6465750691

Committed 10 Oct 2023 06:51AM UTC coverage: 56.348% (+0.03%) from 56.319%

Build # 6465750691

Build Type

Pull #13347

github

Committed by

web-flow

Commit Message

Merge a56b8c0fa into ca1fd3ca9

Pull Request Pull Request #13347: dnsdist: Fix a few warnings from Coverity

Run Details

30458 of 84520 branches covered (0.0%)

Branch coverage included in aggregate %.

13 of 19 new or added lines in 4 files covered. (68.42%)

10 existing lines in 3 files now uncovered.

102334 of 151142 relevant lines covered (67.71%)

2599872.68 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

89.77

/pdns/sodcrypto.cc

/*
 * This file is part of PowerDNS or dnsdist.
 * Copyright -- PowerDNS.COM B.V. and its contributors
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
 *
 * In addition, for the avoidance of any doubt, permission is granted to
 * link this program with OpenSSL and to (re)distribute the binaries
 * produced as the result of such linking.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
#include <iostream>
#include "namespaces.hh"
#include "noinitvector.hh"
#include "misc.hh"
#include "base64.hh"
#include "sodcrypto.hh"


#ifdef HAVE_LIBSODIUM

string newKey()
{
  std::string key;
  key.resize(crypto_secretbox_KEYBYTES);

  randombytes_buf(reinterpret_cast<unsigned char*>(&key.at(0)), key.size());

  return "\""+Base64Encode(key)+"\"";
}

bool sodIsValidKey(const std::string& key)
{
  return key.size() == crypto_secretbox_KEYBYTES;
}

std::string sodEncryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
{
  if (!sodIsValidKey(key)) {
    throw std::runtime_error("Invalid encryption key of size " + std::to_string(key.size()) + ", use setKey() to set a valid key");
  }

  std::string ciphertext;
  ciphertext.resize(msg.length() + crypto_secretbox_MACBYTES);
  crypto_secretbox_easy(reinterpret_cast<unsigned char*>(&ciphertext.at(0)),
                        reinterpret_cast<const unsigned char*>(msg.c_str()),
                        msg.length(),
                        nonce.value,
                        reinterpret_cast<const unsigned char*>(key.c_str()));

  nonce.increment();
  return ciphertext;
}

std::string sodDecryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
{
  std::string decrypted;

  if (msg.length() < crypto_secretbox_MACBYTES) {
    throw std::runtime_error("Could not decrypt message of size " + std::to_string(msg.length()));
  }

  if (!sodIsValidKey(key)) {
    throw std::runtime_error("Invalid decryption key of size " + std::to_string(key.size()) + ", use setKey() to set a valid key");
  }

  decrypted.resize(msg.length() - crypto_secretbox_MACBYTES);

  if (crypto_secretbox_open_easy(reinterpret_cast<unsigned char*>(const_cast<char *>(decrypted.data())),
                                 reinterpret_cast<const unsigned char*>(msg.c_str()),
                                 msg.length(),
                                 nonce.value,
                                 reinterpret_cast<const unsigned char*>(key.c_str())) != 0) {
    throw std::runtime_error("Could not decrypt message, please check that the key configured with setKey() is correct");
  }

  nonce.increment();
  return decrypted;
}
#else
std::string sodEncryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
{
  return msg;
}
std::string sodDecryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
{
  return msg;
}

string newKey()
{
  return "\"plaintext\"";
}

bool sodIsValidKey(const std::string& key)
{
  return true;
}

#endif


#include "base64.hh"
#include <inttypes.h>

namespace anonpdns {
static char B64Decode1(char cInChar)
{
  // The incoming character will be A-Z, a-z, 0-9, +, /, or =.
  // The idea is to quickly determine which grouping the
  // letter belongs to and return the associated value
  // without having to search the global encoding string
  // (the value we're looking for would be the resulting
  // index into that string).
  //
  // To do that, we'll play some tricks...
  unsigned char iIndex = '\0';
  switch ( cInChar ) {
  case '+':
    iIndex = 62;
    break;

  case '/':
    iIndex = 63;
    break;

  case '=':
    iIndex = 0;
    break;

  default:
    // Must be 'A'-'Z', 'a'-'z', '0'-'9', or an error...
    //
    // Numerically, small letters are "greater" in value than
    // capital letters and numerals (ASCII value), and capital
    // letters are "greater" than numerals (again, ASCII value),
    // so we check for numerals first, then capital letters,
    // and finally small letters.
    iIndex = '9' - cInChar;
    if ( iIndex > 0x3F ) {
      // Not from '0' to '9'...
      iIndex = 'Z' - cInChar;
      if ( iIndex > 0x3F ) {
        // Not from 'A' to 'Z'...
        iIndex = 'z' - cInChar;
        if ( iIndex > 0x3F ) {
          // Invalid character...cannot
          // decode!
          iIndex = 0x80; // set the high bit
        } // if
        else {
          // From 'a' to 'z'
          iIndex = (('z' - iIndex) - 'a') + 26;
        } // else
      } // if
      else {
        // From 'A' to 'Z'
        iIndex = ('Z' - iIndex) - 'A';
      } // else
    } // if
    else {
      // Adjust the index...
      iIndex = (('9' - iIndex) - '0') + 52;
    } // else
    break;

