t plain_len;
368423
uint8_t aad[3 + ODOH_MAX_KEY_ID];
@@ -399,7 +454,7 @@ int odoh_client_encrypt_query(const odoh_config *cfg,
399454
return -1;
400455
}
401456

402-
if (wc_HpkeInitSealContext(&client_ctx->hpke, &client_ctx->hpke_ctx,
457+
if (odoh_hpke_init_seal_context(&client_ctx->hpke, &client_ctx->hpke_ctx,
403458
eph, receiver, (byte *)ODOH_INFO_QUERY, (word32)strlen(ODOH_INFO_QUERY)) != 0) {
404459
wc_HpkeFreeKey(&client_ctx->hpke, cfg->kem_id, eph, NULL);
405460
wc_HpkeFreeKey(&client_ctx->hpke, cfg->kem_id, receiver, NULL);
@@ -422,7 +477,7 @@ int odoh_client_encrypt_query(const odoh_config *cfg,
422477
}
423478

424479
ct_len = plain_len + client_ctx->hpke.Nt;
425-
if (wc_HpkeContextSealBase(&client_ctx->hpke, &client_ctx->hpke_ctx,
480+
if (odoh_hpke_context_seal_base(&client_ctx->hpke, &client_ctx->hpke_ctx,
426481
aad, aad_len, plain, plain_len, ct) != 0) {
427482
wc_HpkeFreeKey(&client_ctx->hpke, cfg->kem_id, eph, NULL);
428483
wc_HpkeFreeKey(&client_ctx->hpke, cfg->kem_id, receiver, NULL);
@@ -460,13 +515,18 @@ int odoh_client_encrypt_query(const odoh_config *cfg,
460515
wc_HpkeFreeKey(&client_ctx->hpke, cfg->kem_id, receiver, NULL);
461516
wc_FreeRng(&rng);
462517
return 0;
518+
#endif
463519
}
464520

465521
int odoh_target_decrypt_query(odoh_target_ctx *target,
466522
const uint8_t *in, uint16_t in_len,
467523
uint8_t *dns_out, uint16_t *dns_out_len,
468524
odoh_req_ctx *req_ctx)
469525
{
526+
#if !ODOH_HAVE_HPKE_CONTEXT_API
527+
(void)target; (void)in; (void)in_len; (void)dns_out; (void)dns_out_len; (void)req_ctx;
528+
return -1;
529+
#else
470530
odoh_message_view msg;
471531
uint8_t aad[3 + ODOH_MAX_KEY_ID];
472532
uint16_t aad_len;
@@ -502,15 +562,15 @@ int odoh_target_decrypt_query(odoh_target_ctx *target,
502562
ct = msg.encrypted + enc_len;
503563
ct_len = (uint16_t)(msg.encrypted_len - enc_len);
504564

505-
if (wc_HpkeInitOpenContext(&req_ctx->hpke, &req_ctx->hpke_ctx,
565+
if (odoh_hpke_init_open_context(&req_ctx->hpke, &req_ctx->hpke_ctx,
506566
&target->priv, enc, enc_len,
507567
(byte *)ODOH_INFO_QUERY, (word32)strlen(ODOH_INFO_QUERY)) != 0)
508568
return -1;
509569

510570
if (build_query_aad(target->cfg.key_id, target->cfg.key_id_len, aad, &aad_len) != 0)
511571
return -1;
512572

513-
if (wc_HpkeContextOpenBase(&req_ctx->hpke, &req_ctx->hpke_ctx,
573+
if (odoh_hpke_context_open_base(&req_ctx->hpke, &req_ctx->hpke_ctx,
514574
aad, aad_len, (byte *)ct, ct_len, plain) != 0)
515575
return -1;
516576

@@ -522,12 +582,17 @@ int odoh_target_decrypt_query(odoh_target_ctx *target,
522582
req_ctx->valid = 1;
523583

524584
return 0;
585+
#endif
525586
}
526587

527588
int odoh_target_encrypt_response(const odoh_req_ctx *req_ctx,
528589
const uint8_t *dns_msg, uint16_t dns_len,
529590
uint8_t *out, uint16_t *out_len)
530591
{
592+
#if !ODOH_HAVE_HPKE_CONTEXT_API
593+
(void)req_ctx; (void)dns_msg; (void)dns_len; (void)out; (void)out_len;
594+
return -1;
595+
#else
531596
uint8_t plain[ODOH_MAX_MESSAGE];
532597
uint16_t plain_len;
533598
uint8_t resp_nonce[64];
@@ -599,12 +664,17 @@ int odoh_target_encrypt_response(const odoh_req_ctx *req_ctx,
599664

600665
*out_len = (uint16_t)off;
601666
return 0;
667+
#endif
602668
}
603669

604670
int odoh_client_decrypt_response(odoh_client_ctx *client_ctx,
605671
const uint8_t *in, uint16_t in_len,
606672
uint8_t *dns_out, uint16_t *dns_out_len)
607673
{
674+
#if !ODOH_HAVE_HPKE_CONTEXT_API
675+
(void)client_ctx; (void)in; (void)in_len; (void)dns_out; (void)dns_out_len;
676+
return -1;
677+
#else
608678
odoh_message_view msg;
609679
uint8_t aad[3 + 64];
610680
uint16_t aad_len;
@@ -656,4 +726,5 @@ int odoh_client_decrypt_response(odoh_client_ctx *client_ctx,
656726
wc_AesFree(&aes);
657727

658728
return ret == 0 ? 0 : -1;
729+
#endif
659730
}

0 commit comments

Comments
 (0)