Skip to content

Commit e125802

Browse files
MartyrshotMartyrshot
committed
Activate CodeQL Github action
1 parent 1b3d8d2 commit e125802

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+374
-304
lines changed

‎.github/workflows/codeql.yml

Lines changed: 48 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,33 +21,74 @@ jobs:
2121
language: [ 'cpp' ]
2222

2323
steps:
24+
- name: Setup directories
25+
run: |
26+
mkdir $HOME/OQS-bind
27+
mkdir $HOME/local_deps
28+
mkdir $HOME/local_deps/oqs
29+
mkdir $HOME/local_deps/ossl
30+
2431
- name: Checkout repository
2532
uses: actions/checkout@v3
33+
with:
34+
path: ${{ runner.workspace }}/OQS-bind
2635

2736
- name: Install build dependencies
2837
uses: awalsh128/cache-apt-pkgs-action@latest
2938
with:
30-
packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
39+
packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply astyle cmake gcc ninja-build python3-pytest python3-pytest-xdist unzip xsltproc doxygen graphviz python3-yaml valgrind
40+
3141
version: 1.0
42+
- name: Install liboqs
43+
run: |
44+
git clone https://github.com/open-quantum-safe/liboqs.git
45+
cd liboqs
46+
mkdir build
47+
cd build
48+
cmake -GNinja .. -DCMAKE_INSTALL_PREFIX=$liboqs_DIR && ninja && ninja run_tests && ninja install
49+
env:
50+
liboqs_DIR: ${{ runner.workspace }}/local_deps/oqs
51+
- name: Install Openssl3.2.0-alpha2
52+
run: |
53+
git clone --branch openssl-3.2.0-alpha2 https://github.com/openssl/openssl.git
54+
cd openssl
55+
./Configure --prefix=$OPENSSL_ROOT_DIR --openssldir=$OPENSSL_ROOT_DIR no-docs -lm && make && make $NPROC install LIBDIR=lib
56+
env:
57+
OPENSSL_ROOT_DIR: ${{ runner.workspace }}/local_deps/ossl
58+
59+
- name: Install OQS-provider
60+
run: |
61+
git clone https://github.com/open-quantum-safe/oqs-provider.git
62+
cd oqs-provider
63+
cmake -S . -B _build && cmake --build _build && ctest --test-dir _build && cmake --install _build
64+
env:
65+
OPENSSL_ROOT_DIR: ${{ runner.workspace }}/local_deps/ossl
66+
liboqs_DIR: ${{ runner.workspace }}/local_deps/oqs
3267

3368
# Initializes the CodeQL tools for scanning.
3469
- name: Initialize CodeQL
3570
uses: github/codeql-action/init@v2
3671
with:
3772
languages: ${{ matrix.language }}
3873

39-
- name: Autobuild
40-
uses: github/codeql-action/autobuild@v2
74+
#- name: Autobuild
75+
#uses: github/codeql-action/autobuild@v2
76+
#env:
77+
# OPENSSL_ROOT_DIR: ${{ runner.workspace }}/local_deps/ossl
4178

4279
# ℹ️ Command-line programs to run using the OS shell.
4380
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
4481

4582
# If the Autobuild fails above, remove it and uncomment the following three lines.
4683
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
47-
48-
# - run: |
49-
# echo "Run, Build Application using script"
50-
# ./location_of_script_within_repo/buildscript.sh
84+
- name: Build bind9
85+
run: |
86+
cd ${{ runner.workspace }}/OQS-bind
87+
autoreconf -fi
88+
./configure CFLAGS="-Wl,--no-as-needed" LIBS="-ldl" --with-openssl=$OPENSSL_ROOT_DIR
89+
make -j $NPROC
90+
env:
91+
OPENSSL_ROOT_DIR: ${{ runner.workspace }}/local_deps/ossl
5192

5293
- name: Perform CodeQL Analysis
5394
uses: github/codeql-action/analyze@v2

‎bin/dnssec/dnssec-keygen.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -828,7 +828,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
828828
}
829829
}
830830
dst_key_free(&key);
831-
832831
}
833832
} while (conflict);
834833

