GitHub/boringssl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

merge into: GitHub/boringssl:spm
Branches Tags
GitHub/boringssl:master GitHub/boringssl:spm GitHub/boringssl:master-with-bazel GitHub/boringssl:infra/config GitHub/boringssl:chromium-stable-with-bazel GitHub/boringssl:main-with-bazel GitHub/boringssl:chromium-stable GitHub/boringssl:3945 GitHub/boringssl:fips-android-20191008 GitHub/boringssl:esni GitHub/boringssl:3538 GitHub/boringssl:fips-20180730 GitHub/boringssl:3359 GitHub/boringssl:3282 GitHub/boringssl:3239 GitHub/boringssl:3202 GitHub/boringssl:3112 GitHub/boringssl:3071 GitHub/boringssl:3029 GitHub/boringssl:2987 GitHub/boringssl:2924 GitHub/boringssl:2883 GitHub/boringssl:2785 GitHub/boringssl:2661 GitHub/boringssl:2704 GitHub/boringssl:2623 GitHub/boringssl:2564 GitHub/boringssl:2490 GitHub/boringssl:2357 GitHub/boringssl:2311 GitHub/boringssl:2272 GitHub/boringssl:2214
..
pull from: GitHub/boringssl:master
Branches Tags
GitHub/boringssl:spm GitHub/boringssl:master-with-bazel GitHub/boringssl:master GitHub/boringssl:infra/config GitHub/boringssl:chromium-stable-with-bazel GitHub/boringssl:main-with-bazel GitHub/boringssl:chromium-stable GitHub/boringssl:3945 GitHub/boringssl:fips-android-20191008 GitHub/boringssl:esni GitHub/boringssl:3538 GitHub/boringssl:fips-20180730 GitHub/boringssl:3359 GitHub/boringssl:3282 GitHub/boringssl:3239 GitHub/boringssl:3202 GitHub/boringssl:3112 GitHub/boringssl:3071 GitHub/boringssl:3029 GitHub/boringssl:2987 GitHub/boringssl:2924 GitHub/boringssl:2883 GitHub/boringssl:2785 GitHub/boringssl:2661 GitHub/boringssl:2704 GitHub/boringssl:2623 GitHub/boringssl:2564 GitHub/boringssl:2490 GitHub/boringssl:2357 GitHub/boringssl:2311 GitHub/boringssl:2272 GitHub/boringssl:2214

205 Commits
spm .. master

Author SHA1 Message Date
Adam Langley 0cd846f24f delocation: large memory model support. 
Large memory models on x86-64 allow the code/data of a shared object /
executable to be larger than 2GiB. This is typically impossible because
x86-64 code frequently uses int32 offsets from RIP.

Consider the following program:

    int getpid();

    int main() {
        return getpid();
    }

This is turned into the following assembly under a large memory model:

.L0$pb:
	leaq	.L0$pb(%rip), %rax
	movabsq	$_GLOBAL_OFFSET_TABLE_-.L0$pb, %rcx
	addq	%rax, %rcx
	movabsq	$getpid@GOT, %rdx
	xorl	%eax, %eax
	jmpq	*(%rcx,%rdx)            # TAILCALL

And, with relocations:

   0:	48 8d 05 f9 ff ff ff 	lea    -0x7(%rip),%rax        # 0 <main>
   7:	48 b9 00 00 00 00 00 	movabs $0x0,%rcx
   e:	00 00 00
			9: R_X86_64_GOTPC64	_GLOBAL_OFFSET_TABLE_+0x9
  11:	48 01 c1             	add    %rax,%rcx
  14:	48 ba 00 00 00 00 00 	movabs $0x0,%rdx
  1b:	00 00 00
			16: R_X86_64_GOT64	getpid
  1e:	31 c0                	xor    %eax,%eax
  20:	ff 24 11             	jmpq   *(%rcx,%rdx,1)

We can see that, in the large memory model, function calls involve
loading the address of _GLOBAL_OFFSET_TABLE_ (using `movabs`, which
takes a 64-bit immediate) and then indexing into it. Both cause
relocations.

If we link the binary and disassemble we get:

0000000000001120 <main>:
    1120:	48 8d 05 f9 ff ff ff 	lea    -0x7(%rip),%rax        # 1120 <main>
    1127:	48 b9 e0 2e 00 00 00 	movabs $0x2ee0,%rcx
    112e:	00 00 00
    1131:	48 01 c1             	add    %rax,%rcx
    1134:	48 ba d8 ff ff ff ff 	movabs $0xffffffffffffffd8,%rdx
    113b:	ff ff ff
    113e:	31 c0                	xor    %eax,%eax
    1140:	ff 24 11             	jmpq   *(%rcx,%rdx,1)

Thus the _GLOBAL_OFFSET_TABLE_ symbol is at 0x1120+0x2ee0 = 0x4000.
That's the address of the .got.plt section. But the offset “into” the
table is -0x40, putting it at 0x3fd8, in .got:

Idx Name          Size      VMA               LMA               File off  Algn
 18 .got          00000030  0000000000003fd0  0000000000003fd0  00002fd0  2**3
 19 .got.plt      00000018  0000000000004000  0000000000004000  00003000  2**3

And, indeed, there's a dynamic relocation to setup that address:

OFFSET           TYPE              VALUE
0000000000003fd8 R_X86_64_GLOB_DAT  getpid@GLIBC_2.2.5

Accessing data or BSS works the same: the address of the variable is
stored relative to _GLOBAL_OFFSET_TABLE_.

This is a bit of a pain because we want to delocate the module into a
single .text segment so that it moves through linking unaltered. If we
took the obvious path and built our own offset table then it would need
to contain absolute addresses, but they are only available at runtime
and .text segments aren't supposed to be run-time patched. (That's why
.rela.dyn is a separate segment.) If we use a different segment then
we have the same problem as with the original offset table: the offset
to the segment is unknown when compiling the module.

Trying to pattern match this two-step lookup to do extensive rewriting
seems fragile: I'm sure the compilers will move things around and
interleave other work in time, if they don't already.

So, in order to handle movabs trying to load _GLOBAL_OFFSET_TABLE_ we
define a symbol in the same segment, but outside of the hashed region of
the module, that contains the offset from that position to
_GLOBAL_OFFSET_TABLE_:

.boringssl_got_delta:
    .quad _GLOBAL_OFFSET_TABLE_-.boringssl_got_delta

Then a movabs of $_GLOBAL_OFFSET_TABLE_-.Lfoo turns into:

movq .boringssl_got_delta(%rip), %destreg
addq $.boringssl_got_delta-.Lfoo, %destreg

This works because it's calculating
_GLOBAL_OFFSET_TABLE_ - got_delta + (got_delta - .Lfoo)

When that value is added to .Lfoo, as the original code will do, the
correct address results. Also it doesn't need an extra register because
we know that 32-bit offsets are sufficient for offsets within the
module.

As for the offsets within the offset table, we have to load them from
locations outside of the hashed part of the module to get the
relocations out of the way. Again, no extra registers are needed.

Change-Id: I87b19a2f8886bd9f7ac538fd55754e526bcf3097
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42324
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-08-10 23:46:33 +00:00
Nick Harper 74161f485b Enforce presence of ALPN when QUIC is in use. 
Update-Note: If an SSL_QUIC_METHOD is set, connections will now fail if
ALPN is not negotiated. This new behavior can be detected by checking
if the value of BORINGSSL_API_VERSION is greater than 10.

Bug: 294
Change-Id: I42fb80aa09268e77cec4a51e49cdad79bd72fa58
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42304
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-07-30 16:41:06 +00:00
David Benjamin 7d3a24d9db Fix the naming of alert error codes. 
Reason codes 1000+N correspond to receiving an alert N from the peer,
rather than observing the corresponding error condition locally. This
has generally been a source of confusion for folks.

They were originally named like SSL_R_TLSV1_ALERT_DECRYPTION_FAILED, but
OpenSSL introduced a few without the "ALERT" token in
739a543ea863682f157e9aa0ee382367eb3d187c.

We then inadvertently carried the mistake over in
SSL_R_TLSV1_UNKNOWN_PSK_IDENTITY and SSL_R_TLSV1_CERTIFICATE_REQUIRED.
Fix all these to include the "ALERT" for consistency and make it
slightly less confusing. (Although perhaps it should have been
RECEIVED_ALERT or so.) Add compatibility #defines for the original
OpenSSL ones and SSL_R_TLSV1_CERTIFICATE_REQUIRED. The latter can be
removed when downstream code is fixed. The OpenSSL ones we'll probably
just leave around.

Update-Note: The renamed alerts will log slightly different strings, but
the constants used by external code are still there.

Bug: 366
Change-Id: I30c299c4ad4b2bed695bd71d0831fbe6755975a7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42384
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-07-29 21:19:25 +00:00
David Benjamin 70fee17204 Use golang.org/x/crypto in runner. 
The CI should be set up to retain the Go module and build caches, so
we'll avoid downloading it multiple times. This avoids having to
replicate some code.

Update-Note: The tests now have a golang.org/x/crypto dependency. This
should be fetched transparently with Go modules. Monorepos with
different import path conventions may need to rewrite these imports.

Change-Id: If5ba52e051f180536d72109c2e690bbd13d58e7c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42044
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-07-29 19:27:59 +00:00
Nick Harper 281a8f5ea3 Disable ClientHello padding for QUIC. 
Bug: 327
Change-Id: I415deee8e6b2dc4cd5bdfb5e329d889dd3a5baa7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42364
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-07-28 18:16:41 +00:00
David Benjamin db129f3f3f Add X509_SIG_get0 and X509_SIG_getm. 
Change-Id: I1bef3ea54f871003f7e4a076c5cfb0dbb7f89f73
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42344
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-28 15:36:02 +00:00
Daniel McArdle 8b601c88fb Implement HPKE. 
draft-ietf-tls-esni-07 uses HPKE for encryption.

Bug: 275
Change-Id: I4af39be4df534f8c1c991c4df82d38c6adcf2574
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41304
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-07-27 20:08:35 +00:00
Nick Harper cac93924ab Disallow TLS 1.3 compatibility mode in QUIC. 
Bug: 335
Change-Id: I3caa780284d4a3e646414d1fd85cc2528ebeceff
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41264
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-07-27 18:51:35 +00:00
David Benjamin 54858b63c1 Switch clang-format IncludeBlocks to Preserve. 
clang-format now reorders includes. It used to simply sort within
blocks, but later it added a "regroup" option. The regroup option is a
bit aggressive and does not take into account our project headers being
referenced in <system/header.h> style. (It also won't be able to
recognize the header corresponding to the source file, but perhaps we
should drop that rule.)

For now, just revert it to Preserve.

Change-Id: Ief82b5c3f91c16a8def14f91ef6bf6cde502bb79
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42265
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-23 21:55:26 +00:00
David Benjamin d054e1bc61 Fix unterminated clang-format off. 
We should probably ponder what to do about clang-format. That we
disagree on chains of && is a little annoying, but peppering the code
with clang-format off seems problematic.

Change-Id: I0547e4e41817e8c0b585d5fabe759ef25ed00cf7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42264
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-23 20:52:15 +00:00
Daniel McArdle 1a63507c41 Add line number to doc.go error messages. 
Change-Id: I00f35648a6d354abdc908314fef48b3fa573d825
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42224
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-07-20 17:33:03 +00:00
Adam Langley f0558c359c Kick the bots. 
This should make them update and generate JSON outputs due to
8c0a6ebfc2.

Change-Id: I7e2fa7ace2ed0216fee6b553c4cf7e16a7d7457d
 2020-07-16 14:14:15 -07:00
David Benjamin 8c0a6ebfc2 Add a JSON output to generate_build_files.py. 
gRPC are currently importing generate_build_files.py, injecting a
custom printer, and running into problems with the symlinks they set up
to make this work, as well as needing to delete duplicate generated
files.
https://github.com/grpc/grpc/blob/53a5ad34c0b5fca2cc9fd9ec4b354ff79c12948b/src/boringssl/gen_build_yaml.py#L130
https://boringssl-review.googlesource.com/c/boringssl/+/42164

Rather than layer on more hacks, add a JSON output to
generate_build_files.py. This outputs a sources.json file that folks
with especially custom builds can consume. (Looks like gRPC converts to
some home-grown YAML format which I imagine is further processed by some
other generator?) We can then add it to master-with-bazel's output.

Change-Id: I82b4ea0647386ca6c76a977f057b9962f40d41c8
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42204
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-16 19:32:10 +00:00
Adam Langley 83b74c6a7a Add details of 20190808 FIPS certification. 
Change-Id: I4d17e1e6f24b623ee39a844def8f265eb5e6c6cc
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42144
Commit-Queue: Adam Langley <alangley@gmail.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-07-13 16:59:37 +00:00
David Benjamin 8f88b27d6a Link to ws2_32 more consistently. 
This fixes a couple issues:

- Which libraries to use should be based on WIN32, not MSVC.

- Windows libraries can be specified by #pragma comment lines in the
  source or by build dependencies. We specified #pragma lines in
  source, but also have build dependencies in crypto_test, etc. The
  latter was missing bssl.

  The comment line should be sufficient, but being explicit is useful,
  so fill in the missing one. This should help building with MINGW,
  which is missing support for the usual Windows pragma.

Change-Id: Ide9328c7dd306738ebbb0792e47da96948fe12f4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42105
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-09 23:43:52 +00:00
David Benjamin de196121b0 Allow explicitly-encoded X.509v1 versions for now. 
Sadly, we need to roll this one back for now, at least until we've
cleared all the test failures it causes. This retains the other checks
in https://boringssl-review.googlesource.com/c/boringssl/+/41746. We're
only rolling back enforcement of the DEFAULT v1 encoding.

Bug: 348, 364
Change-Id: I6a290311f5a5714ff4d5add3ae35ec4550398b32
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42104
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-09 16:28:02 +00:00
David Benjamin eda849d2e6 Opaquify PKCS8_PRIV_KEY_INFO. 
This is partially imported from upstream's
54dbf42398e23349b59f258a3dd60387bbc5ba13 which does something similar.

In doing so, remove the pkcs8->broken field, which is a remnant of some
parsing hacks we long since removed (PKCS8_set_broken). The immediate
motivation is, if this sticks, this would make it easier to detach
i2d_PKCS8_PRIV_KEY_INFO and d2i_PKCS8_PRIV_KEY_INFO from the old ASN.1
code.

Update-Note: Direct accesses of PKCS8_PRIV_KEY_INFO now need to use the
accessors. Code search suggests no one uses the fields. Even the
accessors are virtually unused (the one thing which uses it doesn't need
it).

Bug: chromium:1102458
Change-Id: I57054de3fe412079f7387dc99291250e873b1471
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42006
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-08 16:09:11 +00:00
David Benjamin 5d7c2f8b1d Implement i2d_PUBKEY and friends without crypto/asn1. 
Code which targets OpenSSL won't use EVP_parse_public_key. X509_PUBKEY
is fairly deeply tied to the old ASN.1 stack, but there's no reason for
i2d_PUBKEY and friends to be. Move them to crypto/evp and reimplement as
wrappers over our functions.

Bug: chromium:1102458
Change-Id: Ic11766acdac797602e4abe1253b0efe33faef298
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42005
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-08 15:48:18 +00:00
Steven Valdez d0637e901d Remove TRUST_TOKEN_experiment_v0. 
Update-Note: This gets rid of TRUST_TOKEN_experiment_v0. Existing callers
should be updated to call TRUST_TOKEN_experiment_v1.

Change-Id: I8ec9b808cbd35546425690d1548db671ff033e14
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41524
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
 2020-07-07 16:26:59 +00:00
David Benjamin b9fbf4069e Clarify in-place rules for low-level AES mode functions. 
Change-Id: I9dde27f4a6b492d5a3f49041c8cdcac642c58335
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42004
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-07-06 18:20:21 +00:00
Adam Langley fb0c05cac2 acvp: add CMAC-AES support. 
Change by Dan Janni.

Change-Id: I3f059e7b1a822c6f97128ca92a693499a3f7fa8f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41984
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-07-02 20:51:31 +00:00
Adam Langley c655065273 acvp: add SP800-108 KDF support. 
Based on a change from Dan Janni.

Change-Id: Ibe00e61cb43819ecad7c1376f8c013aca3667037
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41964
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-07-02 20:29:41 +00:00
David Benjamin 25638f06e3 Remove x509->name. 
Every X509 object, when parsed, would pretty-print the subject and stash
the result in x509->name. This field was removed in upstream OpenSSL and
all uses I found have now been fixed. Remove this to reduce unnecessary
work in the X.509 parser.

Update-Note: instead of x509->name, use X509_NAME_oneline and
X509_get_subject_name.

Change-Id: I1d1e69bed7429d59125a8bdea5cbba391cd1028c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41904
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-07-02 20:19:01 +00:00
Adam Langley 939d426f6b Maybe build for AArch64 Windows. 
Microsoft lists[1] this define to indicate AArch64, support for which is
requested on https://github.com/grpc/grpc/issues/23310.

More might well be needed, especially if the assembly code is to work,
but maybe this'll work for gRPC.

[1] https://docs.microsoft.com/en-us/cpp/preprocessor/predefined-macros?view=vs-2019

Change-Id: Id66d1c8ab7ab161f73c993dd4901e2252198bda8
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41945
Reviewed-by: Adam Langley <alangley@gmail.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-07-02 20:06:21 +00:00
Adam Langley e2abade424 sha1-x86_64: fix CFI. 
This issue only arises when SHAEXT is enabled, which it isn't (yet).
Will upstream too.

