Merge branch 'main' into dependabot/github_actions/codeql-action-f442528237

Author: gdams

cmd/mksyscall/main.go

@@ -12,6 +12,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"strings"
 )
 
 const mkwinsyscallVersion = "v0.37.0"
@@ -36,7 +37,10 @@ func main() {
 		fmt.Fprintf(flag.CommandLine.Output(), "%s\n\n", description)
 	}
 	flag.Parse()
-	goTool := filepath.Join(runtime.GOROOT(), "bin", "go")
+	goTool, err := exec.LookPath("go")
+	if err != nil {
+		log.Fatal(err)
+	}
 
 	listCmd := exec.Command(goTool, "list", "-m")
 	listCmd.Env = append(os.Environ(), "GO111MODULE=on")
@@ -47,8 +51,8 @@ func main() {
 		log.Fatal("WARNING: Please switch from using:\n    go run ./cmd/mksyscall\nto using:\n    go run golang.org/x/sys/windows/mkwinsyscall\n")
 	}
 
-	install(goTool)
-	zsys := generateSyscalls()
+	mkwinsyscall := install(goTool)
+	zsys := generateSyscalls(mkwinsyscall)
 
 	if *output == "" {
 		os.Stdout.Write(zsys)
@@ -62,7 +66,7 @@ func main() {
 
 // install makes sure mkwinsyscall can be called by
 // running go install golang.org/x/sys/windows/mkwinsyscall.
-func install(goTool string) {
+func install(goTool string) string {
 	// mkwinsyscall is hardcoded here instead of adding it to go.mod so
 	// it doesn't appear in go.sum, which will reduce the likelihood
 	// of having patch conflicts when vendoring go-crypto-winnative.
@@ -75,6 +79,29 @@ func install(goTool string) {
 	if err != nil {
 		log.Fatal(err)
 	}
+
+	binDir := goEnv(goTool, "GOBIN")
+	if binDir == "" {
+		goPaths := filepath.SplitList(goEnv(goTool, "GOPATH"))
+		if len(goPaths) == 0 {
+			log.Fatal("GOPATH is empty")
+		}
+		binDir = filepath.Join(goPaths[0], "bin")
+	}
+	binary := "mkwinsyscall"
+	if runtime.GOOS == "windows" {
+		binary += ".exe"
+	}
+	return filepath.Join(binDir, binary)
+}
+
+func goEnv(goTool, name string) string {
+	cmd := exec.Command(goTool, "env", name)
+	output, err := cmd.Output()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return strings.TrimSpace(string(output))
 }
 
 // generateSyscalls runs mkwinsyscall with GOROOT set to the current working directory.
@@ -84,15 +111,15 @@ func install(goTool string) {
 // to avoid DLL preloading attacks. As sysdll is a std internal package, this function
 // replaces the generated code's sysdll import with our own version located at
 // "./internal/sysdll".
-func generateSyscalls() []byte {
+func generateSyscalls(mkwinsyscall string) []byte {
 	wd, err := os.Getwd()
 	if err != nil {
 		log.Fatal(err)
 	}
 	args := flag.Args()
 	// We have intercepted the output argument, so we can be sure
 	// that mkwinsyscall will emit the generated file to the standard output.
-	cmd := exec.Command("mkwinsyscall", args...)
+	cmd := exec.Command(mkwinsyscall, args...)
 	var bout bytes.Buffer
 	cmd.Stdout = &bout
 	cmd.Stderr = os.Stderr
@@ -104,6 +131,7 @@ func generateSyscalls() []byte {
 	zsys := bout.Bytes()
 	zsys = bytes.ReplaceAll(zsys, []byte("\"internal/syscall/windows/sysdll\""), []byte("\"github.com/microsoft/go-crypto-winnative/internal/sysdll\""))
 	zsys = bytes.ReplaceAll(zsys, []byte("windows.NTStatus"), []byte("NTStatus"))
+	zsys = bytes.ReplaceAll(zsys, []byte(".dll.dll\""), []byte(".dll\""))
 
