mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-01 06:55:30 +00:00
Code Issues Releases Wiki Activity

Remove isc_safe_memcompare, it's not needed anywhere and can't be replaced with CRYPTO_memcmp()

Browse Source
This commit is contained in:
Ondřej Surý
2018-07-20 10:06:14 -04:00
parent 66ba2fdad5
commit b105ccee68
5 changed files with 5 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bin/dnssec/dnssec-signzone.c
View File

@@ -789,7 +789,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
static int static int
hashlist_comp(const void *a, const void *b) { hashlist_comp(const void *a, const void *b) {
return (isc_safe_memcompare(a, b, hash_length + 1)); return (memcmp(a, b, hash_length + 1));
} }
static void static void

4
lib/dns/nsec3.c
View File

@@ -1955,7 +1955,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
* Work out what this NSEC3 covers. * Work out what this NSEC3 covers.
* Inside (<0) or outside (>=0). * Inside (<0) or outside (>=0).
*/ */
scope = isc_safe_memcompare(owner, nsec3.next, nsec3.next_length); scope = memcmp(owner, nsec3.next, nsec3.next_length);
/* /*
* Prepare to compute all the hashes. * Prepare to compute all the hashes.
@@ -1979,7 +1979,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
return (ISC_R_IGNORE); return (ISC_R_IGNORE);
} }
order = isc_safe_memcompare(hash, owner, length); order = memcmp(hash, owner, length);
if (first && order == 0) { if (first && order == 0) {
/* /*
* The hashes are the same. * The hashes are the same.

4
lib/dns/spnego.c
View File

@@ -368,7 +368,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
/* mod_auth_kerb.c */ /* mod_auth_kerb.c */
static int static isc_boolean_t
cmp_gss_type(gss_buffer_t token, gss_OID gssoid) cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
{ {
unsigned char *p; unsigned char *p;
@@ -392,7 +392,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
if (((OM_uint32) *p++) != gssoid->length) if (((OM_uint32) *p++) != gssoid->length)
return (GSS_S_DEFECTIVE_TOKEN); return (GSS_S_DEFECTIVE_TOKEN);
return (isc_safe_memcompare(p, gssoid->elements, gssoid->length)); return (!isc_safe_memequal(p, gssoid->elements, gssoid->length));
} }
/* accept_sec_context.c */ /* accept_sec_context.c */

5
lib/isc/include/isc/safe.h
View File

@@ -29,11 +29,6 @@ ISC_LANG_BEGINDECLS
* *
*/ */
#define isc_safe_memcompare(b1, b2, n) CRYPTO_memcmp(b1, b2, n)
/*%<
* Clone of libc memcmp() which is safe to differential timing attacks.
*/
#define isc_safe_memwipe(ptr, len) OPENSSL_cleanse(ptr, len) #define isc_safe_memwipe(ptr, len) OPENSSL_cleanse(ptr, len)
/*%< /*%<
* Clear the memory of length `len` pointed to by `ptr`. * Clear the memory of length `len` pointed to by `ptr`.

19
lib/isc/tests/safe_test.c
View File

@@ -39,24 +39,6 @@ ATF_TC_BODY(isc_safe_memequal, tc) {
"\x00\x00\x00\x00", 4)); "\x00\x00\x00\x00", 4));
} }
ATF_TC(isc_safe_memcompare);
ATF_TC_HEAD(isc_safe_memcompare, tc) {
atf_tc_set_md_var(tc, "descr", "safe memcompare()");
}
ATF_TC_BODY(isc_safe_memcompare, tc) {
UNUSED(tc);
ATF_CHECK(isc_safe_memcompare("test", "test", 4) == 0);
ATF_CHECK(isc_safe_memcompare("test", "tesc", 4) > 0);
ATF_CHECK(isc_safe_memcompare("test", "tesy", 4) < 0);
ATF_CHECK(isc_safe_memcompare("\x00\x00\x00\x00",
"\x00\x00\x00\x00", 4) == 0);
ATF_CHECK(isc_safe_memcompare("\x00\x00\x00\x00",
"\x00\x00\x00\x01", 4) < 0);
ATF_CHECK(isc_safe_memcompare("\x00\x00\x00\x02",
"\x00\x00\x00\x00", 4) > 0);
}
ATF_TC(isc_safe_memwipe); ATF_TC(isc_safe_memwipe);
ATF_TC_HEAD(isc_safe_memwipe, tc) { ATF_TC_HEAD(isc_safe_memwipe, tc) {
atf_tc_set_md_var(tc, "descr", "isc_safe_memwipe()"); atf_tc_set_md_var(tc, "descr", "isc_safe_memwipe()");
@@ -106,7 +88,6 @@ ATF_TC_BODY(isc_safe_memwipe, tc) {
*/ */
ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TCS(tp) {
ATF_TP_ADD_TC(tp, isc_safe_memequal); ATF_TP_ADD_TC(tp, isc_safe_memequal);
ATF_TP_ADD_TC(tp, isc_safe_memcompare);
ATF_TP_ADD_TC(tp, isc_safe_memwipe); ATF_TP_ADD_TC(tp, isc_safe_memwipe);
return (atf_no_error()); return (atf_no_error());
} }