Change-Id: I92de51789d58ba1784b88eb872b1f9eca8eb78d8
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41944
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-06-30 16:48:54 +00:00
Brian Smith 5d74463301 Use |crypto_word_t| and |size_t| more consistently in ECC scalar recoding. 
Use |crypto_word_t| as the type for secret values in scalar recoding.
Use |size_t| as the type of array indexes in scalar recoding. Use
explicit casts where a larger type is (losslessly) truncated to a
smaller type. With this change, |uint64_t| is no longer used in the
p256.c when building in 32-bit mode, |unsigned| is not used in any of
the affected modules, and |uint8_t| and |char| are no longer used for
secret values in the ECC recoding.

When given the choice of doing non-array-indexing arithmetic (e.g. shifts)
on |size_t| values or |crypto_word_t| values, prefer doing it on
|crypto_word_t| values. More generally, try to use |size_t| only for
sizes and array indexes.

This is part of a bigger project to minimize the use of types other than
|crypto_word_t| for secret values. This is also part of a larger project
make the ECC code more consistent.

Avoid changing the loop indexing in the P-256 scalar multiplication from
|int| to |size_t|. The P-224 code does use |size_t| but it is less clear
than the P-256 code where |i - 1| results in a negative/underflowed
value when |i| is zero.

Change-Id: I78cb404455c2340a4f8c9688d36c0d425bfcc50b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41685
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-30 15:04:06 +00:00
Ilya Tokar 7361ee42cf Enable shaext path for sha1. 
This makes sha1 ~2x faster on Amd Rome:

BM_SHA1Hash/2               10.9MB/s ± 1%           14.0MB/s ± 1%  +28.77%        (p=0.000 n=10+10)
BM_SHA1Hash/4               21.9MB/s ± 1%           28.2MB/s ± 1%  +28.56%        (p=0.000 n=10+10)
BM_SHA1Hash/8               43.9MB/s ± 1%           56.3MB/s ± 2%  +28.36%        (p=0.000 n=10+10)
BM_SHA1Hash/16              88.1MB/s ± 1%          114.8MB/s ± 2%  +30.40%         (p=0.000 n=9+10)
BM_SHA1Hash/32               178MB/s ± 1%            229MB/s ± 2%  +28.64%        (p=0.000 n=10+10)
BM_SHA1Hash/64               240MB/s ± 1%            363MB/s ± 2%  +51.57%        (p=0.000 n=10+10)
BM_SHA1Hash/512              629MB/s ± 1%           1129MB/s ± 2%  +79.54%         (p=0.000 n=9+10)
BM_SHA1Hash/4k               794MB/s ± 0%           1538MB/s ± 1%  +93.76%         (p=0.000 n=8+10)
BM_SHA1Hash/32k              820MB/s ± 1%           1610MB/s ± 2%  +96.44%        (p=0.000 n=10+10)
BM_SHA1Hash/256k             822MB/s ± 1%           1624MB/s ± 1%  +97.48%        (p=0.000 n=10+10)
BM_SHA1Hash/1M               822MB/s ± 1%           1625MB/s ± 1%  +97.63%        (p=0.000 n=10+10)
BM_SHA1Hash/2M               824MB/s ± 1%           1626MB/s ± 1%  +97.32%        (p=0.000 n=10+10)
BM_SHA1Hash/4M               826MB/s ± 1%           1631MB/s ± 0%  +97.56%         (p=0.000 n=10+8)
BM_SHA1Hash/8M               824MB/s ± 1%           1625MB/s ± 1%  +97.14%        (p=0.000 n=10+10)
BM_SHA1Hash/16M              823MB/s ± 1%           1625MB/s ± 1%  +97.40%        (p=0.000 n=10+10)

Change-Id: Ic75eb717a71b35d0ca775c309e08396b2ab77641
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41884
Reviewed-by: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-30 14:58:34 +00:00
David Benjamin 5fa22ed85e Avoid relying on SSL_get_session's behavior during the handshake. 
Mid-renegotiation, there are a lot of sets of TLS parameters flying
around. We need to be clear which one we want for each operation. There
were a few parts of TLS 1.2 which were relying on SSL_get_session to
abstract between the resumption session and a new session.

Implement that separately as ssl_handshake_session, so we're free to
avoid SSL_get_session returning an incomplete session mid-renegotiation.

This doesn't fixed the linked Chromium bug, but it is necessary to do
so. (I'm trying to separate the SSL_get_session change from the
dependencies within the library.)

Update-Note: SSL_generate_key_block will now fail mid-handshake. It is
ambiguous which key block to use and, in some cases, we may not even be
able to compute the right key block.

Bug: chromium:1010748
Change-Id: I30c8a683bb506310e37adbd05a28e3b8de6e6836
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41865
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-29 16:18:30 +00:00
David Benjamin b3c5ac51d5 Add a -wait-for-debugger flag to runner. 
xterm on macOS is surprisingly difficult to get at these days. Instead,
add an option to make bssl_shim SIGSTOP itself so a debugger can resume
it.

Change-Id: Ie3cf02744557f46c8fa08c162276b5ff851a51c7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41864
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-06-29 15:41:10 +00:00
David Benjamin 86f86cbdf7 Add missing OPENSSL_EXPORT to X509_get_X509_PUBKEY. 
Thanks to Daniel Stenberg for noticing this.

Change-Id: I4e1e75d879dc8a09a9d077d710a69804b31ad7bd
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41924
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-06-29 15:19:03 +00:00
David Benjamin 430a742303 Const-correct various functions in crypto/asn1. 
The const ASN1_TIME getters don't work well because some const functions
aren't marked as such. I took a pass over the header and fixed the ones
I noticed.

Change-Id: I7eede530abc14ba0aab5763561c6f2dcf09e9659
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41824
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-06-23 17:57:25 +00:00
Pete Bentley d1d8eee76b Remove uneeded switch statement. 
Warnings for switch statements with just a default case are
now fatal with the latest Windows toolchain used by Github
workflows. So indirectly this was breaking Conscrypt's
continuous integration and possibly other projects using
BoringSSL which run CI on Windows.

Example: https://github.com/google/conscrypt/runs/793502854?check_suite_focus=true

Change-Id: Ia09b86f3292299089c6536862a170677a8024984
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41844
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-06-22 14:06:04 +00:00
David Benjamin 33f8d33af0 Convert X.509 accessor macros to proper functions. 
We'll need the accessors to be functions if we ever make X509 opaque.
Functions are also type-checked and avoid confusing code search's cross
reference features.

Update-Note: This should be compatible, but it is possible that someone,
e.g., passed in a bssl::UniquePtr<X509> to an accessor and relied on
operator->. Callers may also run afoul of const correctness. I mirrored
OpenSSL 1.1.1's consts, so it should at least be compatible with
third-party code.

Change-Id: I65dadc4e9ac0042576dc4db0f194d2e6b786ccca
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41808
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-19 22:28:52 +00:00
David Benjamin d206a11d48 Remove X509_CINF_get_issuer and X509_CINF_get_extensions. 
The X509_CINF_* macros were removed before OpenSSL 1.0.2 was released
but after we forked. X509_CINF_set_modified and X509_CINF_get_signature
have some users to clean up, but these two are unused.

(OpenSSL 1.1.x's new X.509 API effectively no longer exposes X509_CINF
at all. If we could align, that would simplify switching to retaining
the full encoding rather than just TBSCertificate. But I think we'll
need to add some functions to replace a few use cases they missed.)

Update-Note: Two unused macros were removed. If there were uses, the
X509-level accessors can be used instead.

Change-Id: I9b5c7c08196885ee0bccc2658b1ad177bf3100e7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41807
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-19 22:13:52 +00:00
David Benjamin beaf594f8b Remove X509_get_signature_type. 
This macro dates to SSLeay. It is never used and for good reason: it
doesn't do anything. EVP_PKEY_type returns NID_undef if the NID is not
key type, but it is being passed in a signature algorithm type. This
means that, except for invalid certificates, or the rare algorithms
where the two OIDs match (Ed25519), it always returns NID_undef.

Update-Note: If there are any calls to X509_get_signature_type, remove
them. It more-or-less always returned NID_undef.

Change-Id: I6e2e41f171143c28f2afce2890f029b776cc36b5
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41806
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-19 21:46:02 +00:00
David Benjamin 991d31bbf1 clang-format x509.h and run comment converter. 
We never updated it to OpenSSL's new indentation style and it's already
pretty difficult to directly apply patches from upstream anyway.

Change-Id: I78f7f644c6d427f27c29f51c4e8ba54476ddeb2b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41805
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-19 21:35:42 +00:00
David Benjamin 9dd9d4fc24 Check AlgorithmIdentifier parameters for RSA and ECDSA signatures. 
This aligns with the Chromium certificate verifier, which allows NULL or
empty for RSA and requires empty for ECDSA.

Bug: 342
Change-Id: I34acf68f63b4d133dd47b73144b2f27224c499ee
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41804
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-19 21:30:22 +00:00
David Benjamin a3cc7780e7 Remove some unimplemented prototypes. 
We don't have the corresponding functions anyway.

Change-Id: I9771771f011da295db708ed8bc635b4748d0101b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41784
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-06-19 18:26:12 +00:00
David Benjamin dd86e75b24 Check the X.509 version when parsing. 
This checks the X.509 version is valid and consistent with fields new to
those versions. These checks are also implemented by Chromium's
certificate verifier and should be compatible.

Update-Note: The X.509 parser is now a bit stricter. This may break some
malformed certificates which were previously incorrectly accepted.

Bug: 348, 351
Change-Id: I56f35d768d5e72948d22a9546fba3d257a75f409
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41746
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-19 18:16:11 +00:00
David Benjamin fd86eaa868 Fix x509v3_cache_extensions error-handling. 
This imports https://github.com/openssl/openssl/pull/10756 from upstream
with a number of changes:

- Add tests.

- Rather than blindly return false in cert_self_signed, make that
  function a tri-state return. This gives better error-reporting when the
  leaf certificate has a bad extension and reduces the risk of confusing
  the verifier.

- Give x509v3_cache_extensions a return value rather than expecting
  everyone to check EXFLAG_INVALID. Switch X509_check_purpose calls to
  it when applicable.

- Rather than setting EXFLAG_INVALID on bad CRLs, fail the parse
  altogether. We're already in the d2i callback. (Nothing checks
  EXFLAG_INVALID on CRLs.)

- I've intentionally left the error unchecked in X509_cmp. OpenSSL's
  strategy is to return -2, but that's not a consistent comparison
  and may mess up sorts that depend on transitivity. This retains the
  current behavior where we consider all undigestable certs as equal
  to each other (modulo the opportunistic TBSCertificate double-check
  which should work most of the time). This is terrible, so I've filed
  https://crbug.com/boringssl/355 to track fixes here.

That last fix caught that I misread the spec when I generated
kKnownCriticalCRL and kUnknownCriticalCRL2. This fixes those and uses
the old kKnownCriticalCRL as a test for invalid extensions. (Those CRLs
were assembled by hand, so they don't indicate any software has been
encoding them wrong.)

Update-Note: The X.509 verifier now correctly rejects syntax errors in
important certificate extensions. This may break some malformed
certificates which were incorrectly accepted before.

Bug: 345
Change-Id: Ifb3a98ba62cd296920546bc718fda524bd55c024
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41745
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-19 16:55:51 +00:00
David Benjamin cbac9c3a2d Work around Windows command-line limits in embed_test_data.go. 
Change-Id: I020f7c75d2ed160b16a62cb909d2113c318feb3c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41764
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-18 22:48:41 +00:00
David Benjamin 5ddc5b14d9 Move crypto/x509 test data into its own directory. 
I'm about to add a lot more of these.

Change-Id: I2556e301dbed3ceb450e7070ffed46dc4d6de2b4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41744
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-18 22:39:51 +00:00
David Benjamin 1b8194715e Test resumability of same, different, and default ticket keys. 
If we were to accidentally leave the ticket keys zero-initialized, the
only tests that notice are DefaultTicketKeyInitialization (initial key
is not all zeros) and DefaultTicketKeyRotation (old key is not new key),
by way of querying the keys themselves.

Add some tests which additionally test the effects on resumption itself.

Change-Id: I3bfd3f1e082e3a466105dbdffa18621b81c53d17
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41564
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-06-18 22:09:51 +00:00
Jesko Jochum c179854243 Fixes warning when redefining PATH_MAX when building with MINGW. 
Fixes warning thrown when compiling digest.cc with MinGW64, by only defining PATH_MAX, if it has not yet been defined.
Else building with MinGW64, throws the following warning:

<PATH_TO_SOURCE_FOLDER>\boringssl\src\tool\digest.cc:39: warning: "PATH_MAX" redefined
   39 | #define PATH_MAX MAX_PATH
      |
In file included from C:/msys64/mingw64/lib/gcc/x86_64-w64-mingw32/9.3.0/include-fixed/limits.h:194,
                 from C:/msys64/mingw64/lib/gcc/x86_64-w64-mingw32/9.3.0/include-fixed/syslimits.h:7,
                 from C:/msys64/mingw64/lib/gcc/x86_64-w64-mingw32/9.3.0/include-fixed/limits.h:34,
                 from C:/msys64/mingw64/x86_64-w64-mingw32/include/pthread.h:67,
                 from C:/msys64/mingw64/include/c++/9.3.0/x86_64-w64-mingw32/bits/gthr-default.h:35,
                 from C:/msys64/mingw64/include/c++/9.3.0/x86_64-w64-mingw32/bits/gthr.h:148,
                 from C:/msys64/mingw64/include/c++/9.3.0/ext/atomicity.h:35,
                 from C:/msys64/mingw64/include/c++/9.3.0/memory:73,
                 from <PATH_TO_SOURCE_FOLDER>/boringssl/src/include/openssl/base.h:473,
                 from <PATH_TO_SOURCE_FOLDER>\boringssl\src\tool\digest.cc:15:
C:/msys64/mingw64/x86_64-w64-mingw32/include/limits.h:20: note: this is the location of the previous definition
   20 | #define PATH_MAX 260
      |

Change-Id: I29eb33ee8fad9e4e80d9348a0d5e4057dfac620c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41705
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-17 17:22:18 +00:00
David Benjamin 8afdbf04bd Abstract fd operations better in tool. 
Windows and POSIX implement very similar fd operations, but differ
slightly:

- ssize_t in POSIX is usually int on Windows.
- POSIX needs EINTR retry loops.
- Windows wants _open rather than open, etc.
- POSIX fds and sockets are the same thing, while Windows sockets are
  HANDLEs and leaves fd as a C runtime construct.

Rather than ad-hoc macros and redefinitions of ssize_t (which reportedly
upset MINGW), add some actual abstractions. While I'm here, add a scoped
file descriptor type.

That still leaves recv/send which are only used in one file, so defined
a socket_result_t for them.

Change-Id: I17fca2a50c77191f573852bfd27553996e3e9c3f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41725
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-06-16 20:48:22 +00:00
David Benjamin 884614c24f Use CMAKE_SIZEOF_VOID_P instead of CMAKE_CL_64 
CMake's documentation says this is preferred.
https://cmake.org/cmake/help/latest/variable/CMAKE_CL_64.html

Reportedly, it also works better with MINGW, though we do not currently
support MINGW with the CMake build. See
https://boringssl-review.googlesource.com/c/boringssl/+/41704/

Change-Id: Ie5794306beeeff816b34ee98c7a0f8e0d4f99ec8
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41724
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-16 15:20:28 +00:00
David Benjamin cd8f3d36fe Enforce the keyUsage extension in TLS 1.2 client certs. 
I've left this independent of SSL_set_enforce_rsa_key_usage because
client certificates in TLS always use the digitalSignature bit, RSA or
otherwise, so it's less likely that someone has messed it up, unlike
TLS 1.2 RSA server certificates.

Update-Note: Client certificates which do not support the
digitalSignature key usage will be rejected. They should either include
that bit or omit the keyUsage extension.

Bug: 349
Change-Id: I97bbf0c8e394f219ff75b686e0c14019f6d8c9a8
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41664
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-06-15 16:34:03 +00:00
David Benjamin 72b095d0d4 Reword some comments. 
There were a handful of comments that use "blacklist" and "whitelist".
They are easy to fix.

Change-Id: I49a9592393b43fc85e92b4a00a585b504dede75a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41645
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-12 21:17:03 +00:00
Adam Langley 7f90eda55e Add “Z Computation” KAT. 
FIPS updates will make this useful / mandatory in the future.

Change-Id: I9921e4f3fc8a8315dc85dc366f331b456572d49e
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41644
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-06-12 19:01:37 +00:00
Adam Langley 9c256d1d7f acvptool: handle negative sizeConstraint. 
The NIST server has been updated and is now sending a sizeConstraint of
-1 to indicate that the large-upload process isn't needed. However, the
code was trying to put that in a uint64, which caused a parse error.

Change-Id: I9ee16918df13c229b0e889fa1248eb2e0a6a5fb2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41605
Reviewed-by: David Benjamin <davidben@google.com>
 2020-06-11 20:41:51 +00:00
Adam Langley 0313b59d5f Let memory hooks override the size prefix. 
In order to efficiently track heap operations, the memory hooks may need
to store other information in the prefix area than the size that
BoringSSL uses by default. This change lets them manage the prefix how
they wish.