  } // switch

  return iIndex;
}

static inline char B64Encode1(unsigned char uc)
{
  if (uc < 26)
    {
      return 'A'+uc;
    }
  if (uc < 52)
    {
      return 'a'+(uc-26);
    }
  if (uc < 62)
    {
      return '0'+(uc-52);
    }
  if (uc == 62)
    {
      return '+';
    }
  return '/';
};



}
using namespace anonpdns;

template<typename Container> int B64Decode(const std::string& strInput, Container& strOutput)
{
  // Set up a decoding buffer
  long cBuf = 0;
  char* pBuf = (char*)&cBuf;

  // Decoding management...
  int iBitGroup = 0, iInNum = 0;

  // While there are characters to process...
  //
  // We'll decode characters in blocks of 4, as
  // there are 4 groups of 6 bits in 3 bytes. The
  // incoming Base64 character is first decoded, and
  // then it is inserted into the decode buffer
  // (with any relevant shifting, as required).
  // Later, after all 3 bytes have been reconstituted,
  // we assign them to the output string, ultimately
  // to be returned as the original message.
  int iInSize = strInput.size();
  unsigned char cChar = '\0';
  uint8_t pad = 0;
  while ( iInNum < iInSize ) {
    // Fill the decode buffer with 4 groups of 6 bits
    cBuf = 0; // clear
    pad = 0;
    for ( iBitGroup = 0; iBitGroup < 4; ++iBitGroup ) {
      if ( iInNum < iInSize ) {
        // Decode a character
       if(strInput.at(iInNum)=='=')
         pad++;
        while(isspace(strInput.at(iInNum)))
          iInNum++;
        cChar = B64Decode1(strInput.at(iInNum++));

      } // if
      else {
        // Decode a padded zero
        cChar = '\0';
      } // else

      // Check for valid decode
      if ( cChar > 0x7F )
        return -1;

      // Adjust the bits
      switch ( iBitGroup ) {
      case 0:
        // The first group is copied into
        // the least significant 6 bits of
        // the decode buffer...these 6 bits
        // will eventually shift over to be
        // the most significant bits of the
        // third byte.
        cBuf = cBuf | cChar;
        break;

      default:
        // For groupings 1-3, simply shift
        // the bits in the decode buffer over
        // by 6 and insert the 6 from the
        // current decode character.
        cBuf = (cBuf << 6) | cChar;
        break;

      } // switch
    } // for

    // Interpret the resulting 3 bytes...note there
    // may have been padding, so those padded bytes
    // are actually ignored.
#if BYTE_ORDER == BIG_ENDIAN
    strOutput.push_back(pBuf[sizeof(long)-3]);
    strOutput.push_back(pBuf[sizeof(long)-2]);
    strOutput.push_back(pBuf[sizeof(long)-1]);
#else
    strOutput.push_back(pBuf[2]);
    strOutput.push_back(pBuf[1]);
    strOutput.push_back(pBuf[0]);
#endif
  } // while
  if(pad)
    strOutput.resize(strOutput.size()-pad);

  return 1;
}

template int B64Decode<std::vector<uint8_t>>(const std::string& strInput, std::vector<uint8_t>& strOutput);
template int B64Decode<PacketBuffer>(const std::string& strInput, PacketBuffer& strOutput);
template int B64Decode<std::string>(const std::string& strInput, std::string& strOutput);

