Skip to content

Commit

Permalink
Mark parameter in ext/sodium as sensitive
Browse files Browse the repository at this point in the history
  • Loading branch information
@TimWolla
TimWolla committed Jun 13, 2022
1 parent c311ab7 commit 8f82433
Show file tree
Hide file tree
Showing 3 changed files with 230 additions and 6 deletions.
3 changes: 3 additions & 0 deletions ext/sodium/libsodium.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
#include "php_ini.h"
#include "ext/standard/info.h"
#include "php_libsodium.h"
#include "zend_attributes.h"
#include "zend_exceptions.h"

#include <sodium.h>
Expand Down Expand Up @@ -386,6 +387,8 @@ PHP_MINIT_FUNCTION(sodium)
}
#endif

register_libsodium_symbols(module_number);

return SUCCESS;
}

Expand Down
114 changes: 110 additions & 4 deletions ext/sodium/libsodium.stub.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,57 +5,91 @@
function sodium_crypto_aead_aes256gcm_is_available(): bool {}

#ifdef HAVE_AESGCM
/** @sensitive-param $key */
function sodium_crypto_aead_aes256gcm_decrypt(string $ciphertext, string $additional_data, string $nonce, string $key): string|false {}

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_aead_aes256gcm_encrypt(string $message, string $additional_data, string $nonce, string $key): string {}

function sodium_crypto_aead_aes256gcm_keygen(): string {}
#endif

/** @sensitive-param $key */
function sodium_crypto_aead_chacha20poly1305_decrypt(string $ciphertext, string $additional_data, string $nonce, string $key): string|false {}

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_aead_chacha20poly1305_encrypt(string $message, string $additional_data, string $nonce, string $key): string {}

function sodium_crypto_aead_chacha20poly1305_keygen(): string {}

/** @sensitive-param $key */
function sodium_crypto_aead_chacha20poly1305_ietf_decrypt(string $ciphertext, string $additional_data, string $nonce, string $key): string|false {}

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_aead_chacha20poly1305_ietf_encrypt(string $message, string $additional_data, string $nonce, string $key): string {}

function sodium_crypto_aead_chacha20poly1305_ietf_keygen(): string {}

#ifdef crypto_aead_xchacha20poly1305_IETF_NPUBBYTES
/** @sensitive-param $key */
function sodium_crypto_aead_xchacha20poly1305_ietf_decrypt(string $ciphertext, string $additional_data, string $nonce, string $key): string|false {}

function sodium_crypto_aead_xchacha20poly1305_ietf_keygen(): string {}

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_aead_xchacha20poly1305_ietf_encrypt(string $message, string $additional_data, string $nonce, string $key): string {}
#endif

/** @sensitive-param $key */
function sodium_crypto_auth(string $message, string $key): string {}

function sodium_crypto_auth_keygen(): string {}

/** @sensitive-param $key */
function sodium_crypto_auth_verify(string $mac, string $message, string $key): bool {}

/**
* @sensitive-param $message
* @sensitive-param $key_pair
*/
function sodium_crypto_box(string $message, string $nonce, string $key_pair): string {}

function sodium_crypto_box_keypair(): string {}

/** @sensitive-param $seed */
function sodium_crypto_box_seed_keypair(string $seed): string {}

/** @sensitive-param $secret_key */
function sodium_crypto_box_keypair_from_secretkey_and_publickey(string $secret_key, string $public_key): string {}

/** @sensitive-param $key_pair */
function sodium_crypto_box_open(string $ciphertext, string $nonce, string $key_pair): string|false {}

/** @sensitive-param $key_pair */
function sodium_crypto_box_publickey(string $key_pair): string {}

/** @sensitive-param $secret_key */
function sodium_crypto_box_publickey_from_secretkey(string $secret_key): string {}

/** @sensitive-param $message */
function sodium_crypto_box_seal(string $message, string $public_key): string {}

/** @sensitive-param $key_pair */
function sodium_crypto_box_seal_open(string $ciphertext, string $key_pair): string|false {}

/** @sensitive-param $key_pair */
function sodium_crypto_box_secretkey(string $key_pair): string {}