Change-Id: I5a4d98bed100aff2deaaabb3d23fab02f0be82aa
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41584
Reviewed-by: Adam Langley <alangley@gmail.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <alangley@gmail.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-11 18:41:45 +00:00
Adam Langley fbaf1c0546 acvptool: go fmt 
Change-Id: If90e35bf4ef75d12cdbddc118611127b74bbafe6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41604
Reviewed-by: Adam Langley <agl@google.com>
 2020-06-10 22:15:02 +00:00
David Benjamin 251b5169fd Assert md_size > 0. 
md_size is the size of a hash, so it cannot be zero. Add an assert since
it appears to have caused some confusion. The j >= md_size and
j -= md_size logic implicitly assumes md_size > 0. (It's another way to
stick a % md_size elsewhere which, likewise, assumes md_size > 0.)

The bug report itself is a false positive, but locally documenting
assumptions is good.

Bug: chromium:1092697
Change-Id: I3be0992552a300c6786cf1dc5ecfa881173a42e6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41544
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-06-09 17:08:35 +00:00
Adam Langley 88024df121 Remove -enable-ed25519 compat hack. 
Change-Id: I2d5843b2dc957f8ae8e4d9a41cecd3268220cc1d
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41504
Commit-Queue: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-06-02 15:46:08 +00:00
Adam Langley 53a17f5524 Add a |SSL_process_tls13_new_session_ticket|. 
This API processes a given NewSessionTicket message and returns a resumable
|SSL_SESSION| object that contains the ticket.

(Change by Cesar Ghali.)

Change-Id: I7426933b043865ca54d3cf597f7ecd54d493bf35
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41464
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-05-28 19:39:26 +00:00
David Benjamin 2309f645e5 Use ctr32 optimizations for AES_ctr128_encrypt. 
There are a decent number of uses of this function directly. I've
attached this to bug 338. Arguably it makes it worse, though it does
help with aligning on ctr32, if that works out.

Bug: 338
Change-Id: I3dfc1305d359ec0c88d4f298fe1928bef7ec9877
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41426
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-05-26 19:04:16 +00:00
David Benjamin 8819e0be62 Test AES mode wrappers. 
AES_ctr128_encrypt, in particular, has a decent number of external
callers but is completely untested. I haven't included
AES_cfb128_encrypt because its EVP_CIPHER counterpart is tested in
decrept_test. But the EVP_CIPHER counterpart simply calls
AES_cfb128_encrypt, so it's tested transitively.

Change-Id: I0133dbd5b13c2b4045a89a04f29240008a279186
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41425
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-05-26 18:03:03 +00:00
David Benjamin 81a998a637 Bump minimum CMake version. 
CMake 3.2.1 was released in March 2015, which was over five years ago.

Change-Id: I8b76e1de3dba8732a143f86a3956c83fbb4306a7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41444
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-26 16:37:04 +00:00
Nick Harper 851943277f Modify how QUIC 0-RTT go/no-go decision is made. 
The previous implementation was too strict in its byte-for-byte equality
check including Transport Parameters, because the Transport Parameters
contain a field that QUIC requires be different on each connection. This
change still has BoringSSL do a byte-for-byte check, but now it is only
done over the quic_early_data_context. An additional requirement is
imposed that the quic_early_data_context must be set for early data
capable tickets to be issued.

Bug: 295
Change-Id: I5145c10752b41908b6807c3a3c967653b0c13f37
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41427
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-26 16:31:02 +00:00
David Benjamin 9701e84eff Remove RAND_set_urandom_fd. 
Also update the documentation for RAND_enable_fork_unsafe_buffering. The
fd parameter is no longer used.

Update-Note: RAND_set_urandom_fd no longer exists. This was only called
by Chromium, which now uses CRYPTO_pre_sandbox_init.

Change-Id: I1659c1cc84a6f1edc01f6105fc07e80856e457fc
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41424
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-20 18:55:59 +00:00
David Benjamin 7b31d69f19 Document that getrandom support must be consistent. 
Syscall-filtering sandboxes may make getrandom fail without crashing.
This will sometimes trigger the /dev/urandom fallback and sometimes not.

Change-Id: Ic824e5bfe6fcb99105fd285184243c4620447327
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41404
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-05-20 18:55:29 +00:00
Anna Sarai Rosenberg 8f12996be3 Fix docs link for SSL_CTX_load_verify_locations 
Link is outdated; results in 404. Update link to match docs version in other links with redirected path to current link for that version.

Change-Id: I4c9bb2fe48d1b2bbf699773259d5eebad9461ddd
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41385
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-18 17:00:25 +00:00
Steven Valdez 78b3337a10 Fix TRUST_TOKEN experiment_v1 SRR map. 
Change-Id: I9e5c9b016cc0b3b7926df850d470e6367eb9c0bc
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41364
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-14 19:21:22 +00:00
David Benjamin 3e4dfbb2f8 Add CRYPTO_pre_sandbox_init. 
The intent is to replace the logic in [0] and allows Chromium to set up
the MADV_WIPEONFORK page without increasing sandbox syscall surface.
From there we can remove RAND_set_urandom_fd and trim a bit of
complexity from the PRNG logic.

[0] https://source.chromium.org/chromium/chromium/src/+/master:content/app/content_main_runner_impl.cc;l=333-341;drc=975850fa57e140ec696114477e9416a19f06d29f

Change-Id: I9b679e15da551a10302389556c6c77d192be662a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41326
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-05-14 18:17:12 +00:00
David Benjamin 9cf9d3eb06 Still query getauxval if reading /proc/cpuinfo fails. 
If BoringSSL is used in a sandbox without /proc/cpuinfo, we will
silently act as if the CPU is missing capabilities, even though
getauxval may be available. We use /proc/cpuinfo to work around a
missing AT_HWCAP2 and ignore a particular broken CPU.

Ignoring the former fails closed, so it's safe to proceed. The latter
fails closed, but it is now vanishingly rare (even missing AT_HWCAP2 has
largely dropped off), so instead proceed with getauxval. This makes the
/proc paths largely optional.

Change-Id: Ib198c4f78ccdae874d55669b6a7508dfbeac0f44
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41325
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-05-14 17:33:22 +00:00
Nick Harper be28dd623f Add missing header to ec/wnaf.c 
a810d82 added calls to OPENSSL_malloc in this file, but openssl/mem.h
was missing.

Change-Id: I77e19e61e92b1e73702cb3eb93b9c6e22aca9596
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41344
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-14 00:09:11 +00:00
David Benjamin b7acfff8e7 Fix OPENSSL_TSAN typo. 
We weren't actually reducing MAX_BLINDINGS_PER_RSA under TSan.

Change-Id: Ib33dc1a1c0312bd3309a64f2600ec4d6e2ec9ddb
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41324
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-13 17:00:31 +00:00
David Benjamin 49e95dc0f3 Fix p256-x86_64-table.h indentation. 
This makes clang-format a no-op. (I would not recommend running
clang-format on that file. It takes a while.)

Change-Id: Ie4bd93340be8fe586e774ce16b5aed1ab626bb0c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41165
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-12 19:40:02 +00:00
Ilya Tokar 1274d1d977 Enable avx2 implementation of sha1. 
Before:
Did 19655000 SHA-1 (16 bytes) operations in 2000053us (157.2 MB/sec)
Did 5112000 SHA-1 (256 bytes) operations in 2000126us (654.3 MB/sec)
Did 1280000 SHA-1 (1350 bytes) operations in 2000559us (863.8 MB/sec)
Did 229000 SHA-1 (8192 bytes) operations in 2004784us (935.7 MB/sec)
Did 116000 SHA-1 (16384 bytes) operations in 2008224us (946.4 MB/sec)

After:
Did 20506000 SHA-1 (16 bytes) operations in 2000062us (164.0 MB/sec) [+4.3%]
Did 5659000 SHA-1 (256 bytes) operations in 2000100us (724.3 MB/sec) [+10.7%]
Did 1454000 SHA-1 (1350 bytes) operations in 2000739us (981.1 MB/sec) [+13.6%]
Did 255000 SHA-1 (8192 bytes) operations in 2000733us (1044.1 MB/sec) [+11.6%]
Did 129000 SHA-1 (16384 bytes) operations in 2009483us (1051.8 MB/sec) [+11.1%]

Change-Id: Idaf75e92b2da4d83b597771aca1123f2884d7687
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41284
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-12 19:32:02 +00:00
David Benjamin d4d501c159 Trim Z coordinates from the OPENSSL_SMALL P-256 tables. 
The small P-256 tables currently store 2 * 16 points in Jacobian
coordinates, but all the Z values are one, except for the two entries
which store infinity. Instead, store only affine coordinates and omit
the infinity entries. (We can recover infinity with constant-time
selects.)

This trims 1152 bytes from the table. Comparing the sizes of the bssl
tool (stripped, otherwise debug symbols undo the size gain), the binary
is 4096 bytes smaller, but I suspect this is just an artifact of
something rounding to page sizes.

Along the way, I've scripted the table generation and merged it into a
much generalized version of make_p256-x86_64-table.go.

As a bonus, by cutting the size of the table we scan, it's faster!
(ECDSA verify was already not scanning a table, so that one staying the
same is expected.)

Before:
Did 22302 ECDH P-256 operations in 4009795us (5561.9 ops/sec)
Did 62000 ECDSA P-256 signing operations in 4020075us (15422.6 ops/sec)
Did 26544 ECDSA P-256 verify operations in 4056526us (6543.5 ops/sec)

After:
Did 23001 ECDH P-256 operations in 4016544us (5726.6 ops/sec) [+3.0%]
Did 66000 ECDSA P-256 signing operations in 4043083us (16324.2 ops/sec) [+5.8%]
Did 26544 ECDSA P-256 verify operations in 4051220us (6552.1 ops/sec) [+0.1%]

Change-Id: Ie88898fd56e57505e3a325c50bbaf0dc5d42eeb3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41164
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-12 19:24:22 +00:00
David Benjamin a810d82575 Use public multi-scalar mults in Trust Tokens where applicable. 
The input points are all public, so we can use a faster multi-scalar
multiplication. This generalizes ec_point_mul_scalar_public to
ec_point_mul_scalar_public_batch. To support the batched DLEQ
construction, this function takes an arbirarily-length array of points
and allocates some temporaries if necessary.

First, to confirm that this doesn't affect the basic ECDSA verify case:
Before:
Did 6324 ECDSA P-384 verify operations in 3069342us (2060.4 ops/sec)
After:
Did 6324 ECDSA P-384 verify operations in 3063355us (2064.4 ops/sec) [+0.2%]

Results for Trust Tokens issue (Exp1) and finish_issuance (both):
Before:
Did 147 TrustToken-Exp0-Batch1 finish_issuance operations in 2059145us (71.4 ops/sec)
Did 14 TrustToken-Exp0-Batch10 finish_issuance operations in 2085888us (6.7 ops/sec)
Did 357 TrustToken-Exp1-Batch1 issue operations in 2068238us (172.6 ops/sec)
Did 286 TrustToken-Exp1-Batch1 finish_issuance operations in 2090932us (136.8 ops/sec)
Did 63 TrustToken-Exp1-Batch10 issue operations in 2068201us (30.5 ops/sec)
Did 56 TrustToken-Exp1-Batch10 finish_issuance operations in 2064796us (27.1 ops/sec)

After:
Did 168 TrustToken-Exp0-Batch1 finish_issuance operations in 2058891us (81.6 ops/sec) [+14.3%]
Did 16 TrustToken-Exp0-Batch10 finish_issuance operations in 2075742us (7.7 ops/sec) [+14.8%]
Did 378 TrustToken-Exp1-Batch1 issue operations in 2067956us (182.8 ops/sec) [+5.9%]
Did 336 TrustToken-Exp1-Batch1 finish_issuance operations in 2097757us (160.2 ops/sec) [+17.1%]
Did 105 TrustToken-Exp1-Batch10 issue operations in 2069934us (50.7 ops/sec) [+66.5%]
Did 88 TrustToken-Exp1-Batch10 finish_issuance operations in 2014621us (43.7 ops/sec) [+61.1%]

(This CL doesn't affect other operations.)

Change-Id: Ie643b06f44990ab52bf892a007732fde61cdffe5
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41285
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-12 17:38:55 +00:00
Steven Valdez b55a8c1580 Use batched DLEQ proofs for Trust Token. 
Before:
Did 867 TrustToken-Exp1-Batch1 generate_key operations in 1029740us (842.0 ops/sec)
Did 1441 TrustToken-Exp1-Batch1 begin_issuance operations in 1021088us (1411.2 ops/sec)
Did 200 TrustToken-Exp1-Batch1 issue operations in 1003145us (199.4 ops/sec)
Did 154 TrustToken-Exp1-Batch1 finish_issuance operations in 1053858us (146.1 ops/sec)
Did 5128000 TrustToken-Exp1-Batch1 begin_redemption operations in 1000076us (5127610.3 ops/sec)
Did 517 TrustToken-Exp1-Batch1 redeem operations in 1031054us (501.4 ops/sec)
Did 15000 TrustToken-Exp1-Batch1 finish_redemption operations in 1041906us (14396.7 ops/sec)
Did 870 TrustToken-Exp1-Batch10 generate_key operations in 1020929us (852.2 ops/sec)
Did 154 TrustToken-Exp1-Batch10 begin_issuance operations in 1085963us (141.8 ops/sec)
Did 20 TrustToken-Exp1-Batch10 issue operations in 1040995us (19.2 ops/sec)
Did 14 TrustToken-Exp1-Batch10 finish_issuance operations in 1009041us (13.9 ops/sec)
Did 5138000 TrustToken-Exp1-Batch10 begin_redemption operations in 1000114us (5137414.3 ops/sec)
Did 528 TrustToken-Exp1-Batch10 redeem operations in 1026978us (514.1 ops/sec)
Did 15000 TrustToken-Exp1-Batch10 finish_redemption operations in 1016920us (14750.4 ops/sec)

After:
Did 900 TrustToken-Exp1-Batch1 generate_key operations in 1032678us (871.5 ops/sec) [+3.5%]
Did 1410 TrustToken-Exp1-Batch1 begin_issuance operations in 1004439us (1403.8 ops/sec) [-0.5%]
Did 154 TrustToken-Exp1-Batch1 issue operations in 1068370us (144.1 ops/sec) [-27.7%]
Did 121 TrustToken-Exp1-Batch1 finish_issuance operations in 1048767us (115.4 ops/sec) [-21.0%]
Did 5179000 TrustToken-Exp1-Batch1 begin_redemption operations in 1000159us (5178176.7 ops/sec) [+1.0%]
Did 572 TrustToken-Exp1-Batch1 redeem operations in 1093354us (523.2 ops/sec) [+4.3%]
Did 15000 TrustToken-Exp1-Batch1 finish_redemption operations in 1001506us (14977.4 ops/sec) [+4.0%]
Did 913 TrustToken-Exp1-Batch10 generate_key operations in 1027546us (888.5 ops/sec) [+4.3%]
Did 154 TrustToken-Exp1-Batch10 begin_issuance operations in 1051530us (146.5 ops/sec) [+3.3%]
Did 26 TrustToken-Exp1-Batch10 issue operations in 1027599us (25.3 ops/sec) [+31.7%]
Did 24 TrustToken-Exp1-Batch10 finish_issuance operations in 1055615us (22.7 ops/sec) [+63.9%]
Did 5100000 TrustToken-Exp1-Batch10 begin_redemption operations in 1000201us (5098975.1 ops/sec) [-0.7%]
Did 561 TrustToken-Exp1-Batch10 redeem operations in 1072683us (523.0 ops/sec) [+1.7%]
Did 15000 TrustToken-Exp1-Batch10 finish_redemption operations in 1006697us (14900.2 ops/sec) [+1.0%]

Change-Id: Ibdc08f9d63e62dda14a2cd9e9d8be27c8723675b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40865
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-05-12 17:09:54 +00:00
Nick Harper 7c522995d1 Restrict when 0-RTT will be accepted in QUIC. 
QUIC imposes additional restrictions on when 0-RTT data can be accepted.
With this change, a QUIC server configured to support 0-RTT will only
accept early data if the transport parameters and application protocol
specific context are a byte-for-byte match from the original connection
to the 0-RTT resumption attempt.

Bug: 295
Change-Id: Ie5d4688d1c9076b49f2131bb66b27c87e2ba041a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41145
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-05-08 15:08:00 +00:00
Nick Harper e32549edf9 Disable TLS 1.3 compatibility mode for QUIC. 
Bug: 335
Change-Id: Ic22dafbc4ada3af56260bc7213f0078876e56c3d
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41244
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-07 23:25:51 +00:00
David Benjamin d4a97fa65f Use a 5-bit comb for some Trust Tokens multiplications. 
Several of the Trust Tokens multiplications use repeated points (G, H,
and the public keys). We can precompute a 5-bit comb for those points
and perform only 1/5th as many doubles in the multiplication.