/*
www.kbcafe.com
Copyright 2001-2002 Randy Charles Morin
The Encode static method takes an array of 8-bit values and returns a base-64 stream.
*/


std::string Base64Encode (const std::string& vby)
{
  std::string retval;
  if (vby.size () == 0)
    {
      return retval;
    };
  for (unsigned int i = 0; i < vby.size (); i += 3)
    {
      unsigned char by1 = 0, by2 = 0, by3 = 0;
      by1 = vby[i];
      if (i + 1 < vby.size ())
        {
          by2 = vby[i + 1];
        };
      if (i + 2 < vby.size ())
        {
          by3 = vby[i + 2];
        }
      unsigned char by4 = 0, by5 = 0, by6 = 0, by7 = 0;
      by4 = by1 >> 2;
      by5 = ((by1 & 0x3) << 4) | (by2 >> 4);
      by6 = ((by2 & 0xf) << 2) | (by3 >> 6);
      by7 = by3 & 0x3f;
      retval += B64Encode1 (by4);
      retval += B64Encode1 (by5);
      if (i + 1 < vby.size ())
        {
          retval += B64Encode1 (by6);
        }
      else
        {
          retval += "=";
        };
      if (i + 2 < vby.size ())
        {
          retval += B64Encode1 (by7);
        }
      else
        {
          retval += "=";
        };
      /*      if ((i % (76 / 4 * 3)) == 0)
        {
          retval += "\r\n";
          }*/
    };
  return retval;
};

