From 5aff9f2d898163d44cc6fc367e5e7fa57d342b90 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 5 Jan 2026 23:12:32 +0100 Subject: [PATCH] Rename parameters to improve clarity --- src/libsodium/include/sodium/utils.h | 4 +- src/libsodium/sodium/codecs.c | 54 +++++----- test/default/ipcrypt.c | 155 +++++++++++++++++++++++++++ test/default/ipcrypt.exp | 10 ++ 4 files changed, 194 insertions(+), 29 deletions(-) diff --git a/src/libsodium/include/sodium/utils.h b/src/libsodium/include/sodium/utils.h index 175ac573..49e3abfe 100644 --- a/src/libsodium/include/sodium/utils.h +++ b/src/libsodium/include/sodium/utils.h @@ -93,11 +93,11 @@ int sodium_base642bin(unsigned char *const bin, const size_t bin_maxlen, const c const char **const b64_end, const int variant) __attribute__((nonnull(1))); SODIUM_EXPORT -int sodium_ip2bin(unsigned char out[16], const char *src, size_t src_len) +int sodium_ip2bin(unsigned char bin[16], const char *ip, size_t ip_len) __attribute__((warn_unused_result)) __attribute__((nonnull)); SODIUM_EXPORT -char *sodium_bin2ip(char *dst, size_t dst_len, const unsigned char in[16]) +char *sodium_bin2ip(char *ip, size_t ip_maxlen, const unsigned char bin[16]) __attribute__((nonnull)); SODIUM_EXPORT diff --git a/src/libsodium/sodium/codecs.c b/src/libsodium/sodium/codecs.c index fb33e99c..7a9802e7 100644 --- a/src/libsodium/sodium/codecs.c +++ b/src/libsodium/sodium/codecs.c @@ -474,18 +474,18 @@ parse_ipv6(const char *src, const char *end, unsigned char out[16]) } int -sodium_ip2bin(unsigned char out[16], const char *src, size_t src_len) +sodium_ip2bin(unsigned char bin[16], const char *ip, size_t ip_len) { - const char *src_end = src + src_len; + const char *ip_end = ip + ip_len; const char *end; const char *z; unsigned char v4[4]; - for (end = src; end < src_end && *end != 0 && *end != '%'; end++) { + for (end = ip; end < ip_end && *end != 0 && *end != '%'; end++) { /* empty */ } - if (end < src_end && *end == '%') { - for (z = end + 1; z < src_end && *z != 0; z++) { + if (end < ip_end && *end == '%') { + for (z = end + 1; z < ip_end && *z != 0; z++) { if (isspace((unsigned char) *z)) { return -1; } @@ -494,19 +494,19 @@ sodium_ip2bin(unsigned char out[16], const char *src, size_t src_len) return -1; } } - if (memchr(src, ':', (size_t) (end - src)) != NULL) { - return parse_ipv6(src, end, out) != 0 ? 0 : -1; + if (memchr(ip, ':', (size_t) (end - ip)) != NULL) { + return parse_ipv6(ip, end, bin) != 0 ? 0 : -1; } - if (end < src_end && *end == '%') { + if (end < ip_end && *end == '%') { return -1; } - if (parse_ipv4(src, end, v4) == 0) { + if (parse_ipv4(ip, end, v4) == 0) { return -1; } - memset(out, 0, 10U); - out[10] = 0xffU; - out[11] = 0xffU; - memcpy(out + 12, v4, 4U); + memset(bin, 0, 10U); + bin[10] = 0xffU; + bin[11] = 0xffU; + memcpy(bin + 12, v4, 4U); return 0; } @@ -533,7 +533,7 @@ ip_write_num(char **p, unsigned int val, int base) } char * -sodium_bin2ip(char *dst, size_t dst_len, const unsigned char in[16]) +sodium_bin2ip(char *ip, size_t ip_maxlen, const