Fix clang-tidy warning readability-qualified-auto

src/bogo_shim/bogo_shim.cpp

@@ -1512,7 +1512,7 @@ class Shim_Callbacks final : public Botan::TLS::Callbacks {
          }
 
          if(!cert_chain.empty() && cert_chain.front().is_self_signed()) {
-            for(const auto roots : trusted_roots) {
+            for(auto* const roots : trusted_roots) {
                if(roots->certificate_known(cert_chain.front())) {
                   shim_log("Trusting self-signed certificate");
                   return;

src/cli/tls_utils.cpp

@@ -126,11 +126,11 @@ class TLS_Client_Hello_Reader final : public Command {
          const auto* hello_base =
             std::visit([](const auto& ch) -> const Botan::TLS::Client_Hello* { return &ch; }, hello);
 
-         const auto version = std::visit(Botan::overloaded{
-                                            [](const Botan::TLS::Client_Hello_12&) { return "1.2"; },
-                                            [](const Botan::TLS::Client_Hello_13&) { return "1.3"; },
-                                         },
-                                         hello);
+         const std::string version = std::visit(Botan::overloaded{
+                                                   [](const Botan::TLS::Client_Hello_12&) { return "1.2"; },
+                                                   [](const Botan::TLS::Client_Hello_13&) { return "1.3"; },
+                                                },
+                                                hello);
 
          oss << "Version: " << version << "\n"
              << "Random: " << Botan::hex_encode(hello_base->random()) << "\n";
@@ -165,7 +165,7 @@ class TLS_Client_Hello_Reader final : public Command {
             oss << "\n";
          }
 
-         if(auto sg = hello_base->extensions().get<Botan::TLS::Supported_Groups>()) {
+         if(auto* sg = hello_base->extensions().get<Botan::TLS::Supported_Groups>()) {
             oss << "Supported Groups: ";
             for(const auto group : sg->groups()) {
                oss << group.to_string().value_or(Botan::fmt("Unknown group: {}", group.wire_code())) << " ";
@@ -183,7 +183,7 @@ class TLS_Client_Hello_Reader final : public Command {
                           hello_flags["Session Ticket"] = ch12.supports_session_ticket();
                        },
                        [&](const Botan::TLS::Client_Hello_13& ch13) {
-                          if(auto ks = ch13.extensions().get<Botan::TLS::Key_Share>()) {
+                          if(auto* ks = ch13.extensions().get<Botan::TLS::Key_Share>()) {
                              oss << "Key Shares: ";
                              for(const auto group : ks->offered_groups()) {
                                 oss << group.to_string().value_or(Botan::fmt("Unknown group: {}", group.wire_code()))

src/examples/tls_ssl_key_log_file.cpp

@@ -79,7 +79,7 @@ class Server_Credential : public Botan::Credentials_Manager {
          std::vector<Botan::X509_Certificate> certs;
          for(auto& cert : certificates) {
             std::string algorithm = cert.subject_public_key()->algo_name();
-            for(auto& key : cert_key_types) {
+            for(const auto& key : cert_key_types) {
                if(algorithm == key) {
                   certs.push_back(cert);
                }

src/examples/tls_stream_client.cpp

@@ -107,9 +107,9 @@ int main(int argc, char* argv[]) {
       return 1;
    }
 
-   const auto host = argv[1];
-   const auto port = argv[2];
-   const auto target = argv[3];
+   auto* const host = argv[1];
+   auto* const port = argv[2];
+   auto* const target = argv[3];
 
    try {
       boost::asio::io_context io_context;

src/fuzzer/mem_pool.cpp

@@ -88,7 +88,7 @@ void fuzz(std::span<const uint8_t> in) {
    std::map<uint8_t*, size_t> ptrs;
 
    size_t in_len = in.size();
-   auto x = in.data();
+   const auto* x = in.data();
    while(in_len > 0) {
       const uint8_t op = in[0] % 2;
       size_t idx = (in[0] >> 1);