#ifdef crypto_core_ristretto255_HASHBYTES
Expand Down Expand Up @@ -88,38 +122,54 @@ function sodium_crypto_core_ristretto255_sub(string $p, string $q): string {}

function sodium_crypto_kx_keypair(): string {}

/** @sensitive-param $key_pair */
function sodium_crypto_kx_publickey(string $key_pair): string {}

/** @sensitive-param $key_pair */
function sodium_crypto_kx_secretkey(string $key_pair): string {}

/** @sensitive-param $seed */
function sodium_crypto_kx_seed_keypair(string $seed): string {}

/** @return array<int, string> */
/**
* @sensitive-param $client_key_pair
* @return array<int, string>
*/
function sodium_crypto_kx_client_session_keys(string $client_key_pair, string $server_key): array {}

/** @return array<int, string> */
/**
* @sensitive-param $server_key_pair
* @return array<int, string>
*
*/
function sodium_crypto_kx_server_session_keys(string $server_key_pair, string $client_key): array {}

/** @sensitive-param $key */
function sodium_crypto_generichash(string $message, string $key = "", int $length = SODIUM_CRYPTO_GENERICHASH_BYTES): string {}

function sodium_crypto_generichash_keygen(): string {}

/** @sensitive-param $key */
function sodium_crypto_generichash_init(string $key = "", int $length = SODIUM_CRYPTO_GENERICHASH_BYTES): string {}

/** @return true */
function sodium_crypto_generichash_update(string &$state, string $message): bool {}

function sodium_crypto_generichash_final(string &$state, int $length = SODIUM_CRYPTO_GENERICHASH_BYTES): string {}

/** @sensitive-param $key */
function sodium_crypto_kdf_derive_from_key(int $subkey_length, int $subkey_id, string $context, string $key): string {}

function sodium_crypto_kdf_keygen(): string {}

#ifdef crypto_pwhash_SALTBYTES
/** @sensitive-param $password */
function sodium_crypto_pwhash(int $length, string $password, string $salt, int $opslimit, int $memlimit, int $algo = SODIUM_CRYPTO_PWHASH_ALG_DEFAULT): string {}

/** @sensitive-param $password */
function sodium_crypto_pwhash_str(string $password, int $opslimit, int $memlimit): string {}

/** @sensitive-param $password */
function sodium_crypto_pwhash_str_verify(string $hash, string $password): bool {}
#endif

Expand All @@ -128,10 +178,13 @@ function sodium_crypto_pwhash_str_needs_rehash(string $password, int $opslimit,
#endif

#ifdef crypto_pwhash_scryptsalsa208sha256_SALTBYTES
/** @sensitive-param $password */
function sodium_crypto_pwhash_scryptsalsa208sha256(int $length, string $password, string $salt, int $opslimit, int $memlimit): string {}

/** @sensitive-param $password */
function sodium_crypto_pwhash_scryptsalsa208sha256_str(string $password, int $opslimit, int $memlimit): string {}

/** @sensitive-param $password */
function sodium_crypto_pwhash_scryptsalsa208sha256_str_verify(string $hash, string $password): bool {}
#endif

Expand All @@ -143,20 +196,32 @@ function sodium_crypto_scalarmult_ristretto255(string $n, string $p): string {}
function sodium_crypto_scalarmult_ristretto255_base(string $n): string {}
#endif

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_secretbox(string $message, string $nonce, string $key): string {}

function sodium_crypto_secretbox_keygen(): string {}

/**
* @sensitive-param $key
*/
function sodium_crypto_secretbox_open(string $ciphertext, string $nonce, string $key): string|false {}

#ifdef crypto_secretstream_xchacha20poly1305_ABYTES
function sodium_crypto_secretstream_xchacha20poly1305_keygen(): string {}

/** @return array<int, string> */
/**
* @sensitive-param $key
* @return array<int, string>
*/
function sodium_crypto_secretstream_xchacha20poly1305_init_push(string $key): array {}

/** @sensitive-param $message */
function sodium_crypto_secretstream_xchacha20poly1305_push(string &$state, string $message, string $additional_data = "", int $tag = SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_MESSAGE): string {}