@@ -885,7 +884,8 @@ main(int argc, char **argv) {
885884
int ch;
886885
bool set_fips_mode = false;
887886
#if OPENSSL_VERSION_NUMBER >= 0x30200000L && OPENSSL_API_LEVEL >= 30200
888-
OSSL_PROVIDER *fips = NULL, *base = NULL, *oqs = NULL, *default_provider = NULL;
887+
OSSL_PROVIDER *fips = NULL, *base = NULL, *oqs = NULL,
888+
*default_provider = NULL;
889889
#endif
890890

891891
keygen_ctx_t ctx = {

‎bin/dnssec/dnssec-signzone.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,13 @@ static int nsec_datatype = dns_rdatatype_nsec;
106106
"dns_dbiterator_current()")
107107

108108
#define IS_NSEC3 (nsec_datatype == dns_rdatatype_nsec3)
109-
#define OPTOUT(x) (((x)&DNS_NSEC3FLAG_OPTOUT) != 0)
109+
#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
110110

111111
#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
112112

113-
#define BUFSIZE 8192 // OQS increased from 2049 to 8192 to account for SPHINCS+ 128S signatures.
113+
#define BUFSIZE \
114+
8192 // OQS increased from 2049 to 8192 to account for SPHINCS+ 128S
115+
// signatures.
114116
#define MAXDSKEYS 8
115117

116118
#define SIGNER_EVENTCLASS ISC_EVENTCLASS(0x4453)
@@ -3372,7 +3374,8 @@ main(int argc, char *argv[]) {
33723374
bool nonsecify = false;
33733375
bool set_fips_mode = false;
33743376
#if OPENSSL_VERSION_NUMBER >= 0x30200000L && OPENSSL_API_LEVEL >= 30200
3375-
OSSL_PROVIDER *fips = NULL, *base = NULL, *oqs = NULL, *default_provider = NULL;
3377+
OSSL_PROVIDER *fips = NULL, *base = NULL, *oqs = NULL,
3378+
*default_provider = NULL;
33763379
#endif
33773380

33783381
atomic_init(&shuttingdown, false);

‎bin/named/main.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,8 @@ static bool disable6 = false;
154154
static bool disable4 = false;
155155

156156
#if OPENSSL_VERSION_NUMBER >= 0x30200000L && OPENSSL_API_LEVEL >= 30200
157-
static OSSL_PROVIDER *fips = NULL, *base = NULL, *oqs = NULL, *default_provider = NULL;
157+
static OSSL_PROVIDER *fips = NULL, *base = NULL, *oqs = NULL,
158+
*default_provider = NULL;
158159
#endif
159160

160161
void
@@ -1562,7 +1563,8 @@ main(int argc, char *argv[]) {
15621563
ERR_clear_error();
15631564
named_main_earlyfatal("Failed to load default provider");
15641565
}
1565-
#endif /* if OPENSSL_VERSION_NUMER >= 0x30200000L && OPENSSL_API_LEVEL >= 30200 */
1566+
#endif /* if OPENSSL_VERSION_NUMER >= 0x30200000L && OPENSSL_API_LEVEL >= \
1567+
30200 */
15661568
#ifdef ENABLE_AFL
15671569
if (named_g_fuzz_type != isc_fuzz_none) {
15681570
named_fuzz_setup();

‎configure.ac

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -697,12 +697,17 @@ AM_CONDITIONAL([USE_ISC_RWLOCK], [test "$enable_pthread_rwlock" != "yes"])
697697
CRYPTO=OpenSSL
698698

699699
#
700-
# OpenSSL/LibreSSL is mandatory
700+
# OpenSSL is mandatory
701701
#
702-
PKG_CHECK_MODULES([OPENSSL], [libssl libcrypto], [PKG_CHECK_VERSION([OPENSSL_VERSION], [openssl])],
703-
[AX_CHECK_OPENSSL([:], [AC_MSG_FAILURE([OpenSSL/LibreSSL not found])])])
702+
AX_CHECK_OPENSSL([:], [AC_MSG_FAILURE([OpenSSL not found])])
704703