unsigned char bin[16]) { char buf[46]; char *p = buf; @@ -544,27 +544,27 @@ sodium_bin2ip(char *dst, size_t dst_len, const unsigned char in[16]) int cur_len = 0; size_t len; - if (dst_len <= 2U) { + if (ip_maxlen <= 2U) { return NULL; } - if (memcmp(in, ipv4_mapped_prefix, 12U) == 0) { + if (memcmp(bin, ipv4_mapped_prefix, 12U) == 0) { for (i = 0; i < 4; i++) { if (i != 0) { *p++ = '.'; } - ip_write_num(&p, (unsigned int) in[12 + i], 10); + ip_write_num(&p, (unsigned int) bin[12 + i], 10); } len = (size_t) (p - buf); - if (len >= dst_len) { + if (len >= ip_maxlen) { return NULL; } - memcpy(dst, buf, len + 1U); - dst[len] = 0; + memcpy(ip, buf, len + 1U); + ip[len] = 0; - return dst; + return ip; } for (i = 0; i < 8; i++) { - unsigned int word = ((unsigned int) in[i * 2] << 8) | (unsigned int) in[i * 2 + 1]; + unsigned int word = ((unsigned int) bin[i * 2] << 8) | (unsigned int) bin[i * 2 + 1]; if (word == 0U) { if (cur_start < 0) { @@ -597,14 +597,14 @@ sodium_bin2ip(char *dst, size_t dst_len, const unsigned char in[16]) if (i != 0 && (best_start < 0 || i != best_start + best_len)) { *p++ = ':'; } - ip_write_num(&p, ((unsigned int) in[i * 2] << 8) | (unsigned int) in[i * 2 + 1], 16); + ip_write_num(&p, ((unsigned int) bin[i * 2] << 8) | (unsigned int) bin[i * 2 + 1], 16); } len = (size_t) (p - buf); - if (len >= dst_len) { + if (len >= ip_maxlen) { return NULL; } - memcpy(dst, buf, len); - dst[len] = 0; + memcpy(ip, buf, len); + ip[len] = 0; - return dst; + return ip; } diff --git a/test/default/ipcrypt.c b/test/default/ipcrypt.c index 3bdf7a60..a837fdbe 100644 --- a/test/default/ipcrypt.c +++ b/test/default/ipcrypt.c @@ -1,6 +1,9 @@ #define TEST_NAME "ipcrypt" #include "cmptest.h" +static const unsigned char ipv4_mapped_prefix[12] = { 0U, 0U, 0U, 0U, 0U, 0U, + 0U, 0U, 0U, 0U, 0xffU, 0xffU }; + static int check_expected(const char *test_name, const unsigned char *actual, const char *expected_hex, size_t len) @@ -27,10 +30,14 @@ main(void) unsigned char input[crypto_ipcrypt_BYTES]; unsigned char output[crypto_ipcrypt_BYTES]; unsigned char nd_output[crypto_ipcrypt_ND_OUTPUTBYTES]; + unsigned char nd_output2[crypto_ipcrypt_ND_OUTPUTBYTES]; unsigned char ndx_output[crypto_ipcrypt_NDX_OUTPUTBYTES]; + unsigned char ndx_output2[crypto_ipcrypt_NDX_OUTPUTBYTES]; unsigned char pfx_output[crypto_ipcrypt_PFX_BYTES]; unsigned char tweak_nd[crypto_ipcrypt_ND_TWEAKBYTES]; + unsigned char tweak_nd2[crypto_ipcrypt_ND_TWEAKBYTES]; unsigned char tweak_ndx[crypto_ipcrypt_NDX_TWEAKBYTES]; + unsigned char tweak_ndx2[crypto_ipcrypt_NDX_TWEAKBYTES]; unsigned char decrypted[crypto_ipcrypt_BYTES]; unsigned char encrypted1[crypto_ipcrypt_PFX_BYTES]; unsigned char encrypted2[crypto_ipcrypt_PFX_BYTES]; @@ -393,6 +400,14 @@ main(void) } printf("OK: IPv4 /16 prefix preserved for 172.16.x.x\n"); + if (memcmp(pfx_output, ipv4_mapped_prefix, 12) != 0 || + memcmp(encrypted1, ipv4_mapped_prefix, 12) != 0 || + memcmp(encrypted2, ipv4_mapped_prefix, 12) != 0) { + printf("FAILED: IPv4-mapped prefix not