1	/*
2	* This file is part of PowerDNS or dnsdist.
3	* Copyright -- PowerDNS.COM B.V. and its contributors
4	*
5	* This program is free software; you can redistribute it and/or modify
6	* it under the terms of version 2 of the GNU General Public License as
7	* published by the Free Software Foundation.
8	*
9	* In addition, for the avoidance of any doubt, permission is granted to
10	* link this program with OpenSSL and to (re)distribute the binaries
11	* produced as the result of such linking.
12	*
13	* This program is distributed in the hope that it will be useful,
14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16	* GNU General Public License for more details.
17	*
18	* You should have received a copy of the GNU General Public License
19	* along with this program; if not, write to the Free Software
20	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21	*/
22	#include <iostream>
23	#include "namespaces.hh"
24	#include "noinitvector.hh"
25	#include "misc.hh"
26	#include "base64.hh"
27	#include "sodcrypto.hh"
28
29
30	#ifdef HAVE_LIBSODIUM
31
32	string newKey()
33	{
34	std::string key;
35	key.resize(crypto_secretbox_KEYBYTES);
36
37	randombytes_buf(reinterpret_cast<unsigned char*>(&key.at(0)), key.size());
38
39	return "\""+Base64Encode(key)+"\"";
40	}
41
42	bool sodIsValidKey(const std::string& key)
43	{	650✔
44	return key.size() == crypto_secretbox_KEYBYTES;	650✔
45	}	650✔
46
47	std::string sodEncryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
48	{	215✔
49	if (!sodIsValidKey(key)) {	215!
50	throw std::runtime_error("Invalid encryption key of size " + std::to_string(key.size()) + ", use setKey() to set a valid key");
51	}
52
53	std::string ciphertext;	215✔
54	ciphertext.resize(msg.length() + crypto_secretbox_MACBYTES);	215✔
55	crypto_secretbox_easy(reinterpret_cast<unsigned char*>(&ciphertext.at(0)),	215✔
56	reinterpret_cast<const unsigned char*>(msg.c_str()),	215✔
57	msg.length(),	215✔
58	nonce.value,	215✔
59	reinterpret_cast<const unsigned char*>(key.c_str()));	215✔
60
61	nonce.increment();	215✔
62	return ciphertext;	215✔
63	}	215✔
64
65	std::string sodDecryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
66	{	215✔
67	std::string decrypted;	215✔
68
69	if (msg.length() < crypto_secretbox_MACBYTES) {	215!
70	throw std::runtime_error("Could not decrypt message of size " + std::to_string(msg.length()));
71	}
72
73	if (!sodIsValidKey(key)) {	215!
74	throw std::runtime_error("Invalid decryption key of size " + std::to_string(key.size()) + ", use setKey() to set a valid key");
75	}
76
77	decrypted.resize(msg.length() - crypto_secretbox_MACBYTES);	215✔
78
79	if (crypto_secretbox_open_easy(reinterpret_cast<unsigned char>(const_cast<char >(decrypted.data())),	215!
80	reinterpret_cast<const unsigned char*>(msg.c_str()),	215✔
81	msg.length(),	215✔
82	nonce.value,	215✔
83	reinterpret_cast<const unsigned char*>(key.c_str())) != 0) {	215✔
84	throw std::runtime_error("Could not decrypt message, please check that the key configured with setKey() is correct");
85	}
86
87	nonce.increment();	215✔
88	return decrypted;	215✔
89	}	215✔
90	#else
91	std::string sodEncryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
92	{
93	return msg;
94	}
95	std::string sodDecryptSym(const std::string& msg, const std::string& key, SodiumNonce& nonce)
96	{
97	return msg;
98	}
99
100	string newKey()
101	{
102	return "\"plaintext\"";
103	}
104
105	bool sodIsValidKey(const std::string& key)
106	{
107	return true;
108	}
109
110	#endif
111
112
113	#include "base64.hh"
114	#include <inttypes.h>
115
116	namespace anonpdns {
117	static char B64Decode1(char cInChar)
118	{	33,182✔
119	// The incoming character will be A-Z, a-z, 0-9, +, /, or =.
120	// The idea is to quickly determine which grouping the
121	// letter belongs to and return the associated value
122	// without having to search the global encoding string
123	// (the value we're looking for would be the resulting
124	// index into that string).
125	//
126	// To do that, we'll play some tricks...
127	unsigned char iIndex = '\0';	33,182✔
128	switch ( cInChar ) {	33,182✔
129	case '+':	156✔
130	iIndex = 62;	156✔
131	break;	156✔
132
133	case '/':	63✔
134	iIndex = 63;	63✔
135	break;	63✔
136
137	case '=':	836✔
138	iIndex = 0;	836✔
139	break;	836✔
140
141	default:	32,127✔
142	// Must be 'A'-'Z', 'a'-'z', '0'-'9', or an error...
143	//
144	// Numerically, small letters are "greater" in value than
145	// capital letters and numerals (ASCII value), and capital
146	// letters are "greater" than numerals (again, ASCII value),
147	// so we check for numerals first, then capital letters,
148	// and finally small letters.
149	iIndex = '9' - cInChar;	32,127✔
150	if ( iIndex > 0x3F ) {	32,127✔
151	// Not from '0' to '9'...
152	iIndex = 'Z' - cInChar;	27,799✔
153	if ( iIndex > 0x3F ) {	27,799✔
154	// Not from 'A' to 'Z'...
155	iIndex = 'z' - cInChar;	11,568✔
156	if ( iIndex > 0x3F ) {	11,568✔
157	// Invalid character...cannot
158	// decode!
159	iIndex = 0x80; // set the high bit	2✔
160	} // if	2✔
161	else {	11,566✔
162	// From 'a' to 'z'
163	iIndex = (('z' - iIndex) - 'a') + 26;	11,566✔
164	} // else	11,566✔
165	} // if	11,568✔
166	else {	16,231✔
167	// From 'A' to 'Z'