705704
AX_SAVE_FLAGS([openssl])
705+
CFLAGS="$OPENSSL_CFLAGS $CFLAGS"
706+
LIBS="$OPENSSL_LIBS $LIBS"
707+
AC_MSG_NOTICE(["OPENSSL_CFLAGS=${OPENSSL_CFLAGS}"])
708+
AC_MSG_NOTICE(["OPENSSL_LIBS=${OPENSSL_LIBS}"])
709+
AC_MSG_NOTICE(["OPENSSL_LDFLAGS=${OPENSSL_LDFLAGS}"])
710+
AC_MSG_NOTICE(["OPENSSL_VERSION=${OPENSSL_VERSION}"])
706711

707712
CFLAGS="$OPENSSL_CFLAGS $CFLAGS"
708713
LIBS="$OPENSSL_LIBS $LIBS"
@@ -718,7 +723,7 @@ AC_COMPILE_IFELSE(
718723
[AC_MSG_FAILURE([not found])])
719724

720725
#
721-
# Check for functions added in OpenSSL or LibreSSL
726+
# Check for functions added in OpenSSL
722727
#
723728

724729
AC_CHECK_FUNCS([BIO_read_ex BIO_write_ex])

‎lib/dns/adb.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -457,8 +457,8 @@ enum {
457457
* These are currently used on simple unsigned ints, so they are
458458
* not really associated with any particular type.
459459
*/
460-
#define WANT_INET(x) (((x)&DNS_ADBFIND_INET) != 0)
461-
#define WANT_INET6(x) (((x)&DNS_ADBFIND_INET6) != 0)
460+
#define WANT_INET(x) (((x) & DNS_ADBFIND_INET) != 0)
461+
#define WANT_INET6(x) (((x) & DNS_ADBFIND_INET6) != 0)
462462

463463
#define EXPIRE_OK(exp, now) ((exp == INT_MAX) || (exp < now))
464464

@@ -469,7 +469,7 @@ enum {
469469
*/
470470
#define STARTATZONE_MATCHES(nf, o) \
471471
(((nf)->flags & DNS_ADBFIND_STARTATZONE) == \
472-
((o)&DNS_ADBFIND_STARTATZONE))
472+
((o) & DNS_ADBFIND_STARTATZONE))
473473

474474
#define ENTER_LEVEL ISC_LOG_DEBUG(50)
475475
#define CLEAN_LEVEL ISC_LOG_DEBUG(100)

‎lib/dns/dnssec.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1155,7 +1155,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
11551155
dns_rdata_toregion(&rdata, &r);
11561156
r.length -= sig.siglen;
11571157
RETERR(dst_context_adddata(ctx, &r));
1158-
1158+
11591159
/*
11601160
* If this is a response, digest the query.
11611161
*/

‎lib/dns/dst_api.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
231231
RETERR(dst__openssloqs_init(&dst_t_func[DST_ALG_FALCON512]));
232232
RETERR(dst__openssloqs_init(&dst_t_func[DST_ALG_DILITHIUM2]));
233233
RETERR(dst__openssloqs_init(&dst_t_func[DST_ALG_SPHINCSSHA256128S]));
234-
234+
235235
dst_initialized = true;
236236
return (ISC_R_SUCCESS);
237237

‎lib/dns/dst_parse.c

Lines changed: 62 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -70,60 +70,63 @@ struct parse_map {
7070
const char *tag;
7171
};
7272