src/lib/prov/tpm2/tpm2_context.cpp

@@ -53,11 +53,9 @@ bool Context::supports_botan_crypto_backend() noexcept {
 }
 
 std::shared_ptr<Context> Context::create(const std::string& tcti_nameconf) {
-   const auto nameconf_ptr = tcti_nameconf.c_str();
-
    TSS2_TCTI_CONTEXT* tcti_ctx = nullptr;
    ESYS_CONTEXT* esys_ctx = nullptr;
-   check_rc("TCTI Initialization", Tss2_TctiLdr_Initialize(nameconf_ptr, &tcti_ctx));
+   check_rc("TCTI Initialization", Tss2_TctiLdr_Initialize(tcti_nameconf.c_str(), &tcti_ctx));
    BOTAN_ASSERT_NONNULL(tcti_ctx);
    check_rc("TPM2 Initialization", Esys_Initialize(&esys_ctx, tcti_ctx, nullptr /* ABI version */));
    BOTAN_ASSERT_NONNULL(esys_ctx);
@@ -67,8 +65,8 @@ std::shared_ptr<Context> Context::create(const std::string& tcti_nameconf) {
 }
 
 std::shared_ptr<Context> Context::create(std::optional<std::string> tcti, std::optional<std::string> conf) {
-   const auto tcti_ptr = tcti.has_value() ? tcti->c_str() : nullptr;
-   const auto conf_ptr = conf.has_value() ? conf->c_str() : nullptr;
+   const char* const tcti_ptr = tcti.has_value() ? tcti->c_str() : nullptr;
+   const char* const conf_ptr = conf.has_value() ? conf->c_str() : nullptr;
 
    TSS2_TCTI_CONTEXT* tcti_ctx = nullptr;
    ESYS_CONTEXT* esys_ctx = nullptr;

src/lib/prov/tpm2/tpm2_crypto_backend/tpm2_crypto_backend_impl.cpp

@@ -94,7 +94,7 @@ template <typename T>
       return std::nullopt;
    }
 
-   auto ccs = reinterpret_cast<Botan::TPM2::CryptoCallbackState*>(userdata);
+   auto* ccs = reinterpret_cast<Botan::TPM2::CryptoCallbackState*>(userdata);
    if(!ccs) {
       return std::nullopt;
    }

src/lib/prov/tpm2/tpm2_pkops.cpp

@@ -70,7 +70,7 @@ std::vector<uint8_t> Signature_Operation::sign(Botan::RandomNumberGenerator& rng
    };
 
    auto signature = [&] {
-      if(auto h = dynamic_cast<HashFunction*>(hash())) {
+      if(auto* h = dynamic_cast<HashFunction*>(hash())) {
          // This is a TPM2-based hash object that calculated the digest on
          // the TPM. We can use the validation ticket to create the signature.
          auto [digest, validation] = h->final_with_ticket();

src/lib/pubkey/classic_mceliece/cmce_poly.cpp

@@ -126,12 +126,12 @@ std::optional<Classic_McEliece_Minimal_Polynomial> Classic_McEliece_Polynomial_R
 
 secure_vector<uint8_t> Classic_McEliece_Minimal_Polynomial::serialize() const {
    BOTAN_ASSERT_NOMSG(!coef().empty());
-   auto& all_coeffs = coef();
+   const auto& all_coeffs = coef();
    // Store all except coef for monomial x^t since polynomial is monic (ISO Spec Section 9.2.9)
    auto coeffs_to_store = std::span(all_coeffs).first(all_coeffs.size() - 1);
    secure_vector<uint8_t> bytes(sizeof(uint16_t) * coeffs_to_store.size());
    BufferStuffer bytes_stuf(bytes);
-   for(auto& coef : coeffs_to_store) {
+   for(const auto& coef : coeffs_to_store) {
       store_le(bytes_stuf.next<sizeof(CmceGfElem)>(), coef.elem().get());
    }
    BOTAN_ASSERT_NOMSG(bytes_stuf.full());

src/lib/pubkey/hss_lms/hss.cpp

@@ -273,7 +273,7 @@ std::vector<uint8_t> HSS_LMS_PrivateKeyInternal::sign(std::span<const uint8_t> m
 }
 
 LMS_PrivateKey HSS_LMS_PrivateKeyInternal::hss_derive_root_lms_private_key() const {
-   auto& top_params = hss_params().params_at_level(HSS_Level(0));
+   const auto& top_params = hss_params().params_at_level(HSS_Level(0));
    return LMS_PrivateKey(top_params.lms_params(), top_params.lmots_params(), m_identifier, m_hss_seed);
 }
 
@@ -303,7 +303,7 @@ LMS_PrivateKey HSS_LMS_PrivateKeyInternal::hss_derive_child_lms_private_key(
 }
 