 	return zsys
 }

cmd/mkwinmd/main.go

@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+// Command mkwinmd runs the pinned go-winmd generator with Win32 metadata from NuGet.
+package main
+
+import (
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+)
+
+const (
+	goWinMDModule       = "github.com/microsoft/go-winmd"
+	goWinMDVersion      = "v0.0.0-20260825140017-369639105e55"
+	metadataPackage     = "Microsoft.Windows.SDK.Win32Metadata"
+	metadataVersion     = "71.0.20-preview"
+	metadataArchivePath = "Windows.Win32.winmd"
+)
+
+func main() {
+	goTool, err := exec.LookPath("go")
+	if err != nil {
+		log.Fatal(err)
+	}
+	source := downloadMetadata(goTool)
+
+	args := []string{"run", goWinMDModule + "/cmd/gowinmd@" + goWinMDVersion, "-source", source}
+	args = append(args, os.Args[1:]...)
+	runGo(goTool, args...)
+}
+
+func downloadMetadata(goTool string) string {
+	cacheDir, err := os.UserCacheDir()
+	if err != nil {
+		log.Fatal(err)
+	}
+	path := filepath.Join(cacheDir, "go-crypto-winnative", metadataPackage, metadataVersion, metadataArchivePath)
+	if info, err := os.Stat(path); err == nil && info.Size() > 0 {
+		return path
+	}
+
+	runGo(goTool,
+		"run", goWinMDModule+"/cmd/getwinmd@"+goWinMDVersion,
+		"-version", metadataVersion,
+		"-output", path,
+	)
+	return path
+}
+
+func runGo(goTool string, args ...string) {
+	cmd := exec.Command(goTool, args...)
+	cmd.Env = append(os.Environ(), "GO111MODULE=on")
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		log.Fatal(err)
+	}
+}

cng/chacha20poly1305.go

@@ -45,7 +45,7 @@ func NewChaCha20Poly1305(key []byte) (cipher.AEAD, error) {
 }
 
 func (c *chacha20poly1305) finalize() {
-	if c.kh != 0 {
+	if c.kh != nil {
 		bcrypt.DestroyKey(c.kh)
 	}
 }

cng/chacha20poly1305_test.go

@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build windows
+// +build windows
+
 package cng_test
 
 import (

cng/chacha20poly1305_vectors_test.go

@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build windows
+// +build windows
+
 package cng_test
 
 var chacha20Poly1305Tests = []struct {

cng/cipher.go

@@ -38,15 +38,15 @@ func loadCipher(id, mode string) (cipherAlgorithm, error) {
 func newCipherHandle(id, mode string, key []byte) (bcrypt.KEY_HANDLE, error) {
 	h, err := loadCipher(id, mode)
 	if err != nil {
-		return 0, err
+		return nil, err
 	}
 	if !keyIsAllowed(h.allowedKeyLengths, uint32(len(key)*8)) {
-		return 0, errors.New("crypto/cipher: invalid key size")
+		return nil, errors.New("crypto/cipher: invalid key size")
 	}
 	var kh bcrypt.KEY_HANDLE
 	err = bcrypt.GenerateSymmetricKey(h.handle, &kh, nil, key, 0)
 	if err != nil {
-		return 0, err
+		return nil, err
 	}
 	return kh, nil
 }

cng/cng.go

@@ -17,12 +17,12 @@ import (
 )
 
 func FIPS() (bool, error) {
-	var enabled bool
+	var enabled uint8
 	err := bcrypt.GetFipsAlgorithmMode(&enabled)
 	if err != nil {
 		return false, err
 	}
-	return enabled, nil
+	return enabled != 0, nil
 }
 
 // len32 clamps s length so it can fit into a Win32 LONG,
@@ -122,19 +122,19 @@ func getKeyLengths(h bcrypt.HANDLE) (lengths bcrypt.KEY_LENGTHS_STRUCT, err erro
 	if err != nil {
 		return
 	}
-	if lengths.MinLength > lengths.MaxLength || (lengths.Increment == 0 && lengths.MinLength != lengths.MaxLength) {
+	if lengths.DwMinLength > lengths.DwMaxLength || (lengths.DwIncrement == 0 && lengths.DwMinLength != lengths.DwMaxLength) {
 		err = errors.New("invalid BCRYPT_KEY_LENGTHS_STRUCT")
 		return
 	}
 	return lengths, nil
 }
 
 func keyIsAllowed(lengths bcrypt.KEY_LENGTHS_STRUCT, bits uint32) bool {
-	if bits < lengths.MinLength || bits > lengths.MaxLength {
+	if bits < lengths.DwMinLength || bits > lengths.DwMaxLength {
 		return false
 	}
-	if lengths.Increment == 0 {
-		return bits == lengths.MinLength
+	if lengths.DwIncrement == 0 {
+		return bits == lengths.DwMinLength
 	}
-	return (bits-lengths.MinLength)%lengths.Increment == 0
+	return (bits-lengths.DwMinLength)%lengths.DwIncrement == 0
 }