73-
static struct parse_map map[] = { { TAG_RSA_MODULUS, "Modulus:" },
74-
{ TAG_RSA_PUBLICEXPONENT, "PublicExponent:" },
75-
{ TAG_RSA_PRIVATEEXPONENT, "PrivateExponent"
76-
":" },
77-
{ TAG_RSA_PRIME1, "Prime1:" },
78-
{ TAG_RSA_PRIME2, "Prime2:" },
79-
{ TAG_RSA_EXPONENT1, "Exponent1:" },
80-
{ TAG_RSA_EXPONENT2, "Exponent2:" },
81-
{ TAG_RSA_COEFFICIENT, "Coefficient:" },
82-
{ TAG_RSA_ENGINE, "Engine:" },
83-
{ TAG_RSA_LABEL, "Label:" },
84-
85-
{ TAG_ECDSA_PRIVATEKEY, "PrivateKey:" },
86-
{ TAG_ECDSA_ENGINE, "Engine:" },
87-
{ TAG_ECDSA_LABEL, "Label:" },
88-
89-
{ TAG_EDDSA_PRIVATEKEY, "PrivateKey:" },
90-
{ TAG_EDDSA_ENGINE, "Engine:" },
91-
{ TAG_EDDSA_LABEL, "Label:" },
92-
93-
{ TAG_HMACMD5_KEY, "Key:" },
94-
{ TAG_HMACMD5_BITS, "Bits:" },
95-
96-
{ TAG_HMACSHA1_KEY, "Key:" },
97-
{ TAG_HMACSHA1_BITS, "Bits:" },
98-
99-
{ TAG_HMACSHA224_KEY, "Key:" },
100-
{ TAG_HMACSHA224_BITS, "Bits:" },
101-
102-
{ TAG_HMACSHA256_KEY, "Key:" },
103-
{ TAG_HMACSHA256_BITS, "Bits:" },
104-
105-
{ TAG_HMACSHA384_KEY, "Key:" },
106-
{ TAG_HMACSHA384_BITS, "Bits:" },
107-
108-
{ TAG_HMACSHA512_KEY, "Key:" },
109-
{ TAG_HMACSHA512_BITS, "Bits:" },
110-
111-
{ TAG_FALCON512_PRIVATEKEY, "PrivateKey:" },
112-
{ TAG_FALCON512_PUBLICKEY, "PublicKey:" },
113-
{ TAG_FALCON512_ENGINE, "Engine:" }, // Probably won't use for now
114-
{ TAG_FALCON512_LABEL, "Label:" }, // Probably won't use for now
115-
116-
{ TAG_DILITHIUM2_PRIVATEKEY, "PrivateKey:" },
117-
{ TAG_DILITHIUM2_PUBLICKEY, "PublicKey:" },
118-
{ TAG_DILITHIUM2_ENGINE, "Engine:" }, // Probably won't use for now
119-
{ TAG_DILITHIUM2_LABEL, "Label:" }, // Probably won't use for now
120-
121-
{ TAG_SPHINCSSHA256128S_PRIVATEKEY, "PrivateKey:" },
122-
{ TAG_SPHINCSSHA256128S_PUBLICKEY, "PublicKey:" },
123-
{ TAG_SPHINCSSHA256128S_ENGINE, "Engine:" }, // Probably won't use for now
124-
{ TAG_SPHINCSSHA256128S_LABEL, "Label:" }, // Probably won't use for now
125-
126-
{ 0, NULL } };
73+
static struct parse_map map[] = {
74+
{ TAG_RSA_MODULUS, "Modulus:" },
75+
{ TAG_RSA_PUBLICEXPONENT, "PublicExponent:" },
76+
{ TAG_RSA_PRIVATEEXPONENT, "PrivateExponent"
77+
":" },
78+
{ TAG_RSA_PRIME1, "Prime1:" },
79+
{ TAG_RSA_PRIME2, "Prime2:" },
80+
{ TAG_RSA_EXPONENT1, "Exponent1:" },
81+
{ TAG_RSA_EXPONENT2, "Exponent2:" },
82+
{ TAG_RSA_COEFFICIENT, "Coefficient:" },
83+
{ TAG_RSA_ENGINE, "Engine:" },
84+
{ TAG_RSA_LABEL, "Label:" },
85+
86+
{ TAG_ECDSA_PRIVATEKEY, "PrivateKey:" },
87+
{ TAG_ECDSA_ENGINE, "Engine:" },
88+
{ TAG_ECDSA_LABEL, "Label:" },
89+
90+
{ TAG_EDDSA_PRIVATEKEY, "PrivateKey:" },
91+
{ TAG_EDDSA_ENGINE, "Engine:" },
92+
{ TAG_EDDSA_LABEL, "Label:" },
93+
94+
{ TAG_HMACMD5_KEY, "Key:" },
95+
{ TAG_HMACMD5_BITS, "Bits:" },
96+
97+
{ TAG_HMACSHA1_KEY, "Key:" },
98+
{ TAG_HMACSHA1_BITS, "Bits:" },
99+
100+
{ TAG_HMACSHA224_KEY, "Key:" },
101+
{ TAG_HMACSHA224_BITS, "Bits:" },
102+
103+
{ TAG_HMACSHA256_KEY, "Key:" },
104+
{ TAG_HMACSHA256_BITS, "Bits:" },
105+
106+
{ TAG_HMACSHA384_KEY, "Key:" },
107+
{ TAG_HMACSHA384_BITS, "Bits:" },
108+
109+
{ TAG_HMACSHA512_KEY, "Key:" },
110+
{ TAG_HMACSHA512_BITS, "Bits:" },
111+
112+
{ TAG_FALCON512_PRIVATEKEY, "PrivateKey:" },
113+
{ TAG_FALCON512_PUBLICKEY, "PublicKey:" },
114+
{ TAG_FALCON512_ENGINE, "Engine:" }, // Probably won't use for now
115+
{ TAG_FALCON512_LABEL, "Label:" }, // Probably won't use for now
116+
117+
{ TAG_DILITHIUM2_PRIVATEKEY, "PrivateKey:" },
118+
{ TAG_DILITHIUM2_PUBLICKEY, "PublicKey:" },
119+
{ TAG_DILITHIUM2_ENGINE, "Engine:" }, // Probably won't use for now
120+
{ TAG_DILITHIUM2_LABEL, "Label:" }, // Probably won't use for now
121+
122+
{ TAG_SPHINCSSHA256128S_PRIVATEKEY, "PrivateKey:" },
123+
{ TAG_SPHINCSSHA256128S_PUBLICKEY, "PublicKey:" },
124+
{ TAG_SPHINCSSHA256128S_ENGINE, "Engine:" }, // Probably won't use for
125+
// now
126+
{ TAG_SPHINCSSHA256128S_LABEL, "Label:" }, // Probably won't use for now
127+
128+
{ 0, NULL }
129+
};
127130