 HSS_LMS_PublicKeyInternal HSS_LMS_PublicKeyInternal::create(const HSS_LMS_PrivateKeyInternal& hss_sk) {
-   auto& hss_params = hss_sk.hss_params();
+   const auto& hss_params = hss_sk.hss_params();
 
    const auto root_sk = hss_sk.hss_derive_root_lms_private_key();
    LMS_PublicKey top_pub_key = LMS_PublicKey(root_sk);

src/lib/pubkey/kex_to_kem_adapter/kex_to_kem_adapter.cpp

@@ -89,7 +89,7 @@ std::unique_ptr<PK_Key_Agreement_Key> generate_key_agreement_private_key(const P
 
    auto new_kex_key = [&] {
       auto new_private_key = kex_public_key.generate_another(rng);
-      const auto kex_key = dynamic_cast<PK_Key_Agreement_Key*>(new_private_key.get());
+      auto* const kex_key = dynamic_cast<PK_Key_Agreement_Key*>(new_private_key.get());
       if(kex_key) [[likely]] {
          // Intentionally leak new_private_key since we hold an alias of it in kex_key,
          // which is captured in a unique_ptr below
@@ -224,8 +224,8 @@ bool KEX_to_KEM_Adapter_PublicKey::supports_operation(PublicKeyOperation op) con
 namespace {
 
 std::unique_ptr<PK_Key_Agreement_Key> capture_as_ka_key(std::unique_ptr<Private_Key> private_key) {
-   auto raw_ptr = private_key.release();
-   if(auto sk = dynamic_cast<PK_Key_Agreement_Key*>(raw_ptr)) {
+   auto* raw_ptr = private_key.release();
+   if(auto* sk = dynamic_cast<PK_Key_Agreement_Key*>(raw_ptr)) {
       return std::unique_ptr<PK_Key_Agreement_Key>(sk);
    } else {
       delete raw_ptr;

src/lib/pubkey/kyber/kyber_common/kyber_algos.cpp

@@ -183,7 +183,7 @@ void sample_poly_cbd<KyberConstants::KyberEta::_3>(KyberPoly& poly,
 
 void encode_polynomial_vector(std::span<uint8_t> out, const KyberPolyVecNTT& vec) {
    BufferStuffer bs(out);
-   for(auto& v : vec) {
+   for(const auto& v : vec) {
       byte_encode(bs, v);
    }
    BOTAN_ASSERT_NOMSG(bs.full());

src/lib/tls/msg_cert_verify.cpp

@@ -149,7 +149,7 @@ Certificate_Verify_13::Certificate_Verify_13(const Certificate_13& certificate_m
       m_side(whoami) {
    BOTAN_ASSERT_NOMSG(!certificate_msg.empty());
 
-   const auto op_type = (m_side == Connection_Side::Client) ? "tls-client" : "tls-server";
+   const std::string op_type((m_side == Connection_Side::Client) ? "tls-client" : "tls-server");
    const auto context = std::string(hostname);
 
    const auto private_key = (certificate_msg.has_certificate_chain())

src/lib/tls/msg_client_hello.cpp

@@ -371,7 +371,7 @@ bool Client_Hello::sent_signature_algorithms() const {
 }
 
 std::vector<std::string> Client_Hello::next_protocols() const {
-   if(auto alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
+   if(auto* alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
       return alpn->protocols();
    }
    return {};
@@ -700,7 +700,7 @@ Client_Hello_13::Client_Hello_13(std::unique_ptr<Client_Hello_Internal> data) :
    }
 
    if(exts.has<Key_Share>()) {
-      const auto supported_ext = exts.get<Supported_Groups>();
+      auto* const supported_ext = exts.get<Supported_Groups>();
       BOTAN_ASSERT_NONNULL(supported_ext);
       const auto supports = supported_ext->groups();
       const auto offers = exts.get<Key_Share>()->offered_groups();
@@ -881,7 +881,7 @@ void Client_Hello_13::retry(const Hello_Retry_Request& hrr,
    BOTAN_STATE_CHECK(m_data->extensions().has<Supported_Groups>());
    BOTAN_STATE_CHECK(m_data->extensions().has<Key_Share>());
 