/** @sensitive-param $key */
function sodium_crypto_secretstream_xchacha20poly1305_init_pull(string $header, string $key): string {}

/** @return array<int, int|string>|false */
Expand All @@ -165,75 +230,116 @@ function sodium_crypto_secretstream_xchacha20poly1305_pull(string &$state, strin
function sodium_crypto_secretstream_xchacha20poly1305_rekey(string &$state): void {}
#endif

/** @sensitive-param $key */
function sodium_crypto_shorthash(string $message, string $key): string {}

function sodium_crypto_shorthash_keygen(): string {}

/** @sensitive-param $secret_key */
function sodium_crypto_sign(string $message, string $secret_key): string {}

/** @sensitive-param $secret_key */
function sodium_crypto_sign_detached(string $message, string $secret_key): string {}

function sodium_crypto_sign_ed25519_pk_to_curve25519(string $public_key): string {}

/** @sensitive-param $secret_key */
function sodium_crypto_sign_ed25519_sk_to_curve25519(string $secret_key): string {}

function sodium_crypto_sign_keypair(): string {}

/** @sensitive-param $secret_key */
function sodium_crypto_sign_keypair_from_secretkey_and_publickey(string $secret_key, string $public_key): string {}

function sodium_crypto_sign_open(string $signed_message, string $public_key): string|false {}

/** @sensitive-param $key_pair */
function sodium_crypto_sign_publickey(string $key_pair): string {}

/** @sensitive-param $key_pair */
function sodium_crypto_sign_secretkey(string $key_pair): string {}

/** @sensitive-param $secret_key */
function sodium_crypto_sign_publickey_from_secretkey(string $secret_key): string {}

/** @sensitive-param $seed */
function sodium_crypto_sign_seed_keypair(string $seed): string {}

function sodium_crypto_sign_verify_detached(string $signature, string $message, string $public_key): bool {}

/** @sensitive-param $key */
function sodium_crypto_stream(int $length, string $nonce, string $key): string {}

function sodium_crypto_stream_keygen(): string {}

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_stream_xor(string $message, string $nonce, string $key): string {}

#if defined(crypto_stream_xchacha20_KEYBYTES)
/** @sensitive-param $key */
function sodium_crypto_stream_xchacha20(int $length, string $nonce, string $key): string {}

function sodium_crypto_stream_xchacha20_keygen(): string {}

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_stream_xchacha20_xor(string $message, string $nonce, string $key): string {}

/**
* @sensitive-param $message
* @sensitive-param $key
*/
function sodium_crypto_stream_xchacha20_xor_ic(string $message, string $nonce, int $counter, string $key): string {}
#endif

function sodium_add(string &$string1, string $string2): void {}

/**
* @sensitive-param $string1
* @sensitive-param $string2
*/
function sodium_compare(string $string1, string $string2): int {}

function sodium_increment(string &$string): void {}

/**
* @sensitive-param $string1
* @sensitive-param $string2
*/
function sodium_memcmp(string $string1, string $string2): int {}

/** @sensitive-param $string */
function sodium_memzero(string &$string): void {}

/** @sensitive-param $string */
function sodium_pad(string $string, int $block_size): string {}

/** @sensitive-param $string */
function sodium_unpad(string $string, int $block_size): string {}

/** @sensitive-param $string */
function sodium_bin2hex(string $string): string {}

/** @sensitive-param $string */
function sodium_hex2bin(string $string, string $ignore = ""): string {}

#ifdef sodium_base64_VARIANT_ORIGINAL
/** @sensitive-param $string */
function sodium_bin2base64(string $string, int $id): string {}

/** @sensitive-param $string */
function sodium_base642bin(string $string, int $id, string $ignore = ""): string {}
#endif

/** @alias sodium_crypto_box_publickey_from_secretkey */
/**
* @sensitive-param $secret_key
* @alias sodium_crypto_box_publickey_from_secretkey
*/
function sodium_crypto_scalarmult_base(string $secret_key): string {}

class SodiumException extends Exception {}

0 comments on commit 8f82433

Please sign in to comment.