128131
static int
129132
find_value(const char *s, const unsigned int alg) {
@@ -341,10 +344,10 @@ check_hmac_sha(const dst_private_t *priv, unsigned int ntags,
341344
// we only need to use one of the algorithms tags. This is define is
342345
// to make the code below easier to read.
343346

344-
#define TAG_OQS_LABEL TAG_FALCON512_LABEL
345-
#define TAG_OQS_ENGINE TAG_FALCON512_ENGINE
347+
#define TAG_OQS_LABEL TAG_FALCON512_LABEL
348+
#define TAG_OQS_ENGINE TAG_FALCON512_ENGINE
346349
#define TAG_OQS_PRIVATEKEY TAG_FALCON512_PRIVATEKEY
347-
#define TAG_OQS_PUBLICKEY TAG_FALCON512_PUBLICKEY
350+
#define TAG_OQS_PUBLICKEY TAG_FALCON512_PUBLICKEY
348351

349352
static int
350353
check_oqs(const dst_private_t *priv, const unsigned int alg, bool external) {
@@ -376,8 +379,8 @@ check_oqs(const dst_private_t *priv, const unsigned int alg, bool external) {
376379
if (have[TAG_OQS_ENGINE & mask]) {
377380
ok = have[TAG_OQS_LABEL & mask];
378381
} else {
379-
ok = have[TAG_OQS_PRIVATEKEY & mask]
380-
&& have[TAG_OQS_PUBLICKEY & mask];
382+
ok = have[TAG_OQS_PRIVATEKEY & mask] &&
383+
have[TAG_OQS_PUBLICKEY & mask];
381384
}
382385
return (ok ? 0 : -1);
383386
}

0 commit comments

Comments
 (0)