-   auto hrr_ks = hrr.extensions().get<Key_Share>();
+   auto* hrr_ks = hrr.extensions().get<Key_Share>();
    const auto& supported_groups = m_data->extensions().get<Supported_Groups>()->groups();
 
    if(hrr.extensions().has<Key_Share>()) {
@@ -907,7 +907,7 @@ void Client_Hello_13::retry(const Hello_Retry_Request& hrr,
    //       that the user keeps and detects this state themselves.
    cb.tls_modify_extensions(m_data->extensions(), Connection_Side::Client, type());
 
-   auto psk = m_data->extensions().get<PSK>();
+   auto* psk = m_data->extensions().get<PSK>();
    if(psk) {
       // Cipher suite should always be a known suite as this is checked upstream
       const auto cipher = Ciphersuite::by_id(hrr.ciphersuite());
@@ -944,7 +944,7 @@ void Client_Hello_13::validate_updates(const Client_Hello_13& new_ch) {
    // Check that extension omissions are justified
    for(const auto oldext : oldexts) {
       if(!newexts.contains(oldext)) {
-         const auto ext = extensions().get(oldext);
+         auto* const ext = extensions().get(oldext);
 
          // We don't make any assumptions about unimplemented extensions.
          if(!ext->is_implemented()) {
@@ -973,7 +973,7 @@ void Client_Hello_13::validate_updates(const Client_Hello_13& new_ch) {
    // Check that extension additions are justified
    for(const auto newext : newexts) {
       if(!oldexts.contains(newext)) {
-         const auto ext = new_ch.extensions().get(newext);
+         auto* const ext = new_ch.extensions().get(newext);
 
          // We don't make any assumptions about unimplemented extensions.
          if(!ext->is_implemented()) {
@@ -1023,7 +1023,7 @@ void Client_Hello_13::validate_updates(const Client_Hello_13& new_ch) {
 }
 
 void Client_Hello_13::calculate_psk_binders(Transcript_Hash_State ths) {
-   auto psk = m_data->extensions().get<PSK>();
+   auto* psk = m_data->extensions().get<PSK>();
    if(!psk || psk->empty()) {
       return;
    }
@@ -1047,7 +1047,7 @@ std::optional<Protocol_Version> Client_Hello_13::highest_supported_version(const
    //    which versions of TLS it supports and by the server to indicate which
    //    version it is using. The extension contains a list of supported
    //    versions in preference order, with the most preferred version first.
-   const auto supvers = m_data->extensions().get<Supported_Versions>();
+   auto* const supvers = m_data->extensions().get<Supported_Versions>();
    BOTAN_ASSERT_NONNULL(supvers);
 
    std::optional<Protocol_Version> result;

src/lib/tls/msg_server_hello.cpp

@@ -57,7 +57,7 @@ std::vector<uint8_t> make_server_hello_random(RandomNumberGenerator& rng,
    if(offered_version.is_pre_tls_13() && policy.allow_tls13()) {
       constexpr size_t downgrade_signal_length = sizeof(DOWNGRADE_TLS12);
       BOTAN_ASSERT_NOMSG(random.size() >= downgrade_signal_length);
-      auto lastbytes = random.data() + random.size() - downgrade_signal_length;
+      auto* lastbytes = random.data() + random.size() - downgrade_signal_length;
       store_be(DOWNGRADE_TLS12, lastbytes);
    }
 
@@ -388,7 +388,7 @@ bool Server_Hello_12::supports_session_ticket() const {
 }
 
 uint16_t Server_Hello_12::srtp_profile() const {
-   if(auto srtp = m_data->extensions().get<SRTP_Protection_Profiles>()) {
+   if(auto* srtp = m_data->extensions().get<SRTP_Protection_Profiles>()) {
       auto prof = srtp->profiles();
       if(prof.size() != 1 || prof[0] == 0) {
          throw Decoding_Error("Server sent malformed DTLS-SRTP extension");
@@ -400,14 +400,14 @@ uint16_t Server_Hello_12::srtp_profile() const {
 }
 
 std::string Server_Hello_12::next_protocol() const {
-   if(auto alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
+   if(auto* alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
       return alpn->single_protocol();
    }
    return "";
 }
 
 bool Server_Hello_12::prefers_compressed_ec_points() const {
-   if(auto ecc_formats = m_data->extensions().get<Supported_Point_Formats>()) {
+   if(auto* ecc_formats = m_data->extensions().get<Supported_Point_Formats>()) {
       return ecc_formats->prefers_compressed();
    }
    return false;
@@ -730,7 +730,7 @@ Server_Hello_13::Server_Hello_13(const Client_Hello_13& ch,
          key_exchange_group.value(), *ch.extensions().get<Key_Share>(), policy, cb, rng));
    }
 
-   auto& ch_exts = ch.extensions();
+   const auto& ch_exts = ch.extensions();
 
    if(ch_exts.has<PSK>()) {
       const auto cs = Ciphersuite::by_id(m_data->ciphersuite());
@@ -741,7 +741,7 @@ Server_Hello_13::Server_Hello_13(const Client_Hello_13& ch,
       //    offers a "pre_shared_key" extension.
       //
       // Note: Client_Hello_13 constructor already performed a graceful check.
-      const auto psk_modes = ch_exts.get<PSK_Key_Exchange_Modes>();
+      auto* const psk_modes = ch_exts.get<PSK_Key_Exchange_Modes>();
       BOTAN_ASSERT_NONNULL(psk_modes);
 
       // TODO: also support PSK_Key_Exchange_Mode::PSK_KE
@@ -773,7 +773,7 @@ std::optional<Protocol_Version> Server_Hello_13::random_signals_downgrade() cons
 }
 
 Protocol_Version Server_Hello_13::selected_version() const {
-   const auto versions_ext = m_data->extensions().get<Supported_Versions>();
+   auto* const versions_ext = m_data->extensions().get<Supported_Versions>();
    BOTAN_ASSERT_NOMSG(versions_ext);
    const auto& versions = versions_ext->versions();
    BOTAN_ASSERT_NOMSG(versions.size() == 1);

src/lib/tls/sessions_sql/tls_session_manager_sql.cpp

@@ -93,7 +93,7 @@ void Session_Manager_SQL::create_with_latest_schema(std::string_view passphrase,
 
    secure_vector<uint8_t> derived_key(32 + 2);
 
-   const auto pbkdf_name = "PBKDF2(SHA-512)";
+   const std::string pbkdf_name = "PBKDF2(SHA-512)";
    auto pbkdf_fam = PasswordHashFamily::create_or_throw(pbkdf_name);
 
    auto desired_runtime = std::chrono::milliseconds(100);

src/lib/tls/tls12/msg_client_kex.cpp

@@ -118,7 +118,7 @@ Client_Key_Exchange::Client_Key_Exchange(Handshake_IO& io,
          }
 
          if(curve_id.is_ecdh_named_curve()) {
-            auto ecdh_key = dynamic_cast<ECDH_PublicKey*>(private_key.get());
+            auto* ecdh_key = dynamic_cast<ECDH_PublicKey*>(private_key.get());
             if(!ecdh_key) {
                throw TLS_Exception(Alert::InternalError, "Application did not provide a ECDH_PublicKey");
             }
@@ -146,7 +146,7 @@ Client_Key_Exchange::Client_Key_Exchange(Handshake_IO& io,
          throw Internal_Error("No server public key for RSA exchange");
       }
 
-      if(auto rsa_pub = dynamic_cast<const RSA_PublicKey*>(server_public_key)) {
+      if(const auto* rsa_pub = dynamic_cast<const RSA_PublicKey*>(server_public_key)) {
          const Protocol_Version offered_version = state.client_hello()->legacy_version();
 
          rng.random_vec(m_pre_master, 48);

src/lib/tls/tls12/msg_server_kex.cpp

@@ -84,7 +84,7 @@ Server_Key_Exchange::Server_Key_Exchange(Handshake_IO& io,
       // `Policy::default_dh_group()` could return a `std::variant<Group_Params,
       // DL_Group>`, allowing it to define arbitrary groups.
       m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng);
-      auto dh = dynamic_cast<DH_PrivateKey*>(m_kex_key.get());
+      auto* dh = dynamic_cast<DH_PrivateKey*>(m_kex_key.get());
       if(!dh) {
          throw TLS_Exception(Alert::InternalError, "Application did not provide a Diffie-Hellman key");
       }
@@ -115,7 +115,7 @@ Server_Key_Exchange::Server_Key_Exchange(Handshake_IO& io,
          ecdh_public_val = m_kex_key->public_value();
       } else {
          m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng);
-         auto ecdh = dynamic_cast<ECDH_PrivateKey*>(m_kex_key.get());
+         auto* ecdh = dynamic_cast<ECDH_PrivateKey*>(m_kex_key.get());
          if(!ecdh) {
             throw TLS_Exception(Alert::InternalError, "Application did not provide a EC-Diffie-Hellman key");
          }