preserved in output\n"); + return 1; + } + printf("OK: IPv4-mapped prefix preserved in output\n"); + /* 2001:db8::a5c9:4e2f:bb91:5a7d */ memset(input, 0, sizeof input); input[0] = 0x20; @@ -585,6 +600,146 @@ main(void) } printf("OK: Different inputs produce different outputs\n"); + printf("\nedge case tests\n"); + + memset(key, 0x11, sizeof key); + memset(input, 0, sizeof input); + input[10] = 0xff; + input[11] = 0xff; + memset(tweak_nd, 0, sizeof tweak_nd); + memset(tweak_nd2, 0, sizeof tweak_nd2); + tweak_nd2[sizeof tweak_nd2 - 1] = 1U; + crypto_ipcrypt_nd_encrypt(nd_output, input, tweak_nd, key); + crypto_ipcrypt_nd_encrypt(nd_output2, input, tweak_nd2, key); + if (memcmp(nd_output, nd_output2, sizeof nd_output) == 0) { + printf("FAILED: nd tweak change did not affect output\n"); + return 1; + } + printf("OK: nd tweak changes output\n"); + + memset(ndx_key, 0x22, 16); + memset(ndx_key + 16, 0x33, 16); + memset(tweak_ndx, 0, sizeof tweak_ndx); + memset(tweak_ndx2, 0, sizeof tweak_ndx2); + tweak_ndx2[0] = 1U; + crypto_ipcrypt_ndx_encrypt(ndx_output, input, tweak_ndx, ndx_key); + crypto_ipcrypt_ndx_encrypt(ndx_output2, input, tweak_ndx2, ndx_key); + if (memcmp(ndx_output, ndx_output2, sizeof ndx_output) == 0) { + printf("FAILED: ndx tweak change did not affect output\n"); + return 1; + } + printf("OK: ndx tweak changes output\n"); + + memset(ndx_key, 0x44, 16); + memcpy(ndx_key + 16, ndx_key, 16); + memset(input, 0xaa, sizeof input); + memset(tweak_ndx, 0x5a, sizeof tweak_ndx); + crypto_ipcrypt_ndx_encrypt(ndx_output, input, tweak_ndx, ndx_key); + crypto_ipcrypt_ndx_decrypt(decrypted, ndx_output, ndx_key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: ndx equal-halves key round-trip\n"); + return 1; + } + printf("OK: ndx equal-halves key round-trip\n"); + + memset(pfx_key, 0x5b, 16); + memcpy(pfx_key + 16, pfx_key, 16); + memset(input, 0, sizeof input); + input[10] = 0xff; + input[11] = 0xff; + input[12] = 203; + input[13] = 0; + input[14] = 113; + input[15] = 7; + crypto_ipcrypt_pfx_encrypt(pfx_output, input, pfx_key); + crypto_ipcrypt_pfx_decrypt(decrypted, pfx_output, pfx_key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: pfx equal-halves key round-trip\n"); + return 1; + } + printf("OK: pfx equal-halves key round-trip\n"); + + memset(pfx_key, 0x7a, sizeof pfx_key); + memset(input, 0, sizeof input); + input[0] = 0x20; + input[1] = 0x01; + input[2] = 0x0d; + input[3] = 0xb8; + input[15] = 0x01; + crypto_ipcrypt_pfx_encrypt(pfx_output, input, pfx_key); + memcpy(decrypted, input, sizeof input); + crypto_ipcrypt_pfx_encrypt(decrypted, decrypted, pfx_key); + if (memcmp(pfx_output, decrypted, sizeof pfx_output) != 0) { + printf("FAILED: pfx in-place encryption differs\n"); + return 1; + } + crypto_ipcrypt_pfx_decrypt(decrypted, decrypted, pfx_key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: pfx in-place round-trip\n"); + return 1; + } + printf("OK: pfx in-place encryption/decryption\n"); + + memset(key, 0x13, sizeof key); + memset(ndx_key, 0x37, sizeof ndx_key); + memset(pfx_key, 0x59, sizeof pfx_key); + memset(tweak_nd, 0x1a, sizeof tweak_nd); + memset(tweak_ndx, 0x2b, sizeof tweak_ndx); + + memset(input, 0, sizeof input); + crypto_ipcrypt_encrypt(output, input, key); + crypto_ipcrypt_decrypt(decrypted, output, key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: ipcrypt IPv6 :: round-trip\n"); + return 1; + } + crypto_ipcrypt_nd_encrypt(nd_output, input, tweak_nd, key); + crypto_ipcrypt_nd_decrypt(decrypted, nd_output, key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: nd IPv6 :: round-trip\n"); + return 1; + } + crypto_ipcrypt_ndx_encrypt(ndx_output, input, tweak_ndx, ndx_key); + crypto_ipcrypt_ndx_decrypt(decrypted, ndx_output, ndx_key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: ndx IPv6 :: round-trip\n"); + return 1; + } + crypto_ipcrypt_pfx_encrypt(pfx_output, input, pfx_key); + crypto_ipcrypt_pfx_decrypt(decrypted, pfx_output, pfx_key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: pfx IPv6 :: round-trip\n"); + return 1; + } + printf("OK: IPv6 :: round-trips\n"); + + memset(input, 0xff, sizeof input); + crypto_ipcrypt_encrypt(output, input, key); + crypto_ipcrypt_decrypt(decrypted, output, key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: ipcrypt IPv6 all-ones round-trip\n"); + return 1; + } + crypto_ipcrypt_nd_encrypt(nd_output, input, tweak_nd, key); + crypto_ipcrypt_nd_decrypt(decrypted, nd_output, key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: nd IPv6 all-ones round-trip\n"); + return 1; + } + crypto_ipcrypt_ndx_encrypt(ndx_output, input, tweak_ndx, ndx_key); + crypto_ipcrypt_ndx_decrypt(decrypted, ndx_output, ndx_key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: ndx IPv6 all-ones round-trip\n"); + return 1; + } + crypto_ipcrypt_pfx_encrypt(pfx_output, input, pfx_key); + crypto_ipcrypt_pfx_decrypt(decrypted, pfx_output, pfx_key); + if (memcmp(input, decrypted, sizeof input) != 0) { + printf("FAILED: pfx IPv6 all-ones round-trip\n"); + return 1; + } + printf("OK: IPv6 all-ones round-trips\n"); + printf("\nAll specification test vectors passed!\n"); return 0; diff --git a/test/default/ipcrypt.exp b/test/default/ipcrypt.exp index 68e87dae..323a45d1 100644 --- a/test/default/ipcrypt.exp +++ b/test/default/ipcrypt.exp @@ -41,6 +41,7 @@ OK: pfx /16 test (172.16.5.193) OK: pfx /16 test (172.16.97.42) OK: pfx /16 test (172.16.248.177) OK: IPv4 /16 prefix preserved for 172.16.x.x +OK: IPv4-mapped prefix preserved in output OK: pfx /64 test (2001:db8::a5c9:4e2f:bb91:5a7d) OK: pfx /64 test (2001:db8::7234:d8f1:3c6e:9a52) OK: pfx /64 test (2001:db8::f1e0:937b:26d4:8c1a) @@ -56,4 +57,13 @@ OK: In-place encryption/decryption OK: Deterministic encryption OK: Different inputs produce different outputs +edge case tests +OK: nd tweak changes output +OK: ndx tweak changes output +OK: ndx equal-halves key round-trip +OK: pfx equal-halves key round-trip +OK: pfx in-place encryption/decryption +OK: IPv6 :: round-trips +OK: IPv6 all-ones round-trips + All specification test vectors passed!