168	iIndex = ('Z' - iIndex) - 'A';	16,231✔
169	} // else	16,231✔
170	} // if	27,799✔
171	else {	4,328✔
172	// Adjust the index...
173	iIndex = (('9' - iIndex) - '0') + 52;	4,328✔
174	} // else	4,328✔
175	break;	32,127✔
176
177	} // switch	33,182✔
178
179	return iIndex;	33,182✔
180	}	33,182✔
181
182	static inline char B64Encode1(unsigned char uc)
183	{	1,719✔
184	if (uc < 26)	1,719✔
185	{	912✔
186	return 'A'+uc;	912✔
187	}	912✔
188	if (uc < 52)	807✔
189	{	585✔
190	return 'a'+(uc-26);	585✔
191	}	585✔
192	if (uc < 62)	222✔
193	{	220✔
194	return '0'+(uc-52);	220✔
195	}	220✔
196	if (uc == 62)	2!
197	{	2✔
198	return '+';	2✔
199	}	2✔
UNCOV 200	return '/';	×
201	};	2✔
202
203
204
205	}
206	using namespace anonpdns;
207
208	template<typename Container> int B64Decode(const std::string& strInput, Container& strOutput)
209	{	686✔
210	// Set up a decoding buffer
211	long cBuf = 0;	686✔
212	char* pBuf = (char*)&cBuf;	686✔
213
214	// Decoding management...
215	int iBitGroup = 0, iInNum = 0;	686✔
216
217	// While there are characters to process...
218	//
219	// We'll decode characters in blocks of 4, as
220	// there are 4 groups of 6 bits in 3 bytes. The
221	// incoming Base64 character is first decoded, and
222	// then it is inserted into the decode buffer
223	// (with any relevant shifting, as required).
224	// Later, after all 3 bytes have been reconstituted,
225	// we assign them to the output string, ultimately
226	// to be returned as the original message.
227	int iInSize = strInput.size();	686✔
228	unsigned char cChar = '\0';	686✔
229	uint8_t pad = 0;	686✔
230	while ( iInNum < iInSize ) {	8,981!
231	// Fill the decode buffer with 4 groups of 6 bits
232	cBuf = 0; // clear	8,297✔
233	pad = 0;	8,297✔
234	for ( iBitGroup = 0; iBitGroup < 4; ++iBitGroup ) {	41,481!
235	if ( iInNum < iInSize ) {	33,186!
236	// Decode a character
237	if(strInput.at(iInNum)=='=')	33,182!
238	pad++;	836✔
239	while(isspace(strInput.at(iInNum)))	33,182!
240	iInNum++;	×
241	cChar = B64Decode1(strInput.at(iInNum++));	33,182✔
242
243	} // if	33,182✔
244	else {	4✔
245	// Decode a padded zero
246	cChar = '\0';	4✔
247	} // else	4✔
248
249	// Check for valid decode
250	if ( cChar > 0x7F )	33,186!
251	return -1;	2✔
252
253	// Adjust the bits
254	switch ( iBitGroup ) {	33,184✔
255	case 0:	8,297!
256	// The first group is copied into
257	// the least significant 6 bits of
258	// the decode buffer...these 6 bits
259	// will eventually shift over to be
260	// the most significant bits of the
261	// third byte.
262	cBuf = cBuf \| cChar;	8,297✔
263	break;	8,297✔
264
265	default:	24,887!
266	// For groupings 1-3, simply shift
267	// the bits in the decode buffer over
268	// by 6 and insert the 6 from the
269	// current decode character.
270	cBuf = (cBuf << 6) \| cChar;	24,887✔
271	break;	24,887✔
272
273	} // switch	33,184✔
274	} // for	33,184✔
275
276	// Interpret the resulting 3 bytes...note there
277	// may have been padding, so those padded bytes
278	// are actually ignored.
279	#if BYTE_ORDER == BIG_ENDIAN
280	strOutput.push_back(pBuf[sizeof(long)-3]);
281	strOutput.push_back(pBuf[sizeof(long)-2]);
282	strOutput.push_back(pBuf[sizeof(long)-1]);
283	#else
284	strOutput.push_back(pBuf[2]);	8,295✔
285	strOutput.push_back(pBuf[1]);	8,295✔
286	strOutput.push_back(pBuf[0]);	8,295✔
287	#endif	8,295✔
288	} // while	8,295✔
289	if(pad)	684!
290	strOutput.resize(strOutput.size()-pad);	587✔
291
292	return 1;	684✔
293	}	686✔
294
295	template int B64Decode<std::vector<uint8_t>>(const std::string& strInput, std::vector<uint8_t>& strOutput);
296	template int B64Decode<PacketBuffer>(const std::string& strInput, PacketBuffer& strOutput);
297	template int B64Decode<std::string>(const std::string& strInput, std::string& strOutput);
298
299	/*
300	www.kbcafe.com
301	Copyright 2001-2002 Randy Charles Morin
302	The Encode static method takes an array of 8-bit values and returns a base-64 stream.
303	*/
304
305
306	std::string Base64Encode (const std::string& vby)
307	{	75✔
308	std::string retval;	75✔
309	if (vby.size () == 0)	75✔
310	{	2✔
311	return retval;	2✔
312	};	73✔
313	for (unsigned int i = 0; i < vby.size (); i += 3)	522✔
314	{	449✔
315	unsigned char by1 = 0, by2 = 0, by3 = 0;	449✔
316	by1 = vby[i];	449✔
317	if (i + 1 < vby.size ())	449✔
318	{	423✔
319	by2 = vby[i + 1];	423✔
320	};	423✔
321	if (i + 2 < vby.size ())	449✔
322	{	398✔
323	by3 = vby[i + 2];	398✔
324	}	398✔
325	unsigned char by4 = 0, by5 = 0, by6 = 0, by7 = 0;	449✔
326	by4 = by1 >> 2;	449✔
327	by5 = ((by1 & 0x3) << 4) \| (by2 >> 4);	449✔
328	by6 = ((by2 & 0xf) << 2) \| (by3 >> 6);	449✔
329	by7 = by3 & 0x3f;	449✔
330	retval += B64Encode1 (by4);	449✔
331	retval += B64Encode1 (by5);	449✔
332	if (i + 1 < vby.size ())	449✔
333	{	423✔
334	retval += B64Encode1 (by6);	423✔
335	}	423✔
336	else	26✔
337	{	26✔
338	retval += "=";	26✔
339	};	26✔
340	if (i + 2 < vby.size ())	449✔
341	{	398✔
342	retval += B64Encode1 (by7);	398✔
343	}	398✔
344	else	51✔
345	{	51✔
346	retval += "=";	51✔
347	};	51✔
348	/* if ((i % (76 / 4 * 3)) == 0)
349	{
350	retval += "\r\n";
351	}*/
352	};	449✔
353	return retval;	73✔
354	};	75✔

PowerDNS / pdns / 6465750691

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous