ephemeral-api: add a mechanism to define ephemeral API

This enables to implement ephemeral API functions without affecting
the library ABI.  This is particularly useful when you implement
unfinalized protocols.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

diff --git a/.gitignore b/.gitignore
index de27a2fc9a0f5cd39eeb9054573e382d95fface2..9d41782604bfa9d1171330a29533704f0228bbf4 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -214,6 +214,7 @@ lib/algorithms/libgnutls_alg.la
 lib/auth/libgnutls_auth.la
 libdane/gnutls-dane.pc
 libdane/libgnutls-dane.la
+lib/ephemeral_functions.h
 lib/ext/libgnutls_ext.la
 lib/extras/libgnutls_extras.la
 lib/gcrypt/libcrypto.la

diff --git a/lib/Makefile.am b/lib/Makefile.am
index eddd1167a72c8c5867ba205d1b0324a5ce0140d4..ec261ca10a97229940218cc51ab74a9328b47f71 100644 (file)
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -20,8 +20,11 @@
 
 ACLOCAL_AMFLAGS = -I ../m4 -I ../gl/m4
 
-EXTRA_DIST = priority_options.gperf common.mk inih/LICENSE.txt
-BUILT_SOURCES = pkix_asn1_tab.c gnutls_asn1_tab.c priority_options.h
+EXTRA_DIST = priority_options.gperf common.mk inih/LICENSE.txt \
+       ephemeral_functions.gperf
+
+BUILT_SOURCES = pkix_asn1_tab.c gnutls_asn1_tab.c priority_options.h \
+       ephemeral_functions.h
 
 SUBDIRS = includes x509 auth ext algorithms extras accelerated
 
@@ -81,7 +84,7 @@ COBJECTS = range.c record.c compress.c debug.c cipher.c gthreads.h handshake-tls
        cert-session.c handshake-checks.c dtls-sw.c dh-primes.c openpgp_compat.c \
        crypto-selftests.c crypto-selftests-pk.c secrets.c extv.c extv.h \
        hello_ext_lib.c hello_ext_lib.h ocsp-api.c stek.c cert-cred-rawpk.c \
-       iov.c iov.h
+       iov.c iov.h ephemeral-api.c
 
 if ENABLE_GOST
 COBJECTS += vko.c
@@ -129,7 +132,8 @@ HFILES = abstract_int.h debug.h cipher.h     \
        srp.h auth/srp_kx.h auth/srp_passwd.h   \
        file.h supplemental.h crypto.h random.h system.h\
        locks.h mbuffers.h ecc.h pin.h fips.h \
-       priority_options.h secrets.h stek.h cert-cred.h
+       priority_options.h secrets.h stek.h cert-cred.h \
+       ephemeral_functions.h
 
 if ENABLE_PKCS11
 HFILES += pkcs11_int.h pkcs11x.h
@@ -248,3 +252,8 @@ priority_options.h: $(srcdir)/priority_options.gperf
        -gperf --global-table -t $^ > $@-tmp \
        && sed 's/^const struct priority_options_st \*/static const struct priority_options_st \*/' <$@-tmp >$@ \
        && rm -f $@-tmp
+
+ephemeral_functions.h: $(srcdir)/ephemeral_functions.gperf
+       -gperf --global-table -t $^ > $@-tmp \
+       && sed 's/^const struct ephemeral_function_st \*/static const struct ephemeral_function_st \*/' <$@-tmp >$@ \
+       && rm -f $@-tmp

diff --git a/lib/ephemeral-api.c b/lib/ephemeral-api.c
new file mode 100644 (file)
index 0000000..b39f420
--- /dev/null
+++ b/lib/ephemeral-api.c
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2020 Red Hat, Inc.
+ *
+ * Author: Daiki Ueno
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
+ *
+ */
+
+#include "gnutls_int.h"
+#include <string.h>
+
+/* This will define _gnutls_ephemeral_get */
+#include "ephemeral_functions.h"
+
+const void *_gnutls_ephemeral_get(const char *name);
+
+/**
+ * _gnutls_ephemeral_get:
+ * @name: the name of the ephemeral function
+ *
+ * Resolves an ephemeral function symbol by the name.
+ *
+ * Returns: a non-NULL function symbol or %NULL if it is not found
+ *
+ * Since: 3.6.13
+ */
+const void *
+_gnutls_ephemeral_get(const char *name)
+{
+       const struct ephemeral_function_st *func;
+
+       func = _gnutls_ephemeral_get_function(name, strlen(name));
+       if (func == NULL) {
+               gnutls_assert();
+               return NULL;
+       }
+
+       return func->func;
+}

diff --git a/lib/ephemeral_functions.gperf b/lib/ephemeral_functions.gperf
new file mode 100644 (file)
index 0000000..caf1f20
--- /dev/null
+++ b/lib/ephemeral_functions.gperf
@@ -0,0 +1,5 @@
+%define lookup-function-name _gnutls_ephemeral_get_function
+%language=ANSI-C
+%readonly-tables
+struct ephemeral_function_st { const char *name; void *func; };
+%%

diff --git a/lib/includes/Makefile.am b/lib/includes/Makefile.am
index 42bec1c35ed1910aff09e2533ee58884addd9813..fa2952f4856d7e90191bbdb7986c57a1eea1ce22 100644 (file)
--- a/lib/includes/Makefile.am
+++ b/lib/includes/Makefile.am
@@ -22,7 +22,8 @@ nobase_include_HEADERS = gnutls/x509.h gnutls/pkcs12.h gnutls/compat.h        \
        gnutls/openpgp.h gnutls/crypto.h gnutls/pkcs11.h                \
        gnutls/abstract.h gnutls/dtls.h gnutls/ocsp.h gnutls/tpm.h      \
        gnutls/x509-ext.h gnutls/self-test.h gnutls/system-keys.h       \
-       gnutls/urls.h gnutls/pkcs7.h gnutls/socket.h
+       gnutls/urls.h gnutls/pkcs7.h gnutls/socket.h \
+       gnutls/ephemeral.h
 
 if ENABLE_CXX
 nobase_include_HEADERS += gnutls/gnutlsxx.h

diff --git a/lib/includes/gnutls/ephemeral.h b/lib/includes/gnutls/ephemeral.h
new file mode 100644 (file)
index 0000000..9a9a6c8
--- /dev/null
+++ b/lib/includes/gnutls/ephemeral.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2020 Red Hat, Inc.
+ *
+ * Author: Daiki Ueno
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
+ *
+ */
+
+/* Ephemeral functions that are not exposed directly from the ABI. */
+
+#ifndef _GNUTLS_EPHEMERAL_H
+#define _GNUTLS_EPHEMERAL_H
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+extern "C" {
+#endif
+/* *INDENT-ON* */
+
+const void *_gnutls_ephemeral_get(const char *name);
+
+/**
+ * GNUTLS_EPHEMERAL_INT:
+ * @name: the name of the function
+ * @ret: the return type (must be integral)
+ * @arglist: the list of argument types
+ * @args: the arguments
+ *
+ * A macro for emitting the wrapper definition of an ephemeral function.
+ *
+ * Since: 3.6.13
+ */
+#define GNUTLS_EPHEMERAL_INT(name, ret, arglist, args) \
+static inline ret name arglist \
+{ \
+       const void *func = _gnutls_ephemeral_get(#name); \
+       if (func == NULL) \
+               return GNUTLS_E_UNIMPLEMENTED_FEATURE; \
+       return ((ret (*)arglist)func)args; \
+}
+
+/* *INDENT-OFF* */
+#ifdef __cplusplus
+}
+#endif
+/* *INDENT-ON* */
+
+#endif /* _GNUTLS_EPHEMERAL_H */

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index cfc1f35e922e438a18edf0b6cd98050be0c75c5d..bb5edc9f09ca1a8517c7f91d31171d838ec75992 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -3448,4 +3448,8 @@ void gnutls_fips140_set_mode(gnutls_fips_mode_t mode, unsigned flags);
 
 #include <gnutls/compat.h>
 
+#if defined(GNUTLS_INTERNAL_BUILD) || defined(GNUTLS_EPHEMERAL_API)
+#include <gnutls/ephemeral.h>
+#endif
+
 #endif                         /* GNUTLS_H */

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 234d43e755802a7fe0c63c7e45adb01f3c3c73e2..404e4432d98ce6ae3c249eef26df354e20755c5c 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -1416,4 +1416,5 @@ GNUTLS_PRIVATE_3_4 {
        _gnutls_buffer_unescape;
        _gnutls_buffer_pop_datum;
        _gnutls_buffer_clear;
+       _gnutls_ephemeral_get;
 } GNUTLS_3_4;

diff --git a/lib/prf.c b/lib/prf.c
index bb76e2ed4e46463b8d75070eb842367592bf47bf..40c52d156f1da282dd64149da246c09e2c7aa027 100644 (file)
--- a/lib/prf.c
+++ b/lib/prf.c
@@ -348,4 +348,3 @@ gnutls_prf(gnutls_session_t session,
 
        return ret;
 }
-

diff --git a/tests/tls13/prf.c b/tests/tls13/prf.c
index a8a529bcb8a1158aa214d416c8c234d39708ae03..fe985326f107d8d88c0e747f52f8f9fa10e5f95b 100644 (file)
--- a/tests/tls13/prf.c
+++ b/tests/tls13/prf.c
@@ -234,6 +234,12 @@ static void client(int fd)
                exit(1);
        }
 
+       ret = gnutls_prf_get(session);
+       if (ret != GNUTLS_MAC_SHA384) {
+               fprintf(stderr, "negotiated unexpected prf: %s\n", gnutls_mac_get_name(ret));
+               exit(1);
+       }
+
        check_prfs(session);
 
        gnutls_bye(session, GNUTLS_SHUT_WR);