Before:
Did 483 TrustToken-Exp0-Batch1 generate_key operations in 2017082us (239.5 ops/sec)
Did 1449 TrustToken-Exp0-Batch1 begin_issuance operations in 2086097us (694.6 ops/sec)
Did 176 TrustToken-Exp0-Batch1 issue operations in 2089640us (84.2 ops/sec)
Did 147 TrustToken-Exp0-Batch1 finish_issuance operations in 2027924us (72.5 ops/sec)
Did 12284000 TrustToken-Exp0-Batch1 begin_redemption operations in 2000151us (6141536.3 ops/sec)
Did 483 TrustToken-Exp0-Batch1 redeem operations in 2063241us (234.1 ops/sec)
Did 35000 TrustToken-Exp0-Batch1 finish_redemption operations in 2050694us (17067.4 ops/sec)
Did 483 TrustToken-Exp0-Batch10 generate_key operations in 2003222us (241.1 ops/sec)
Did 138 TrustToken-Exp0-Batch10 begin_issuance operations in 2000845us (69.0 ops/sec)
Did 16 TrustToken-Exp0-Batch10 issue operations in 2010264us (8.0 ops/sec)
Did 14 TrustToken-Exp0-Batch10 finish_issuance operations in 2036137us (6.9 ops/sec)
Did 12106000 TrustToken-Exp0-Batch10 begin_redemption operations in 2000126us (6052618.7 ops/sec)
Did 483 TrustToken-Exp0-Batch10 redeem operations in 2062366us (234.2 ops/sec)
Did 35000 TrustToken-Exp0-Batch10 finish_redemption operations in 2023617us (17295.8 ops/sec)

Did 1254 TrustToken-Exp1-Batch1 generate_key operations in 2086776us (600.9 ops/sec)
Did 3612 TrustToken-Exp1-Batch1 begin_issuance operations in 2052090us (1760.2 ops/sec)
Did 420 TrustToken-Exp1-Batch1 issue operations in 2002421us (209.7 ops/sec)
Did 378 TrustToken-Exp1-Batch1 finish_issuance operations in 2078074us (181.9 ops/sec)
Did 12843000 TrustToken-Exp1-Batch1 begin_redemption operations in 2000068us (6421281.7 ops/sec)
Did 1210 TrustToken-Exp1-Batch1 redeem operations in 2083419us (580.8 ops/sec)
Did 35000 TrustToken-Exp1-Batch1 finish_redemption operations in 2023704us (17295.0 ops/sec)
Did 1239 TrustToken-Exp1-Batch10 generate_key operations in 2060962us (601.2 ops/sec)
Did 357 TrustToken-Exp1-Batch10 begin_issuance operations in 2031131us (175.8 ops/sec)
Did 42 TrustToken-Exp1-Batch10 issue operations in 2045185us (20.5 ops/sec)
Did 36 TrustToken-Exp1-Batch10 finish_issuance operations in 2028604us (17.7 ops/sec)
Did 12435000 TrustToken-Exp1-Batch10 begin_redemption operations in 2000084us (6217238.9 ops/sec)
Did 1176 TrustToken-Exp1-Batch10 redeem operations in 2023934us (581.0 ops/sec)
Did 35000 TrustToken-Exp1-Batch10 finish_redemption operations in 2002899us (17474.7 ops/sec)

After:
Did 875 TrustToken-Exp0-Batch1 generate_key operations in 2028222us (431.4 ops/sec) [+80.2%]
Did 1449 TrustToken-Exp0-Batch1 begin_issuance operations in 2097298us (690.9 ops/sec) [-0.5%]
Did 207 TrustToken-Exp0-Batch1 issue operations in 2083578us (99.3 ops/sec) [+18.0%]
Did 147 TrustToken-Exp0-Batch1 finish_issuance operations in 2018783us (72.8 ops/sec) [+0.5%]
Did 12020250 TrustToken-Exp0-Batch1 begin_redemption operations in 2000036us (6010016.8 ops/sec) [-2.1%]
Did 525 TrustToken-Exp0-Batch1 redeem operations in 2077137us (252.8 ops/sec) [+8.0%]
Did 35000 TrustToken-Exp0-Batch1 finish_redemption operations in 2006257us (17445.4 ops/sec) [+2.2%]
Did 903 TrustToken-Exp0-Batch10 generate_key operations in 2091846us (431.7 ops/sec) [+79.0%]
Did 138 TrustToken-Exp0-Batch10 begin_issuance operations in 2006432us (68.8 ops/sec) [-0.3%]
Did 19 TrustToken-Exp0-Batch10 issue operations in 2000665us (9.5 ops/sec) [+19.3%]
Did 14 TrustToken-Exp0-Batch10 finish_issuance operations in 2045846us (6.8 ops/sec) [-0.5%]
Did 12124000 TrustToken-Exp0-Batch10 begin_redemption operations in 2000055us (6061833.3 ops/sec) [+0.2%]
Did 525 TrustToken-Exp0-Batch10 redeem operations in 2076637us (252.8 ops/sec) [+7.9%]
Did 35000 TrustToken-Exp0-Batch10 finish_redemption operations in 2000072us (17499.4 ops/sec) [+1.2%]

Did 2142 TrustToken-Exp1-Batch1 generate_key operations in 2031447us (1054.4 ops/sec) [+75.5%]
Did 3633 TrustToken-Exp1-Batch1 begin_issuance operations in 2073265us (1752.3 ops/sec) [-0.4%]
Did 504 TrustToken-Exp1-Batch1 issue operations in 2043677us (246.6 ops/sec) [+17.6%]
Did 378 TrustToken-Exp1-Batch1 finish_issuance operations in 2086624us (181.2 ops/sec) [-0.4%]
Did 12548250 TrustToken-Exp1-Batch1 begin_redemption operations in 2000020us (6274062.3 ops/sec) [-2.3%]
Did 1281 TrustToken-Exp1-Batch1 redeem operations in 2067790us (619.5 ops/sec) [+6.7%]
Did 35000 TrustToken-Exp1-Batch1 finish_redemption operations in 2012117us (17394.6 ops/sec) [+0.6%]
Did 2184 TrustToken-Exp1-Batch10 generate_key operations in 2069977us (1055.1 ops/sec) [+75.5%]
Did 357 TrustToken-Exp1-Batch10 begin_issuance operations in 2041930us (174.8 ops/sec) [-0.5%]
Did 50 TrustToken-Exp1-Batch10 issue operations in 2063927us (24.2 ops/sec) [+18.0%]
Did 36 TrustToken-Exp1-Batch10 finish_issuance operations in 2038115us (17.7 ops/sec) [-0.5%]
Did 12693000 TrustToken-Exp1-Batch10 begin_redemption operations in 2000070us (6346277.9 ops/sec) [+2.1%]
Did 1281 TrustToken-Exp1-Batch10 redeem operations in 2066940us (619.8 ops/sec) [+6.7%]
Did 35000 TrustToken-Exp1-Batch10 finish_redemption operations in 2020506us (17322.4 ops/sec) [-0.9%]

Change-Id: Id26600c07401d6567275155aa389839ac0e87013
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41124
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-07 18:16:27 +00:00
David Benjamin 5f43b12d52 Use a (mostly) constant-time multi-scalar mult for Trust Tokens. 
With multi-scalar multiplication, we're stuck pondering the doubling
case. But it's fine for trust tokens, because the points are independent
and the scalars are uniformly generated and not under attacker control.
That means the probability of hitting a double is negligible. (It's
equivalent to accidentally finding the discrete log of two independent
points.)

Before:
Did 306 TrustToken-Exp0-Batch1 generate_key operations in 2000725us (152.9 ops/sec)
Did 1428 TrustToken-Exp0-Batch1 begin_issuance operations in 2080325us (686.4 ops/sec)
Did 105 TrustToken-Exp0-Batch1 issue operations in 2070658us (50.7 ops/sec)
Did 88 TrustToken-Exp0-Batch1 finish_issuance operations in 2023864us (43.5 ops/sec)
Did 12283000 TrustToken-Exp0-Batch1 begin_redemption operations in 2000063us (6141306.5 ops/sec)
Did 315 TrustToken-Exp0-Batch1 redeem operations in 2084451us (151.1 ops/sec)
Did 35000 TrustToken-Exp0-Batch1 finish_redemption operations in 2024388us (17289.2 ops/sec)
Did 315 TrustToken-Exp0-Batch10 generate_key operations in 2045481us (154.0 ops/sec)
Did 138 TrustToken-Exp0-Batch10 begin_issuance operations in 2022158us (68.2 ops/sec)
Did 10 TrustToken-Exp0-Batch10 issue operations in 2148640us (4.7 ops/sec)
Did 8 TrustToken-Exp0-Batch10 finish_issuance operations in 2047452us (3.9 ops/sec)
Did 12167000 TrustToken-Exp0-Batch10 begin_redemption operations in 2000118us (6083141.1 ops/sec)
Did 315 TrustToken-Exp0-Batch10 redeem operations in 2084853us (151.1 ops/sec)
Did 35000 TrustToken-Exp0-Batch10 finish_redemption operations in 2014997us (17369.8 ops/sec)

Did 777 TrustToken-Exp1-Batch1 generate_key operations in 2034967us (381.8 ops/sec)
Did 3612 TrustToken-Exp1-Batch1 begin_issuance operations in 2052618us (1759.7 ops/sec)
Did 264 TrustToken-Exp1-Batch1 issue operations in 2084327us (126.7 ops/sec)
Did 220 TrustToken-Exp1-Batch1 finish_issuance operations in 2024603us (108.7 ops/sec)
Did 12691000 TrustToken-Exp1-Batch1 begin_redemption operations in 2000111us (6345147.8 ops/sec)
Did 777 TrustToken-Exp1-Batch1 redeem operations in 2070867us (375.2 ops/sec)
Did 35000 TrustToken-Exp1-Batch1 finish_redemption operations in 2019118us (17334.3 ops/sec)
Did 798 TrustToken-Exp1-Batch10 generate_key operations in 2090816us (381.7 ops/sec)
Did 357 TrustToken-Exp1-Batch10 begin_issuance operations in 2032751us (175.6 ops/sec)
Did 25 TrustToken-Exp1-Batch10 issue operations in 2046353us (12.2 ops/sec)
Did 21 TrustToken-Exp1-Batch10 finish_issuance operations in 2015579us (10.4 ops/sec)
Did 12695000 TrustToken-Exp1-Batch10 begin_redemption operations in 2000126us (6347100.1 ops/sec)
Did 740 TrustToken-Exp1-Batch10 redeem operations in 2032413us (364.1 ops/sec)
Did 35000 TrustToken-Exp1-Batch10 finish_redemption operations in 2011564us (17399.4 ops/sec)

After:
Did 483 TrustToken-Exp0-Batch1 generate_key operations in 2003131us (241.1 ops/sec) [+57.7%]
Did 1449 TrustToken-Exp0-Batch1 begin_issuance operations in 2089317us (693.5 ops/sec) [+1.0%]
Did 176 TrustToken-Exp0-Batch1 issue operations in 2094210us (84.0 ops/sec) [+65.7%]
Did 147 TrustToken-Exp0-Batch1 finish_issuance operations in 2006750us (73.3 ops/sec) [+68.5%]
Did 12217000 TrustToken-Exp0-Batch1 begin_redemption operations in 2000094us (6108212.9 ops/sec) [-0.5%]
Did 483 TrustToken-Exp0-Batch1 redeem operations in 2058132us (234.7 ops/sec) [+55.3%]
Did 35000 TrustToken-Exp0-Batch1 finish_redemption operations in 2026970us (17267.2 ops/sec) [-0.1%]
Did 504 TrustToken-Exp0-Batch10 generate_key operations in 2086204us (241.6 ops/sec) [+56.9%]
Did 144 TrustToken-Exp0-Batch10 begin_issuance operations in 2084670us (69.1 ops/sec) [+1.2%]
Did 16 TrustToken-Exp0-Batch10 issue operations in 2008793us (8.0 ops/sec) [+71.1%]
Did 14 TrustToken-Exp0-Batch10 finish_issuance operations in 2033577us (6.9 ops/sec) [+76.2%]
Did 12026000 TrustToken-Exp0-Batch10 begin_redemption operations in 2000018us (6012945.9 ops/sec) [-1.2%]
Did 483 TrustToken-Exp0-Batch10 redeem operations in 2056418us (234.9 ops/sec) [+55.5%]
Did 35000 TrustToken-Exp0-Batch10 finish_redemption operations in 2046766us (17100.1 ops/sec) [-1.6%]

Did 1239 TrustToken-Exp1-Batch1 generate_key operations in 2060737us (601.2 ops/sec) [+57.5%]
Did 3675 TrustToken-Exp1-Batch1 begin_issuance operations in 2085293us (1762.3 ops/sec) [+0.1%]
Did 420 TrustToken-Exp1-Batch1 issue operations in 2008121us (209.2 ops/sec) [+65.1%]
Did 378 TrustToken-Exp1-Batch1 finish_issuance operations in 2077226us (182.0 ops/sec) [+67.5%]
Did 12783000 TrustToken-Exp1-Batch1 begin_redemption operations in 2000134us (6391071.8 ops/sec) [+0.7%]
Did 1197 TrustToken-Exp1-Batch1 redeem operations in 2056802us (582.0 ops/sec) [+55.1%]
Did 35000 TrustToken-Exp1-Batch1 finish_redemption operations in 2030955us (17233.3 ops/sec) [-0.6%]
Did 1260 TrustToken-Exp1-Batch10 generate_key operations in 2095507us (601.3 ops/sec) [+57.5%]
Did 357 TrustToken-Exp1-Batch10 begin_issuance operations in 2029693us (175.9 ops/sec) [+0.2%]
Did 42 TrustToken-Exp1-Batch10 issue operations in 2050856us (20.5 ops/sec) [+67.6%]
Did 36 TrustToken-Exp1-Batch10 finish_issuance operations in 2027488us (17.8 ops/sec) [+70.4%]
Did 12140000 TrustToken-Exp1-Batch10 begin_redemption operations in 2000070us (6069787.6 ops/sec) [-4.4%]
Did 1210 TrustToken-Exp1-Batch10 redeem operations in 2079615us (581.8 ops/sec) [+59.8%]
Did 34000 TrustToken-Exp1-Batch10 finish_redemption operations in 2052918us (16561.8 ops/sec) [-4.8%]

Change-Id: Idd51d7e1d18f3b94edc4105e68fd50b5f44d87cd
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41104
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-07 17:10:36 +00:00
David Benjamin ce1665b825 Batch inversions in Trust Tokens. 
The DLEQ and DLEQOR proofs require converting many Jacobian points to
affine, some multiple times. The inversions involved can be batched.

This buys us a +5-8% improvement in token issuance speed. issue and
finish_issue should each only perform two inversions per token now. We
could save an inversion per token by changing the dleq_generate and
dleq_verify function signatures, but that would complicate the likely
more valuable batched DLEQ(OR) optimization, so I've left those alone.

Before:
Did 300 TrustToken-Exp0-Batch1 generate_key operations in 2031798us (147.7 ops/sec)
Did 1449 TrustToken-Exp0-Batch1 begin_issuance operations in 2093639us (692.1 ops/sec)
Did 96 TrustToken-Exp0-Batch1 issue operations in 2044310us (47.0 ops/sec)
Did 84 TrustToken-Exp0-Batch1 finish_issuance operations in 2072137us (40.5 ops/sec)
Did 12170000 TrustToken-Exp0-Batch1 begin_redemption operations in 2000098us (6084701.8 ops/sec)
Did 315 TrustToken-Exp0-Batch1 redeem operations in 2091938us (150.6 ops/sec)
Did 35000 TrustToken-Exp0-Batch1 finish_redemption operations in 2004900us (17457.2 ops/sec)
Did 308 TrustToken-Exp0-Batch10 generate_key operations in 2067860us (148.9 ops/sec)
Did 138 TrustToken-Exp0-Batch10 begin_issuance operations in 2005706us (68.8 ops/sec)
Did 9 TrustToken-Exp0-Batch10 issue operations in 2107753us (4.3 ops/sec)
Did 8 TrustToken-Exp0-Batch10 finish_issuance operations in 2193489us (3.6 ops/sec)
Did 12046750 TrustToken-Exp0-Batch10 begin_redemption operations in 2000025us (6023299.7 ops/sec)
Did 315 TrustToken-Exp0-Batch10 redeem operations in 2091940us (150.6 ops/sec)
Did 35000 TrustToken-Exp0-Batch10 finish_redemption operations in 2008851us (17422.9 ops/sec)

Did 756 TrustToken-Exp1-Batch1 generate_key operations in 2051005us (368.6 ops/sec)
Did 3633 TrustToken-Exp1-Batch1 begin_issuance operations in 2072577us (1752.9 ops/sec)
Did 242 TrustToken-Exp1-Batch1 issue operations in 2052091us (117.9 ops/sec)
Did 210 TrustToken-Exp1-Batch1 finish_issuance operations in 2058740us (102.0 ops/sec)
Did 12477000 TrustToken-Exp1-Batch1 begin_redemption operations in 2000004us (6238487.5 ops/sec)
Did 777 TrustToken-Exp1-Batch1 redeem operations in 2084953us (372.7 ops/sec)
Did 35000 TrustToken-Exp1-Batch1 finish_redemption operations in 2028286us (17255.9 ops/sec)
Did 756 TrustToken-Exp1-Batch10 generate_key operations in 2051178us (368.6 ops/sec)
Did 357 TrustToken-Exp1-Batch10 begin_issuance operations in 2041875us (174.8 ops/sec)
Did 23 TrustToken-Exp1-Batch10 issue operations in 2026494us (11.3 ops/sec)
Did 20 TrustToken-Exp1-Batch10 finish_issuance operations in 2048478us (9.8 ops/sec)
Did 12492000 TrustToken-Exp1-Batch10 begin_redemption operations in 2000053us (6245834.5 ops/sec)
Did 777 TrustToken-Exp1-Batch10 redeem operations in 2084956us (372.7 ops/sec)
Did 36000 TrustToken-Exp1-Batch10 finish_redemption operations in 2021991us (17804.2 ops/sec)

After:
Did 315 TrustToken-Exp0-Batch1 generate_key operations in 2046638us (153.9 ops/sec) [+4.2%]
Did 1449 TrustToken-Exp0-Batch1 begin_issuance operations in 2087930us (694.0 ops/sec) [+0.3%]
Did 105 TrustToken-Exp0-Batch1 issue operations in 2071104us (50.7 ops/sec) [+8.0%]
Did 88 TrustToken-Exp0-Batch1 finish_issuance operations in 2023502us (43.5 ops/sec) [+7.3%]
Did 11847000 TrustToken-Exp0-Batch1 begin_redemption operations in 2000041us (5923378.6 ops/sec) [-2.7%]
Did 315 TrustToken-Exp0-Batch1 redeem operations in 2084116us (151.1 ops/sec) [+0.4%]
Did 35000 TrustToken-Exp0-Batch1 finish_redemption operations in 2003732us (17467.4 ops/sec) [+0.1%]
Did 315 TrustToken-Exp0-Batch10 generate_key operations in 2046863us (153.9 ops/sec) [+3.3%]
Did 138 TrustToken-Exp0-Batch10 begin_issuance operations in 2000108us (69.0 ops/sec) [+0.3%]
Did 10 TrustToken-Exp0-Batch10 issue operations in 2149283us (4.7 ops/sec) [+9.0%]
Did 8 TrustToken-Exp0-Batch10 finish_issuance operations in 2046416us (3.9 ops/sec) [+7.2%]
Did 12112000 TrustToken-Exp0-Batch10 begin_redemption operations in 2000077us (6055766.9 ops/sec) [+0.5%]
Did 315 TrustToken-Exp0-Batch10 redeem operations in 2084427us (151.1 ops/sec) [+0.4%]
Did 35000 TrustToken-Exp0-Batch10 finish_redemption operations in 2015111us (17368.8 ops/sec) [-0.3%]

Did 777 TrustToken-Exp1-Batch1 generate_key operations in 2029777us (382.8 ops/sec) [+3.9%]
Did 3654 TrustToken-Exp1-Batch1 begin_issuance operations in 2093484us (1745.4 ops/sec) [-0.4%]
Did 252 TrustToken-Exp1-Batch1 issue operations in 2024557us (124.5 ops/sec) [+5.5%]
Did 220 TrustToken-Exp1-Batch1 finish_issuance operations in 2034633us (108.1 ops/sec) [+6.0%]
Did 12659000 TrustToken-Exp1-Batch1 begin_redemption operations in 2000112us (6329145.6 ops/sec) [+1.5%]
Did 777 TrustToken-Exp1-Batch1 redeem operations in 2073783us (374.7 ops/sec) [+0.5%]
Did 35000 TrustToken-Exp1-Batch1 finish_redemption operations in 2050371us (17070.1 ops/sec) [-1.1%]
Did 768 TrustToken-Exp1-Batch10 generate_key operations in 2025482us (379.2 ops/sec) [+2.9%]
Did 357 TrustToken-Exp1-Batch10 begin_issuance operations in 2034429us (175.5 ops/sec) [+0.4%]
Did 25 TrustToken-Exp1-Batch10 issue operations in 2049293us (12.2 ops/sec) [+7.5%]
Did 21 TrustToken-Exp1-Batch10 finish_issuance operations in 2022256us (10.4 ops/sec) [+6.4%]
Did 12702000 TrustToken-Exp1-Batch10 begin_redemption operations in 2000015us (6350952.4 ops/sec) [+1.7%]
Did 777 TrustToken-Exp1-Batch10 redeem operations in 2072048us (375.0 ops/sec) [+0.6%]
Did 35000 TrustToken-Exp1-Batch10 finish_redemption operations in 2024580us (17287.5 ops/sec) [-2.9%]

Change-Id: Ia1b09cd14aa8ce0935d18033fb4bd75666a258e9
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41086
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-07 16:45:06 +00:00
David Benjamin 54a59c68b7 Rearrange the DLEQ logic slightly. 
The DLEQ logic needs to convert many points to affine coordinates at the
Hc computations. Rearrange things so the two happen concurrently, which
will allow us to batch the inversions.

Change-Id: I09bb053788f1555547272bf9af19b54e0fe7c325
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41085
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-05 18:55:28 +00:00
Steven Valdez 54304734eb Use token hash to encode private metadata for Trust Token Experiment V1. 
Bug: 328
Change-Id: Iaf3ff1bbe2f21c622b974081281848c60a01f142
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40764
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-05-05 18:37:58 +00:00
David Benjamin 802523aa5f Introduce an EC_AFFINE abstraction. 
PMBTokens ends up converting the same point to affine coordinates
repeatedly. Additionally, it converts many affine coordinates at once,
which we can batch. Introduce an EC_AFFINE type to store affine points
and move the inversion to the Jacobian -> affine conversion.

This does mean we lose the (negligible) Montgomery reduction
optimization in EC_GFp_mont. point_get_affine_coordinates no longer
breaks the EC_FELEM abstraction around Montgomery form.

Unfortunately, this complicates hardening of the callers not checking
return values because EC_AFFINE cannot represent the point at infinity
and, due to OpenSSL's API limitations, groups may not have generators
available and the generator is not affine at the type level. (EC_AFFINE
cannot represent the point at infinity.) Thus this CL:

- Tidies up some duplicate code in setting up the generator and ensures
  it always has Z = 1.
- ec_point_set_affine_coordinates hardens against unused results if the
  generator is configured. But this is ultimately an internal function.
- Retains the hardening on the public APIs by adding calls to
  ec_set_to_safe_point in two places.

This CL does not apply the optimization to Trust Tokens, only introduces
the EC_AFFINE abstraction. It additionally continues to store EC_POINTs
(used in ECDH and ECDSA) in Jacobian form. See
https://crbug.com/boringssl/326#c4 for a discussion on why this is
tricky. Those protocols are hopefully simple enough that they don't need
complexity around inversions.

Having an EC_AFFINE type will also be useful for computing custom tables
for Trust Token public keys, which gives a nice speedup.

Bug: 326
Change-Id: I11b010a33f36a15bac9939351df5205bd35cc665
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41084
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-05 16:55:18 +00:00
David Benjamin 73e0401e3d Make the fuzzer PRNG thread-safe. 
We run some unit tests with multiple threads now. While that makes it no
longer deterministic, we should at least be thread-safe.

Change-Id: I5d75f2ff1ce76d0b7914cd6ea61bcf640aa085ab
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41184
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-04 18:27:17 +00:00
Adam Langley cccfb9bcf2 Disable fork-detect tests under TSAN. 
TSAN can't cope with the pattern of forking and threading here and
exits with an error.

Change-Id: I3673004b62a45c5e910a4597f89764682a0b8d0a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41224
Commit-Queue: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-05-04 15:19:06 +00:00
David Benjamin aa764c46eb Introduce TRUST_TOKENS_experiment_v1. 
This starts a new branch of the protocol using P-384 and draft-07 of
hash-to-curve. Mark it unstable for now as we aim to add batching and
other fixes.

Did 154 TrustToken-Exp0-Batch1 generate_key operations in 1033312us (149.0 ops/sec)
Did 748 TrustToken-Exp0-Batch1 begin_issuance operations in 1078707us (693.4 ops/sec)
Did 48 TrustToken-Exp0-Batch1 issue operations in 1030056us (46.6 ops/sec)
Did 44 TrustToken-Exp0-Batch1 finish_issuance operations in 1092816us (40.3 ops/sec)
Did 6040750 TrustToken-Exp0-Batch1 begin_redemption operations in 1000009us (6040695.6 ops/sec)
Did 154 TrustToken-Exp0-Batch1 redeem operations in 1023722us (150.4 ops/sec)
Did 18000 TrustToken-Exp0-Batch1 finish_redemption operations in 1021087us (17628.3 ops/sec)
Did 154 TrustToken-Exp0-Batch10 generate_key operations in 1032878us (149.1 ops/sec)
Did 72 TrustToken-Exp0-Batch10 begin_issuance operations in 1050908us (68.5 ops/sec)
Did 4 TrustToken-Exp0-Batch10 issue operations in 1051989us (3.8 ops/sec)
Did 4 TrustToken-Exp0-Batch10 finish_issuance operations in 1214996us (3.3 ops/sec)
Did 5987000 TrustToken-Exp0-Batch10 begin_redemption operations in 1000068us (5986592.9 ops/sec)
Did 154 TrustToken-Exp0-Batch10 redeem operations in 1037898us (148.4 ops/sec)
Did 18000 TrustToken-Exp0-Batch10 finish_redemption operations in 1024788us (17564.6 ops/sec)

Did 396 TrustToken-Exp1-Batch1 generate_key operations in 1060955us (373.2 ops/sec)
Did 1925 TrustToken-Exp1-Batch1 begin_issuance operations in 1093039us (1761.1 ops/sec)
Did 121 TrustToken-Exp1-Batch1 issue operations in 1022292us (118.4 ops/sec)
Did 110 TrustToken-Exp1-Batch1 finish_issuance operations in 1076011us (102.2 ops/sec)
Did 6322000 TrustToken-Exp1-Batch1 begin_redemption operations in 1000144us (6321089.8 ops/sec)
Did 407 TrustToken-Exp1-Batch1 redeem operations in 1087774us (374.2 ops/sec)
Did 18000 TrustToken-Exp1-Batch1 finish_redemption operations in 1031736us (17446.3 ops/sec)
Did 407 TrustToken-Exp1-Batch10 generate_key operations in 1090415us (373.3 ops/sec)
Did 187 TrustToken-Exp1-Batch10 begin_issuance operations in 1065754us (175.5 ops/sec)
Did 11 TrustToken-Exp1-Batch10 issue operations in 1005738us (10.9 ops/sec)
Did 10 TrustToken-Exp1-Batch10 finish_issuance operations in 1066494us (9.4 ops/sec)
Did 6302000 TrustToken-Exp1-Batch10 begin_redemption operations in 1000029us (6301817.2 ops/sec)
Did 407 TrustToken-Exp1-Batch10 redeem operations in 1087692us (374.2 ops/sec)
Did 18000 TrustToken-Exp1-Batch10 finish_redemption operations in 1014611us (17740.8 ops/sec)

Change-Id: I7ea9a8ab8ad48acfbf50026e251cc6e1d5b8ba7f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41069
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
 2020-05-04 14:20:47 +00:00
David Benjamin 69402f33f3 Route PMBToken calls through TRUST_TOKEN_METHOD. 
Change-Id: I8b87484ea94cf1f931fa66216aab4654abe26bd3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41068
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-04 13:40:46 +00:00
David Benjamin 239634da1b Introduce a TRUST_TOKEN_METHOD hook to select TRUST_TOKEN variations. 
For now, it does nothing. This will make it easier to transition between
versions of the experiment while the protocol evolves.

Update-Note: Pass TRUST_TOKEN_experiment_v0() into any existing code
that now needs a TRUST_TOKEN_METHOD.

Change-Id: I434e18c794ab30545e367eb902e434e6311b7497
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41066
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-01 20:21:02 +00:00
Adam Langley ad5582985c fork_detect: be robust to qemu. 
fork_detect needs to know whether |MADV_WIPEONFORK| is supported by the
kernel or not. However, current versions of qemu ignore madvise calls
and just return zero, making it seems like it's supported when it's
actually not. Therefore, try an madvise with -1 to ensure that clearly
bogus values actually produce and error before trusting the result of
calling with |MADV_WIPEONFORK|.

Change-Id: I7f72714d5794274acabd0bee0b0ac470e1933774
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41024
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-05-01 18:35:42 +00:00
David Benjamin 90bb72c6a6 Move serialization of points inside pmbtoken.c. 
This reduces the number of places that know about the group and allows
us to abstract between different PMBTokens variations. Although the
abstraction isn't quite clean with the key_id in the TRUST_TOKEN
serialization, so we may need to ponder this.

Change-Id: Ia892340057025794aaf7c44a64c4d195a969715f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41065
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-01 18:16:12 +00:00
David Benjamin 090ee96bf6 Introduce PMBTOKENS key abstractions. 
Start tidying up the TRUST_TOKENS/PMBTOKENS split.

Change-Id: Iabcbc864f4016dfcb22438387446b04d31b64beb
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41064
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
 2020-05-01 17:52:31 +00:00
David Benjamin 17078f21a5 Fix the types used in token counts. 
The number of tokens is inconsistent throughout the API. max_batchsize
is a uint16_t. max_issuance is a size_t. out_tokens_issued is a
uint8_t*. The serialization only supports up to uint16_t.

Standardize on size_t. The natural size for a count of elements is
size_t. Protocol limitations can be handled within the implementation.
Additionally, it is best not to use small types for counters in public
APIs in C/C++ because the language has implicit truncating conversions.
(Whereas code points or other enum-like values are fine because the
caller won't managed to get a 32-bit cipher suite.)

Update-Note: Fix callers of TRUST_TOKEN_ISSUER_issue to use size_t
instead of uint8_t. The max_batchsize changes should go through without
changes to the caller.

Change-Id: I9be5dd8f61abdbe5a1dbe70b8dc72d06114b1022
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41044
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-05-01 17:29:22 +00:00
David Benjamin dc06e320d8 Remove unused code from ghash-x86_64.pl. 
Thanks to Brian Smith for pointing these out in
https://boringssl-review.googlesource.com/c/boringssl/+/38724.

Change-Id: I715da0778346fcc45aab19855050e18fe95a9185
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41144
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-05-01 16:01:21 +00:00
David Benjamin eeb5bb3561 Switch the P-384 hash-to-curve to draft-07. 
Leave the P-521 one alone as it's part of the current trust token
experiment. But suffix all the functions by their draft until everything
stabilizes. Also remove the ref_for_testing function since we can cite
the fixed test vectors from the upstream PR.

Change-Id: Ied89d26848c8ec1f6e8414a2385d9f3e491d7fb2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41067
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-04-30 20:23:27 +00:00
Steven Valdez 6a7184066f Add hash-to-curve code for P384. 
Change-Id: I34c3609641c23aed14f2324c6887250369ae8b5f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40944
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-29 17:16:17 +00:00
David Benjamin b36f52d187 Write down the expressions for all the NIST primes. 
I find myself needing to look them up frequently and this is easier than
digging through https://www.secg.org/SEC2-Ver-1.0.pdf each time.

Change-Id: I4aa7cdf2c8f114a0f2ba8b9bd7ee394d3201d731
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40984
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-27 17:27:49 +00:00
Adam Langley 21aede9179 Move fork_detect files into rand/ 
Files in the top-level of fipsmodule/ are considered be FIPS-support
files by generate_build_files.py. However, fork_detect is different.
Rather than have more special cases in the support scripts, this change
moves fork_detect into fipsmodule/rand. It's not a perfect fit, and
maybe it could have been its own directory, but it's not bad and fixes
the build for now.

Change-Id: I875088dd458069190dade870e085865e1306f55a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40964
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-04-26 21:38:36 +00:00
David Benjamin b1086cdb12 Harden against fork via MADV_WIPEONFORK. 
Linux 4.14 and up support MADV_WIPEONFORK, which can be used to reliably
and efficiently detect forks. Use it to harden the PRNG and RSA blinding
caches.

On the RSA side, we currently cache blinding values. (Alas, removing the cache
gives a *very* noticeable perf hit. There is some low-hanging fruit to trim a
few Montgomery reductions, but it didn't offset much last I toyed with it.)
Now, on Linux 4.14 and up, this cache is fork-safe.

Since not all platforms that support fork also support fork detection,
this should only be used as a hardening measure. Now, when detection is
present, BoringSSL will skip doing per-call entropy draws from the
kernel. (This might regress protection against VM cloning when no fast
RDRAND is available. However, we need to do something for AMD machines.
Hypervisors that clone VMs are going to need to signal the kernel to
wipe WIPEONFORK pages.)

Upgrade-Note: BoringSSL now calls some more syscalls on Linux. If this offends
sandboxes, let us know. We can loosen the sandbox or add a mechanism to prime
the MADV_WIPEONFORK page before entering it.

Change-Id: I6ba43951aeaa2b9b81f74f9e5a7a0ce2de0438a4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/34745
Reviewed-by: Adam Langley <alangley@gmail.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-04-26 18:31:56 +00:00
David Benjamin 14d192e930 Fix typo in comment. 
Change-Id: I67a012a54a2818ec12c1829a746e2d7f796616d6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40924
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-04-24 16:01:58 +00:00
David Benjamin 21f694210c Use faster addition chains for P-256 field inversion. 
Switch to the addition chains by Brian Smith in
https://briansmith.org/ecc-inversion-addition-chains-01#p256_field_inversion

The new addition chains are a bit faster when measured independently.
They aren't, however, noticeable when measured with everything else in
ECDH. Rather, the motivation is just to align fiat_p256, nistz256, and a
possible future fiat_p384 import.

Since it's free, I've included the (negligible) z^-2 optimization, but
if we ever want a z^-1 abstraction, it doesn't actually matter. In the
meantime, it replaces the (even more negligible) Montgomery conversion
optimization which is a bit less odd on the EC_FELEM abstraction. (I'm
pondering whether we want an EC_AFFINE abstraction given how the Trust
Tokens DLEQ proofs work.)

fiat_p256 (64-bit):
Before:
Did 539000 P-256 get x operations in 5007148us (107646.1 ops/sec)
Did 532000 P-256 get x and y operations in 5008736us (106214.4 ops/sec)
After:
Did 607000 P-256 get x operations in 5005225us (121273.3 ops/sec)
Did 594000 P-256 get x and y operations in 5001251us (118770.3 ops/sec)

nistz256:
Before:
Did 1472000 P-256 get x operations in 5003286us (294206.6 ops/sec)
Did 1445000 P-256 get x and y operations in 5002052us (288881.4 ops/sec)
After:
Did 1491000 P-256 get x operations in 5002524us (298049.5 ops/sec)
Did 1452000 P-256 get x and y operations in 5003193us (290214.7 ops/sec)

I haven't bothered checking in the benchmarks as those operations
standalone are largely artificial. They're a consequence of using the
same type for affine and Jacobian points.

Change-Id: I71e0d50a8712198f9cb8f68d50894d14a6091635
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40867
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-23 21:31:07 +00:00
David Benjamin 47b1e39042 Tidy up third_party/fiat. 
Originally, when we imported fiat-crypto field operations, the pipeline
was in early stages and the generated code had to be manually integrated
with the rest of the curve implementation, so we moved all our
supporting code to third_party/fiat for simplicity. Over time more
supporting code, like the table generators, landed there to be next to
its callers.

fiat-crypto now generates standalone files which we #include into the
supporting code. This moves the supporting code back to the usual
location. It also updates the README.md file to reflect the new
pipeline. (Most of it was a documentation of the old pipeline, which was
much more manual.)

Change-Id: I64db7235feb6566f0d3cd4db3a7146050edaf25a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40904
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-23 19:50:07 +00:00
David Benjamin 25ab623a86 Prefix g_pre_comp in p256.c as well. 
I missed a symbol.

Change-Id: I83c6828620a54eaab26cad08b1714402a2758fc0
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40905
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-23 19:05:07 +00:00
David Benjamin 8bbc5e9a61 Add missing curve check to ec_hash_to_scalar_p521_xmd_sha512. 
The bounds on k make this a little tricky to test, so stick an assert(0)
as that codepath should be impossible.

Change-Id: I03958ed36bff4f0b420a446c6d49eca944f45da2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40885
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-04-23 17:44:57 +00:00
David Benjamin 1d8ef2c666 Add a tool to compare the output of bssl speed. 
I've been doing it by hand this whole time.

Change-Id: Ib64dcca81c33ebe7b81cd8e3d579b9fca02e1096
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40745
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-23 17:15:27 +00:00
David Benjamin 21712d52c4 Benchmark ECDH slightly more accurately. 
We really need a better ECDH API in the first place, but ECDH would not
extract the y-coordinate which saves a couple multiplications. (This is
entirely unnoticeable between everything else going on in ECDH.)

Change-Id: I663554577b0cfc373067f9db4d2116a3dfbf1478
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40866
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-04-23 16:52:47 +00:00
David Benjamin c878b651ce Align remaining Intel copyright notice. 
https://boringssl-review.googlesource.com/c/boringssl/+/25588/ missed
one of the files.

Change-Id: Iba3aa37f5ecd69fd35054c44cbd5f8988a05f76e
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40868
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-23 15:59:37 +00:00
David Benjamin e2af857ddc Don't retain T in PMBTOKEN_PRETOKEN. 
We only need r, t, and T'.

Change-Id: I736c5638c73e80c99036182fa3cd30397c33d923
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40884
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-04-23 15:17:47 +00:00
David Benjamin cbe128b3e3 Check for trailing data in TRUST_TOKEN_CLIENT_finish_issuance. 
Change-Id: I2dec3ca3651c81e25370dfd7d10bd27c1803cc38
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40847
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-22 20:15:36 +00:00
David Benjamin 13d09f0527 Properly namespace everything in third_party/fiat/p256.c. 
This file gets #included into other files, so we shouldn't use generic
names like 'fe'. This will let us import other fiat-crypto curves in the
future, if we want them.

Change-Id: Ie4e222729bde7e4ccd368b86fb9048a2ea4a58ac
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40824
Reviewed-by: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-22 20:04:56 +00:00
David Benjamin baca5b4fa0 Update fiat-crypto. 
This pulls in the latest upstream files and reapplies our value_barrier patch.
In particular, https://github.com/mit-plv/fiat-crypto/pull/723 made 64-bit
P-256 faster!

32-bit x86, gcc
Before:
Did 3150 ECDH P-256 operations in 4027477us (782.1 ops/sec)
Did 9912 ECDSA P-256 signing operations in 4067212us (2437.1 ops/sec)
Did 3772 ECDSA P-256 verify operations in 4059197us (929.2 ops/sec)
Did 74800 Ed25519 key generation operations in 4020883us (18602.9 ops/sec)
Did 74000 Ed25519 signing operations in 4001827us (18491.6 ops/sec)
Did 21371 Ed25519 verify operations in 4024606us (5310.1 ops/sec)
Did 78000 Curve25519 base-point multiplication operations in 4051574us (19251.8 ops/sec)
Did 25133 Curve25519 arbitrary point multiplication operations in 4063280us (6185.4 ops/sec)
After:
Did 3250 ECDH P-256 operations in 4025179us (807.4 ops/sec) [+3.2%]
Did 10277 ECDSA P-256 signing operations in 4084926us (2515.8 ops/sec) [+3.2%]
Did 3895 ECDSA P-256 verify operations in 4048734us (962.0 ops/sec) [+3.5%]
Did 74480 Ed25519 key generation operations in 4002460us (18608.6 ops/sec) [+0.0%]
Did 74000 Ed25519 signing operations in 4004425us (18479.6 ops/sec) [-0.1%]
Did 21756 Ed25519 verify operations in 4038856us (5386.7 ops/sec) [+1.4%]
Did 78000 Curve25519 base-point multiplication operations in 4031991us (19345.3 ops/sec) [+0.5%]
Did 25133 Curve25519 arbitrary point multiplication operations in 4064925us (6182.9 ops/sec) [-0.0%]

x86_64, clang, OPENSSL_SMALL
Before:
Did 20090 ECDH P-256 operations in 4019408us (4998.2 ops/sec)
Did 56000 ECDSA P-256 signing operations in 4004370us (13984.7 ops/sec)
Did 23562 ECDSA P-256 verify operations in 4062283us (5800.2 ops/sec)
Did 127000 Ed25519 key generation operations in 4005053us (31709.9 ops/sec)
Did 128000 Ed25519 signing operations in 4021902us (31825.7 ops/sec)
Did 71000 Ed25519 verify operations in 4036015us (17591.6 ops/sec)
Did 132000 Curve25519 base-point multiplication operations in 4002101us (32982.7 ops/sec)
Did 93000 Curve25519 arbitrary point multiplication operations in 4023827us (23112.3 ops/sec)
After:
Did 22263 ECDH P-256 operations in 4005099us (5558.7 ops/sec) [+11.2%]
Did 61000 ECDSA P-256 signing operations in 4024810us (15156.0 ops/sec) [+8.4%]
Did 27426 ECDSA P-256 verify operations in 4038547us (6791.1 ops/sec) [+17.1%]
Did 128000 Ed25519 key generation operations in 4015033us (31880.2 ops/sec) [+0.5%]
Did 127000 Ed25519 signing operations in 4003894us (31719.1 ops/sec) [-0.3%]
Did 70000 Ed25519 verify operations in 4017446us (17424.0 ops/sec) [-1.0%]
Did 132000 Curve25519 base-point multiplication operations in 4006282us (32948.3 ops/sec) [-0.1%]
Did 93000 Curve25519 arbitrary point multiplication operations in 4025190us (23104.5 ops/sec) [-0.0%]

Change-Id: I2f705772899c701480ca0e0885e6b75dd1bb1f5d
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40746
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-22 19:06:26 +00:00
David Benjamin a27ed585fa Add missing ERR_LIB_TRUST_TOKEN constants. 
Also fix the numbering. ERR_LIB_USER probably ought to be last.

Change-Id: I2eb94dc129aa40b36711a7c20a9dfedf9944fc21
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40846
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-22 15:07:24 +00:00
Steven Valdez 188b65a791 Add bssl speed support for hashtocurve and trusttoken. 
Change-Id: I74bee1855c593131bf1451553de6a56b4e0e8a54
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40804
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-22 03:20:44 +00:00
Steven Valdez 78987bb7bb Implement DLEQ checks for Trust Token. 
Change-Id: I6f263b775aafad6616b31af59096c3b4229fe3e1
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40684
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-21 13:42:50 +00:00
David Benjamin 367d64f84c Fix error-handling in EVP_BytesToKey. 
This only matters on malloc failure and I think, even then,
EVP_DigestInit_ex will only fail the first time around the loop so it
wouldn't actually leak anything. Nonetheless, that should be a goto err.

Change-Id: Ieea9db387f9c16915c3a0026c6fd48036da2cfef
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40748
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-17 18:40:28 +00:00
Steven Valdez 8f3019e849 Fix Trust Token CBOR. 
CBOR requires map keys to be sorted by length followed by alphabet,
but only some parsers enforce this requirement.

Change-Id: I63cad4ec27f1509704be7a755b5486b0f4baa800
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40747
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-17 16:42:58 +00:00
David Benjamin 7853619553 Match parameter names between header and source. 
clang-tidy flagged this in a diff. Running a full clang-tidy would
probably reveal others, but ah well.

Change-Id: Ib004f7df4fd53b326686810c314869b35b35e547
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40749
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-17 16:37:18 +00:00
Steven Valdez 538a124d70 Trust Token Implementation. 
Trust Token implementation based on PrivacyPass using the PMBToken construction.
This implementation currently omits the DLEQ proofs.

https://github.com/alxdavids/privacy-pass-ietf/blob/master/draft-davidson-pp-protocol.md
https://eprint.iacr.org/2020/072.pdf

Change-Id: If236cc8beaf33a80bdad2991c3163f9dd0cb7571
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39244
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-17 01:41:02 +00:00
Adam Langley f37eb8d6a8 Include mem.h for |CRYPTO_memcmp| 
Change-Id: I3009326a5fa0c28bd3d214254e9beda4ea779833
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40744
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-04-16 21:10:07 +00:00
Adam Langley 9a798eb531 acvptool: add subprocess tests. 
(Written by Dan Janni.)

Change-Id: Ice03bb3e717b361af367cce7425f43d65e79cadc
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40724
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-16 17:00:17 +00:00
Adam Langley 3c11bf53e9 Add SHA-512-256. 
(Not wired up into all the signature verifiers because we don't need or
recommend that.)

Change-Id: Ia212a1f0e1c389a31d303e00a6fafb0ec3db7c71
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40704
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-15 21:23:37 +00:00
David Benjamin 9fc31378f0 Make ec_GFp_simple_cmp constant-time. 
We need a constant-time point equality for two reasons. First, although
multiplication results are usually public, their Jacobian Z coordinates
may be secret, or at least are not obviously public. Second, more
complex protocols will sometimes manipulate secret points, notably
PMBTokens.

While here I've renamed the inner function to points_equal without the
flipped return value, to be less confusing.

Update-Note: This does mean that we pay a 6M+2S Jacobian comparison
where comparing two publicly affine points should cost no field
operations at all. Code which compares two EC public keys for equality
will be slightly slower. I wouldn't expect this to matter (if you
actually use the public keys, you'll pay much much more) If it does, we
can restore this optimization by keeping better track of affine vs.
Jacobian forms. See https://crbug.com/boringssl/326.

Bug: 326, chromium:1014199
Change-Id: I67c9a56bc9b66f30c0b500a29e8bf90427d89061
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40665
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-13 21:33:44 +00:00
David Benjamin f883b98cfd Tidy up CRYPTO_sysrand variants. 
We can extend the inline function trick to avoid needing to add extra
wrappers to the fuzzer PRNG.

Change-Id: Ie007a4ccaf0e2d703a3710e4298a774af861d514
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40624
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-13 19:15:28 +00:00
David Benjamin 3d22c8260a Do a better job testing EC_POINT_cmp. 
If EC_POINT_cmp always returns points are equal, our tests barely
notice.

Change-Id: I1a78d95af2fad3d97c2db013468d34159807ff21
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40664
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-13 19:02:38 +00:00
David Benjamin 2a8e294b70 Follow-up comments to hash_to_scalar. 
See
https://boringssl-review.googlesource.com/c/boringssl/+/40646/3#message-ee607e82b0c62dd73a1b8a81f03acd9329cbbf02

Additionally, to be consistent with hash_to_field, we ought to use a
big-endian value. It's also probably time to have some common functions
for dealing with converting BN_ULONG[]s to and from big-endian bytes.
Coding all those free-handed is a little tedious and error-prone.

Change-Id: I6bdcd9362cee60e160e5a8eca25206b052206e1f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40647
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-10 18:35:25 +00:00
David Benjamin 28987cf081 Add a hash_to_scalar variation of P-521's hash_to_field. 
DLEQ proofs for PMBTokens need a random oracle over scalars as well as
field elements. (Interestingly, draft-irtf-cfrg-voprf-03 section 5.1
does not specify as strong of requirements, but then their reference
implementation does rejection sampling, so it's unclear.)

Reusing the hash_to_field operation so hash calls use the domain
separation tag consistently with other hash-to-curve operations seems
prudent, so implement a companion function until the actual construction
solidifies.

Change-Id: I92d807bfddcca26db690cce0a3da551143c25ff3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40646
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
 2020-04-10 15:37:52 +00:00
David Benjamin f9e0cda2d8 Add SSL_SESSION_copy_without_early_data. 
While we could store an extra boolean along with each session in the
session cache and then disable early data on a per-socket level, that
causes SSL_early_data_reason to report confusing values. Clearing it
at the session seems simpler. Since sessions are intended to be
mutable, do this as a copy operation.

Bug: chromium:1066623
Change-Id: I599b1559b696805e330ab5c2d61e4158440daef8
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40464
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-09 18:50:29 +00:00
David Benjamin 5902657734 Double-check secret EC point multiplications. 
Doing a Jacobian point-on-curve check has negligible cost compared to
the point operations. We may as well perform one to add some defense
against potential bugs and such. (We already double-check RSA
operations.)

Before:
Did 40000 ECDH P-224 operations in 3014872us (13267.6 ops/sec)
Did 55000 ECDH P-256 operations in 3026351us (18173.7 ops/sec)
Did 3410 ECDH P-384 operations in 3053181us (1116.9 ops/sec)
Did 1364 ECDH P-521 operations in 3079656us (442.9 ops/sec)
Did 83000 ECDSA P-224 signing operations in 3013476us (27542.9 ops/sec)
Did 41000 ECDSA P-224 verify operations in 3073530us (13339.7 ops/sec)
Did 168000 ECDSA P-256 signing operations in 3008562us (55840.6 ops/sec)
Did 60000 ECDSA P-256 verify operations in 3038517us (19746.5 ops/sec)
Did 6169 ECDSA P-384 signing operations in 3066741us (2011.6 ops/sec)
Did 6231 ECDSA P-384 verify operations in 3054468us (2040.0 ops/sec)
Did 2418 ECDSA P-521 signing operations in 3058901us (790.5 ops/sec)
Did 2418 ECDSA P-521 verify operations in 3048765us (793.1 ops/sec)

After:
Did 39600 ECDH P-224 operations in 3001966us (13191.4 ops/sec)
Did 55000 ECDH P-256 operations in 3033098us (18133.3 ops/sec)
Did 3441 ECDH P-384 operations in 3088436us (1114.2 ops/sec)
Did 1364 ECDH P-521 operations in 3087711us (441.8 ops/sec)
Did 83000 ECDSA P-224 signing operations in 3029486us (27397.4 ops/sec)
Did 40000 ECDSA P-224 verify operations in 3005452us (13309.1 ops/sec)
Did 168000 ECDSA P-256 signing operations in 3011387us (55788.2 ops/sec)
Did 60000 ECDSA P-256 verify operations in 3030343us (19799.7 ops/sec)
Did 6076 ECDSA P-384 signing operations in 3023469us (2009.6 ops/sec)
Did 6231 ECDSA P-384 verify operations in 3056138us (2038.8 ops/sec)
Did 2418 ECDSA P-521 signing operations in 3057375us (790.9 ops/sec)
Did 2449 ECDSA P-521 verify operations in 3083418us (794.2 ops/sec)

Change-Id: Icedc51e340c8f3a21f96a535395814575e0c89b2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40592
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-09 18:11:29 +00:00
David Benjamin d2c5b7da2f Make ec_felem_equal constant-time. 
This doesn't fix any particular issue, but we may as well use
the constant-time comparison to be more robust.

Change-Id: I96dffce7fe153a7dd4eec226a6b42dcea240c3f1
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40591
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-09 15:45:09 +00:00
David Benjamin 0f86c142a7 Fix hash-to-curve comment. 
511S + 3M isn't even enough operations to get up to 2^519-1. I dropped a
a bunch of terms. (We can get up to 2^512-1 with 511S + 9M. Then an
additional 7S + 3M finishes it up.)

Change-Id: Ibb1bc3491dfb09ab8a917498e99deb66e4894cf0
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40644
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-09 15:32:38 +00:00
David Benjamin f20772cc0a Make ec_GFp_simple_is_on_curve constant-time. 
This function (by way of EC_POINT_is_on_curve) is used by callers in two
places:

- To check the affine result of decoding a point. (This is no longer
  necessary because we'll always do it internally, but folks still do
  it.)

- To check the Jacobian result of a multiplication as fault protection.
  (Tink does this. We should probably do it in the library.)

That function's implementations of affine and Jacobian checks are mostly
constant-time, but branching between the two isn't. Since the difference
is small (2S + 1M vs 2S + 3M) compared to what one would be doing with
an affine point (point multiplication), this probably isn't worth
worrying about. Conservatively do the Jacobian check so folks like Tink
aren't accidentally introducing side channels.

Change-Id: I3140167868e027004906293df547add43ae40552
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40590
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-09 15:03:48 +00:00
David Benjamin a49c617197 Implement draft-irtf-cfrg-hash-to-curve-06. 
This implements hash-to-curve for P-521, which is needed by the
PMBTokens construction in https://eprint.iacr.org/2020/072.pdf. It is
only an internal function for now, operating on EC_RAW_POINT, so that
PMBTokens can avoid allocating EC_POINTs everywhere. If we ever have a
need to expose this outside, we can add an EC_POINT wrapper (hopefully
by then the draft will be stable).

Note this implements two versions of the function due to a spec issue in
P521_XMD:SHA-512_SSWU_RO_. One of them only exists to test against the
original test vectors. See
https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/issues/237

Bug: chromium:1014199
Change-Id: I7207d1bcb8b20f7111c2ffb40e2794ad2d3d0000
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40589
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-08 22:18:51 +00:00
Adam Langley 4143943085 Update list of tested SDE configurations. 
This is taken from the help output of the current version of SDE.

Change-Id: I0513088a52d6692dd419f323b72411e107ed9636
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40584
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-08 18:45:11 +00:00
Adam Langley 7a22a65098 Only draw from RDRAND for additional_data if it's fast. 
We seek to incorporate entropy into every |RAND_bytes| call to avoid
problems with fork() and VM cloning. However, on some chips, RDRAND is
significantly slower than a system call thus crushing the performance of
|RAND_bytes|.

This change disables use of RDRAND for this opportunistic draw for
non-Intel chips. BoringSSL will then fall back to either the OS, or
nothing (if fork-unsafe mode has been set).

RDRAND is still used for seeding the PRNG whenever it is available.

This now adds a new blocking case: RDRAND may be used for seeding, but
the syscall to get additional_data was still blocking. Previously that
didn't matter because, if a syscall was used to get additional_data,
then a blocking one had already been used to seed. Thus the syscall for
additional_data is now non-blocking.

Also, we had both |hwrand| and |rdrand| names hanging around. We don't
support entropy instructions other than RDRAND, so unify around |rdrand|
naming. If we ever do add support for more we can properly abstract at
that time.

Change-Id: I91121b270a2ebc667543dad1324f37285daad893
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40565
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-08 18:29:21 +00:00
David Benjamin ea53011c6e Generalize bn_from_montgomery_small. 
Montgomery reduction works when the input is at most N*R (N^2 is a
tighter bound that's easier to describe and usually suffices). This is
useful when reducing product-sized values. In particular,
hash-to-curve's hash_to_field function requires a reduction. Generalize
this so we can implement it with Montgomery reduction.

Bug: chromium:1014199
Change-Id: I1a07f9b94823742384a98c0c6fecdedfe5240b7b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40588
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-08 00:40:10 +00:00
David Benjamin ad5e3e3597 Remove BIGNUM from uncompressed coordinate parsing. 
Compressed coordinates still use BIGNUM. I've moved the curve check to
an EC_FELEM-based ec_point_set_affine_coordinates and implemented a
tighter one than ec_GFp_simple_is_on_curve, which currently needs to
branch on Jacobian vs. affine and potentially leaks information. (A
later CL will make it conservatively always perform a Jacobian check.)

The Trust Tokens implementation will eventually need to deserialize
points, so this avoids needing to allocate EC_POINTs everywhere.
Likewise if we ever get around to adding a better ECDH, this will let us
avoid pulling in BIGNUMs.

Bug: chromium:1014199, 242
Change-Id: I93162ba3680d38cb3c0eacff1eb8f42a445246ea
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40587
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-07 23:46:10 +00:00
David Benjamin 58add794d9 Add EC_RAW_POINT serialization function. 
This avoids some unnecessary EC_POINT allocations in the in-progress Trust
Tokens implementation.

Bug: chromium:1014199
Change-Id: I64e1fca61d111eacec02648e68972be30fd5a48f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40586
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-07 23:14:30 +00:00
David Benjamin 1d43e57c30 Base EC_FELEM conversions on bytes rather than BIGNUMs. 
It is tricky to create EC_FELEMs right now. This will simplify making them.

Change-Id: Icde518efed61381004e2e5569a45d653af48ca2a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40585
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-07 23:10:10 +00:00
David Benjamin 47a6f5b4bf runner: Replace supportsVersions calls with allVersions. 
Save a few lines.

Change-Id: I9e3bdd00e31d5c832c29df68be0207e13a36fc8e
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40604
Reviewed-by: Nick Harper <nharper@chromium.org>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-07 23:06:10 +00:00
Nick Harper e8434d304c Enable QUIC for some perMessageTest runner tests 
Change-Id: I7b944a5456e04a2fb1b0248a020d288065064043
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40304
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-07 22:51:10 +00:00
David Benjamin b65e630ec0 Move BN_nnmod calls out of low-level group_set_curve. 
group_set_curve is called when instantiating the built-in curves and
when creating arbitrary curves. The former has non-NULL BN_CTXs and
fully reduced inputs. Move the logic for this to the deprecated
EC_GROUP_new_curve_GFp function so it can be dropped from most binaries.

Change-Id: I5ff60d6d51acb79fbcb32588e6324a5b2627b6d2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40544
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-07 20:54:45 +00:00
David Benjamin bd1fa86feb Clean up various EC inversion functions. 
This fixes two issues. First, we have been lax about whether the
low-level inversion functions fail on zero input or output zero. Fix the
documentation and call the latter inv0 or inverse0 to match the
terminology used in draft-irtf-cfrg-hash-to-curve. (Although we may not
actually need inv0 given the optimization in D.2.)

This has no actual effect because the functions were only used in
contexts where the inputs were already guaranteed to be non-zero. Still,
we should be consistent here.

Second, ec_scalar_inv_montgomery and ec_scalar_inv_montgomery_vartime
claim to perform the same operation, but they do not. First, one
computed inv0 and the other computed inv (except only in some
implementations, so fix it to be consistent). Second, the former
computes inverses in the Montgomery domain, while the latter converts to
the Montgomery domain and then inverts. Rename it to
ec_scalar_to_montgomery_inv_vartime, which is... questionably
understandable but at least looks different.

Change-Id: I9b4829ce5013bdb9528078a093f41b1b158df265
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40526
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-07 20:28:59 +00:00
David Benjamin 243a29241c Start to organize ec/internal.h a little. 
Change-Id: I1de8ca164641d1e3d1fc36246205a7c0e60e0034
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40525
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-07 19:34:55 +00:00
Adam Langley 12840915a1 Fix CFI for AVX2 ChaCha20-Poly1305. 
When running ABI tests on an AVX2-enabled system, they flag the
ChaCha20-Poly1305 assembly. The issue appears pretty simple: the code
has chunks of code after the mainline `ret` instruction the there's a
CFI directive that undoes the adjustments for restoring registers, but
it only accounts for six saved registers and there are actually seven.

At least, with this, the ABI tests are happy.

Change-Id: Ia6d1d89f564148db43852b245916a8c2cdfb1e6b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40564
Commit-Queue: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-07 19:33:30 +00:00
David Benjamin 300ef4767d Remove unused function prototype. 
This function was removed in
https://boringssl-review.googlesource.com/c/boringssl/+/33065.

Change-Id: Ib8adefeabafa58e22e1b0fdd406f73c234c2e5e7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40524
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-07 19:17:12 +00:00
Nick Harper af6bfbee47 Enable more runner tests for QUIC 
Change-Id: Id1922197c5218460210e6404ad60b60afc591984
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40284
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-04-06 18:51:17 +00:00
Nick Harper 72cff81939 Require QUIC method with Transport Parameters and vice versa 
Bug: 296, 322

Change-Id: I297f53674ee7177f61d75695f47b5caeed78bd17
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40384
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-03 21:52:34 +00:00
Adam Langley ee2660203b acvptool: support non-interactive mode. 
Most people won't need the interactive mode and it's use of x/crypto can
be problematic in some contexts.

Change-Id: I33e0178726ee485f3967c0b71c9d538524af9286
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40504
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-02 17:00:33 +00:00
Nick Harper 6bfd25c755 Add is_quic bit to SSL_SESSION 
This bit is used to prevent cross-protocol resumption between QUIC and
TLS-over-TCP.

Bug: 221
Change-Id: I8ab5341f00ae96c0a5f7ac3999f61edc7cbeca1c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40444
Commit-Queue: Nick Harper <nharper@chromium.org>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-01 21:38:22 +00:00
David Benjamin d5aae81fb7 Update SDE. 
Change-Id: I7f5209dff570b1b2efd8d1d53ece818219bbf98c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40470
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-01 18:43:51 +00:00
David Benjamin 7c719d1246 Update tools. 
This skips vs_toolchain.py because Chromium is now using VS2019, but we're
still testing 2015 and 2017.

Change-Id: Ib46eba76c8a3309d82be6e88e2baa4d8a93d222a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40469
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-01 18:21:41 +00:00
David Benjamin cdc5c184b3 Add simpler getters for DH and DSA. 
These come from OpenSSL 1.1.1. I don't think any third-party code is
using them yet, but OpenSSL 1.1.0 is EOL, so newer code may use them and
they're much more convenient when porting over existing uses of DH and
DSA.

Bug: 325
Change-Id: I767496da4b458a3871dea23a1405b1e7e40b3de5
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40484
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-04-01 18:01:12 +00:00
Adam Langley 0cf14d3ec8 Don't define default implementations for weak symbols. 
See https://github.com/facebook/folly/blob/d72b38e4aa7a42d9ff49705020e0916851d0e3cc/folly/memory/Malloc.h#L89-L97

This should work as well and be more robust to the pattern used in
Folly. The branch-predictor in modern CPUs probably makes it equally
fast.

Change-Id: I65b115c16d103b8a5492354411b55f3ef906b097
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40405
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-01 16:18:51 +00:00
Adam Langley 732b70ee20 Don't automatically run all tests for ABI testing. 
We have good coverage for individual functions now and this makes
running tests when building for shared libraries more complex.

Change-Id: Ie69d234e1eed04e341b5192e174c4dae553c8706
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40404
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-01 15:20:21 +00:00
Adam Langley 577eadc424 Fix test build with recent Clang. 
Some configurations of Clang hate not using a reference in a C++
range-for loop.

Change-Id: I90abf99625df4bbb67e835411bd85d995252beae
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40471
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-04-01 14:49:21 +00:00
David Benjamin 141062fe7f Remove LCM dependency from RSA_check_key. 
Instead of checking d * e = 1 (mod lcm(p-1, q-1)), we can separately
check d * e = 1 (mod p-1) and d * e = 1 (mod q-1). This drops an LCM
dependency from key import and is 2x faster.

(Our constant-time LCM implementation can probably be faster if we
tried, but now it's only used in RSA keygen, so it doesn't matter much.
It's also using the unoptimized constant-time division, which is
probably the next target if we decide we care about speeding this up.)

Before:
Did 6768 RSA 2048 checking operations in 3015824us (2244.2 ops/sec)
Did 5610 RSA 2048 signing operations in 3033396us (1849.4 ops/sec)
Did 1953 RSA 4096 checking operations in 3060828us (638.1 ops/sec)
Did 817 RSA 4096 signing operations in 3021092us (270.4 ops/sec)
After:
Did 13175 RSA 2048 checking operations in 3090576us (4263.0 ops/sec)
Did 5610 RSA 2048 signing operations in 3032966us (1849.7 ops/sec)
Did 3720 RSA 4096 checking operations in 3085971us (1205.5 ops/sec)
Did 820 RSA 4096 signing operations in 3027312us (270.9 ops/sec)

Bug: 316
Change-Id: Ie29554c02d31f586dd0f8bdee03a227f1d5dc916
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40146
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-03-31 23:11:26 +00:00
David Benjamin ce9b8737cb Simplify bn_sub_part_words. 
This function does not need to be so complex. The bulk of
the work is done by bn_sub_words. The unrolled loop is only used when
bn_sub_part_words is called in different-length inputs.

bn_sub_part_words is itself only called from bn_abs_sub_consttime and
bn_mul_part_recursive. bn_abs_sub_consttime is used to compute p - q in
RSA key generation so it never sees different-width inputs.
bn_mul_part_recursive is called from bn_mul_impl if all of the following
are true:

- Both inputs are at least 16 words long (1024 bits on 64-bit platforms
  and 512 bits on 32-bit).

- The two inputs are within one word from each other.

- The length of the larger input is one more than a power of two.

The first condition rules out all EC configurations except P-521 on
32-bit platforms. The EC code uses bn_mul_mont assembly if available, so
this only affects non-x86 and non-ARM 32-bit architectures. Building for
32-bit x86 without assembly shows no significant change:

Before:
Did 88 ECDH P-521 operations in 1014591us (86.7 ops/sec)
Did 165 ECDSA P-521 signing operations in 1066428us (154.7 ops/sec)
Did 150 ECDSA P-521 verify operations in 1001749us (149.7 ops/sec)
After:
Did 90 ECDH P-521 operations in 1045905us (86.0 ops/sec)
Did 165 ECDSA P-521 signing operations in 1071189us (154.0 ops/sec)
Did 154 ECDSA P-521 verify operations in 1050509us (146.6 ops/sec)

RSA does meet the first condition, but the third condition rules out all
common RSA sizes, with one quirk: RSA_check_key uses the non-normalized
BIGNUMs, but RSA_check_key is not called as part of private key
operations. (https://crbug.com/boringssl/316 discusses what to do about
RSA longer term. It's kind of a mess right now.)

Bug: 314
Change-Id: I0bd604e2cd6a75c266f64476c23a730ca1721ea6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40145
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-03-31 22:56:39 +00:00
David Benjamin 8b4fa1b6b5 No-op commit to test Windows SDE bots. 
Change-Id: I10210ed7f4a40925f68383d16ec619a2cf43308f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40468
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-03-31 22:27:03 +00:00
Adam Langley 6c17797205 ABI-test each AEAD. 
This keeps coverage for some assembly once we stop ABI testing by
default.

Change-Id: I2937a2961c19de560cb63e180646eb0e7d59d4ec
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40424
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-03-31 16:16:44 +00:00
Wiktor Garbacz 9ae40ce9ad Add memory tracking and sanitization hooks 
Intended use is sanitization of BoringSSL allocations.

Change-Id: Ia577f944d19e5b0b77373fedd0970e2c0c97cd21
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39824
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-03-25 17:45:13 +00:00
David Benjamin 5cd0724ecb Add X509_STORE_CTX_get0_chain. 
In OpenSSL 1.1.x, the preferred spelling of X509_STORE_CTX_get_chain is
X509_STORE_CTX_get0_chain.

Change-Id: I20281c7ae86371a72ac70fb9a8719f4810e0747c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40366
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-03-24 01:51:30 +00:00
David Benjamin 0064c290d1 Add DH_set_length. 
OpenSSH uses this function.

Change-Id: I73c4c1647f61824f771022606f95bff7f6d3d77a
Update-Note: Set HAVE_DH_SET_LENGTH in OpenSSH.
Bug: 325
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40365
Reviewed-by: Adam Langley <agl@google.com>
 2020-03-23 23:30:01 +00:00
David Benjamin dea1d44988 Static assert that CRYPTO_MUTEX is sufficiently aligned. 
Bug: 325

Change-Id: I55d4d7fcb91602c8d2a371be5011e1a5df157819
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40364
Reviewed-by: Adam Langley <agl@google.com>
 2020-03-23 23:28:24 +00:00
Yannic Bonenberger 7fe639cc2d [bazel] Format toplevel BUILD file with buildifier 
This change was generated with
  buildifier -type build -lint=fix -warnings=all util/BUILD.toplevel

Change-Id: I4200fb484ec205c37abcb9b657c4ce74796a411c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40324
Reviewed-by: Adam Langley <agl@google.com>
 2020-03-23 14:51:06 +00:00
Adam Langley 964256d066 Add |SSL_CTX_get0_chain|. 
This is the getter counterpart to |SSL_CTX_set_chain_and_key|. There's
no |SSL*| because a) we didn't need it and b) then you have to worry
about config discarding and it doesn't end up being very useful.

Change-Id: Iba75d0165d7e555d0f793687b1f5e1e6c6f7c738
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40264
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-03-19 22:53:55 +00:00
David Benjamin 5298ef99bf Configure QUIC secrets inside set_{read,write}_state. 
set_write_state flushes buffered handshake data, and we should finish
writing to a level before moving on to the next one.

I've moved the callback into set_{read,write}_state to ensure we still
update read_level and write_level after installing secrets, since that's
how we decide what level to write things and we should never write
alerts with keys we don't have. (I believe the only way this can come up
is if the QUIC callback itself fails, but it still seems prudent to
defer updating the levels.)

This does unfortunately mean a goofy secret_for_quic parameter, though
it is arguably more "correct" in that QUIC would ideally be a third
SSL_PROTOCOL_METHOD, rather than escape hatches over TLS. Probably a
cleaner abstraction would be for set_read_state and set_write_state to
take the secret and derive an SSLAEADContext internally.

Update-Note: See b/151142920#comment9
Change-Id: I4bbb76e15b5d95615ea643bccf796db87fae4989
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40244
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-03-16 16:45:10 +00:00
Nick Harper 80ddfc7d1b Allow setting QUIC transport parameters after parsing the client's 
Our server code (unfortunately) conditions its transport parameters
based on the client's transport parameters. Instead of using
hs->config->quic_transport_params to check whether QUIC is in use, this
replaces it with ssl->quic_method.

Change-Id: I6817e9f674a70f4568b0c469c96dfdf1c1c91709
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40224
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-03-13 20:04:56 +00:00
Adam Langley 959c76d928 Fix comment for |BORINGSSL_self_test|. 
The hash-based omission of the self tests for Android was moved around,
but the comment wasn't updated to match.

Change-Id: I66c3b4e9b48df00e8134cee3feb72469f92d51a4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40184
Commit-Queue: Adam Langley <alangley@gmail.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-03-11 18:23:46 +00:00
Steven Valdez 0b710a305b Trust Token Key Generation. 
Trust Token is a new protocol to issue and redeem provably anonymized
tokens. To allow for development of key storage/management for Trust
Token, this CL provides the function to generate Trust Token keys.

Bug: chromium:1014199
Change-Id: If764e027b202f07be13c64f7be66dfaff71c45e7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40064
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-03-04 21:16:08 +00:00
David Benjamin 1e859054c3 Revise QUIC encryption secret APIs. 
The original API separated when keys were exported to QUIC from when
they were "active". This means the obligations on QUIC are unclear. For
instance we added SSL_quic_read_level and SSL_quic_write_level to
capture when keys were active, yet QUICHE never used them anyway. It
would be better to defer releasing keys to when they are needed.

In particular, we should align our API with the guidelines in
https://github.com/quicwg/base-drafts/issues/3173.

This means we need separate read and write callbacks, which
unfortunately means the invariants around ACKs must now be covered in
prose.

We'll likely remove SSL_quic_read_level and SSL_quic_write_level in a
later CL as QUIC has no need to know this anymore. (It should simply
feed handshake data to BoringSSL as it sees it and, if we reject it,
report a suitably error.) The notion of a "current" encryption level is
a little odd given the interaction between 0-RTT and
ServerHello..Finished ACKs.

Update-Note: This is an incompatible change to SSL_QUIC_METHOD.
BORINGSSL_API_VERSION can be used to distinguish the two revisions.

Bug: 303
Change-Id: I6c9dca1ae156d26a80c366a4ba969dcb04e65349
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40127
Reviewed-by: Nick Harper <nharper@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-03-03 17:15:15 +00:00
David Benjamin bfe527fa35 Fix ec_point_mul_scalar_public's documentation. 
At the time the comment was written, the secret multiplication operation
hadn't been split yet.

Change-Id: Idd283461c357b47e91b73fac489d1828c4ce2a0c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40065
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-03-03 17:09:35 +00:00
David Benjamin 2fb729d4f3 Don't infinite loop when QUIC tests fail. 
Change-Id: I33714c68ab8ba841c614afd2ea9a57a6e9b8c27a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40126
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
 2020-03-02 18:57:19 +00:00
David Benjamin 44099d5925 Tidy up transitions out of 0-RTT keys on the client. 
This change does two things. First, it funnels the transition out of
0-RTT into one function so that, later, when QUIC releases keys in
set_(read|write)_state, we can handle the QUIC quirks better.

Second, it switches to handshake (or initial) keys as soon as 0-RTT is
closed. In particular, if EncryptedExtensions reports a 0-RTT reject, we
switch keys before processing Certificate. This way, if we then reject
the server certificate, we send the alert with keys the server can read.

If there is an error in EncryptedExtensions or earlier, we do not know
whether the server is expecting 0-RTT-encrypted alerts or
handshake-encrypted alerts, so we cannot reliably send an alert. This is
fine because all such error cases are server implementation bugs and
alerts are purely a debugging courtesy. However, after a 0-RTT reject,
we may reject the Certificate message due to local policy, in which case
the certificate error alerts make more sense.

Bug: 303
Change-Id: I4c4bc9c8ab2c2ecb89e20141518e1b7ea7b39af3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40125
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-03-02 18:29:59 +00:00
David Benjamin 3280287c06 Remove bn_sub_part_words assembly. 
The assembly only existed for 32-bit x86, which is much less relevant
these days. It's also just a pile of ADDs, ADCs, etc., which compilers
should be able to figure out by now.

This frees us up to clean up that function, including the weird cl/dl
calling convention. No noticeable difference in RSA benchmarks:

Before:
Did 224 RSA 2048 signing operations in 1006100us (222.6 ops/sec)
Did 9240 RSA 2048 verify (same key) operations in 1078563us (8567.0 ops/sec)
Did 8541 RSA 2048 verify (fresh key) operations in 1064996us (8019.7 ops/sec)
Did 32 RSA 4096 signing operations in 1052851us (30.4 ops/sec)
Did 2365 RSA 4096 verify (same key) operations in 1093337us (2163.1 ops/sec)
Did 2222 RSA 4096 verify (fresh key) operations in 1090037us (2038.5 ops/sec)

After:
Did 231 RSA 2048 signing operations in 1018908us (226.7 ops/sec)
Did 9394 RSA 2048 verify (same key) operations in 1095548us (8574.7 ops/sec)
Did 8525 RSA 2048 verify (fresh key) operations in 1062449us (8023.9 ops/sec)
Did 32 RSA 4096 signing operations in 1050236us (30.5 ops/sec)
Did 2376 RSA 4096 verify (same key) operations in 1098509us (2162.9 ops/sec)
Did 2233 RSA 4096 verify (fresh key) operations in 1094724us (2039.8 ops/sec)

Bug: 314
Change-Id: I86a27b2550ab8bec2a9930cc509f4c29d6036b35
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40144
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-02-28 17:56:19 +00:00
David Benjamin b092192965 Keep the encryption state and encryption level in sync. 
This is a little bit of internal cleanup. The original intent was so
QUIC could install secrets in set_(read|write)_state, but that was
somewhat annoying, so I've left it just before the call for now.

There is one TLS 1.3 state transition which doesn't carry an encryption
level: switching from 0-RTT keys back to unencrypted on an HRR-based
0-RTT reject. The TCP code doesn't care about write_level and the QUIC
code is currently fine because we never "install" the 0-RTT keys. But we
should get this correct.

This also opens the door for DTLS 1.3, if we ever implement it, because
DTLS 1.3 will need to know which level it is to handle 0-RTT keys funny.
(Clients sending 0-RTT will briefly have handshake and 0-RTT write keys
active simultaneously.)

QUIC has the same property, but we can fudge it because only the caller
is aware of this.

Change-Id: Ia76d787e1b96a058d9818948b6d9a051e8592207
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40124
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-02-24 22:16:24 +00:00
Shelley Vohr 6432bb46ab Add ECDSA_SIG_get0_r and ECDSA_SIG_get0_s. 
OpenSSL 1.1.1 added some more convenient versions of ECDSA_SIG_get0.
Node.js uses them.

Change-Id: I425e8a0c2e43c34130f30d902090b839f1a67186
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40044
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-18 22:08:35 +00:00
Adam Langley 472d91c39c Fix a couple of comment typos. 
Thanks to Tobias Thierer for pointing these out.

(No semantic change.)

Change-Id: Ia191da6353a11b090201adf813e2ca271acaff2e
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40104
Commit-Queue: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-18 20:36:28 +00:00
David Benjamin a12a2497ff Const-correct various X509_NAME APIs. 
Half of them were marked const and half weren't.

Change-Id: Ia9135f743b06f07aafac8655ded84d01e59cf481
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39764
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-17 17:46:12 +00:00
Adam Langley 7940ed1f30 Ignore old -enable-ed25519 flag. 
Change 1766935f76 removed this flag but it's useful if bssl_shim ignores
it to reduce noise in cross-version testing. This can be dropped in
three months once the old versions have aged out.

Change-Id: I73f2bebeb5e8c178253fbb6915026e06b6ad58bc
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40084
Commit-Queue: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-14 23:50:28 +00:00
Adam Langley f1efbc8f8b Provide __NR_getrandom fillins in urandom test too. 
The urandom test added in 3e502c84f0 assumed that __NR_getrandom was
defined by the system's headers, but urandom.c doesn't. This change
pulls the fills for that system call into a common header that's used by
both.

Change-Id: I71c3b9bfa69c34b320e724a4c977cd63163cbdec
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40067
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-02-14 19:14:38 +00:00
David Benjamin aadb46369a Skip RSATest.DISABLED_BlindingCacheConcurrency in SDE. 
The SDE bot has started developing flakes with that many threads.
(Unclear if it is due to SDE or running too many copies of the test
in parallel.)

Change-Id: I0081b6d75882b946bdccee5405dc688d0035d565
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40066
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-14 18:39:56 +00:00
David Benjamin 754d4c99c8 Fix client handling of 0-RTT rejects with cipher mismatch. 
Servers can only accept 0-RTT if the ciphers match. If they reject
0-RTT, however, they may change the cipher suite and even the PRF hash.
This is tricky, however, because the 0-RTT accept or reject signal comes
in EncryptedExtensions, which is *after* the new cipher suite is
installed. (Although a client could infer 0-RTT is rejected based on the
cipher suite if it wanted.)

While we correctly handled the PRF hash switch, we get the cipher suite
mixed up due to dependency on SSL_get_session and incorrectly decrypt
EncryptedExtensions. Fix this and add some tests.

Change-Id: Ia20f2ed665cf601d30a38f0c8d4786c4c111019f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40005
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-02-14 17:20:17 +00:00
David Benjamin 83ea777db5 runner: Tidy up 0-RTT support. 
earlyCipherSuite is a remnant of early exporters, which we've since
removed. Also runner should perform the cipher suite matching check for
0-RTT.

Change-Id: Ia6dc2ff6cf7072d94820e8755acd555037c557f1
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40004
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-02-14 16:44:37 +00:00
David Benjamin 0dc70e462c Add X509_getm_notBefore and X509_getm_notAfter. 
This functions were added in OpenSSL 1.1.0.

Change-Id: I1ee78ba124534d6e3e47edf75c0b4fed51388a6e
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40024
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-14 16:06:40 +00:00
David Benjamin 0c30649ba6 Clean up TLS 1.3 handback logic. 
There's no need to treat the 1-RTT and 0-RTT handback flows differently.
This aligns the 1-RTT handback with the 0-RTT point. This consistently
installs the decryption keys in the state machine after handback rather
than while applying the handback.

Update-Note: This changes the serialization format for TLS 1.3 split
handshakes, which were only just added.

Change-Id: I0e109cb8d9ecd3c8658dfa26059cbe0139f82eed
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39988
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Matt Braithwaite <mab@google.com>
 2020-02-13 19:57:57 +00:00
David Benjamin f9cc26f9c1 Require handshake flights end at record boundaries. 
The TLS handshake runs over a sequence of messages, serialized onto a
stream, which is then packetized into records, with no correlation to
message boundaries.

TLS messages may span records, so a TLS implementation will buffer up
excess data in a record for the next message. If not checked, that next
message may a round-trip or even a key change later. Carrying data
across a key change has security consequences, so we reject any excess
data across key changes (see ChangeCipherSpec synchronization tests and
(d)tls_set_read_state). However, we do not currently check it across
network round trips that do not change keys.

For instance, a TLS 1.2 client may pack part of ClientKeyExchange (the
first byte, at least, is deterministic) into the ClientHello record,
before even receiving ServerHello. Most TLS implementations will accept
this.

However, the handback logic does *not* serialize excess data in hs_buf.
There shouldn't be any, but if the peer is doing strange things as
above, that data will get silently dropped. The way TLS 1.3 0-RTT
handback logic works (the key isn't installed until after handback),
this data is even silently dropped though there is a key change.

To keep all our behavior consistent, check for unprocessed handshake
data at the end of each flight and reject it. Add a bunch of tests.

Update-Note: If the peer packs data across handshake flights, or packs
HelloRequest into the same record as Finished, this will now be an
error. (The former is pathologically odd behavior. The latter is also
rejected by Schannel and also odd.)

Change-Id: I9412bbdea09ee7fdcfeb78d3456329505a190641
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39987
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-13 19:30:40 +00:00
David Benjamin 21a879a78a Delete unreachable DTLS check. 
It is impossible for us to have an unconsumed ChangeCipherSpec message
in dtls_has_unprocessed_handshake_data.
dtls_has_unprocessed_handshake_data is only called in
dtls1_set_read_state and, in DTLS 1.2 and earlier, we only ever switch
the cipher state immediately after consuming ChangeCipherSpec.

Remove this because later commits will check
has_unprocessed_handshake_data in more places and we have a test
(StrayChangeCipherSpec) which asserts we do tolerate arbitrarily early
ChangeCipherSpecs messages.

There may be something to be said for rejecting this (the peer would
have to be doing something weird and sending ChangeCipherSpec in the
wrong flight), but ChangeCipherSpec in DTLS is predictable and
informationless, so this is probably not worth worrying about.

Change-Id: I1bc2952c0ba5231a7f962b9f7ca4c63271ec079f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39986
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-11 21:47:07 +00:00
David Benjamin 82a4b2234e Rename TLS-specific functions to tls_foo from ssl3_foo. 
Some of the TLS-specific functions begin with ssl3_, otherwise with
tls_. Align on tls_ since we don't implement SSL 3.0 anymore. (Plain ssl_
means common to TLS and DTLS, which is an odd backronym, but SSL_foo for
the APIs are thoroughly stuck.)

Change-Id: Ib7acffd21ee370bb9bed46789fb511d00fac24ca
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39985
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-11 21:38:53 +00:00
David Benjamin f6cc8ddf52 Rename ssl3_choose_cipher. 
We don't support SSL 3.0 anymore. It's also file-local, so it can be
choose_cipher.

Change-Id: Idab96496eda69c7fd906aa788ac26e8d30c317d5
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39984
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-11 21:37:39 +00:00
Matthew Braithwaite 8f299d5e03 SSL_apply_handback: don't choke on trailing data. 
It may be useful for future extensibility.

Change-Id: I415095140367a44a2c8dd636998721399232c400
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39964
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-02-11 01:14:36 +00:00
Matthew Braithwaite 4f3e8212ea ssl_test: test early data with split handshakes. 
This helps to clarify where SSL_set_early_data_enabled() needs to be
called: in the shim tests it was being set everywhere, which concealed
the fact that the |enable_early_data| bit was not being set by
SSL_apply_handback().

Change-Id: I35bfdc6dd43f4fa07ef79eb02e4624b59fcdda5e
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39385
Commit-Queue: Matt Braithwaite <mab@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-10 21:19:46 +00:00
Adam Langley 7964a1d676 Check for overflow in massive mallocs. 
Hopefully it never happens, but a malloc of nearly the whole address
space should fail cleanly.

Change-Id: I82499e3236a1a485f5518b1c048899b1df3e8488
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39864
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-10 17:43:35 +00:00
David Benjamin 7e43e2e8ee Add more convenient RSA getters. 
OpenSSL 1.1.0's RSA getters can be inconvenient because they return a number of
fields via output parameters. OpenSSL 1.1.1 adds individual getters for each of
the fields, which is a bit simpler. Align with them.

Note our OPENSSL_VERSION_NUMBER is still 1.1.0. Adding these functions may
cause friction with third-party packages which polyfill these functions based
on OPENSSL_VERSION_NUMBER, though none appear to be doing this right now.
Between this and TLS 1.3, we probably should switch the version to 1.1.1 at
some point anyway.

Change-Id: Iada5a0315c403cc221688af53fc4ba165d65e99c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39944
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-07 19:36:22 +00:00
David Benjamin 1766935f76 Remove SSL_CTX_set_ed25519_enabled. 
We never ended up using this, and callers can still configure
SSL_CTX_set_verify_algorithm_prefs to enable Ed25519 on the receiving
side. (On the sending side, this API was never needed because it's a
function of what certificate you configure.) This was just a way to
tweak the default without requiring callers restate the order.

Change-Id: I38d7f91d85430f37fc7e278d77466e78a0cbfa0d
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39848
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-06 23:54:44 +00:00
David Benjamin 6ab75bf21f Improve signature algorithm tests. 
ecdsa_sha1 and ecdsa_secp521_sha512 are disabled by default but a caller
could still enable them by configuring the verify preferences. Improve
the tests to distinguish these cases better. Also, as this is getting
unwieldy, cut down on duplicated code between the client and server
signatures.

Change-Id: I1530f4cb43d8e9d675f7fdc4693034287fcac153
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39847
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-02-06 20:02:23 +00:00
Adam Langley 2a4ce17243 bazel: explicitly load C++ rules 
Starting with Bazel 3.0, C++ rules will require loads. See
https://github.com/bazelbuild/bazel/issues/8743

Thanks to Yannic Bonenberger for noting this in
https://boringssl-review.googlesource.com/c/boringssl/+/39825

Change-Id: I8e274c82ade6c7ec569989026190f6a0a88b47ed
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39924
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-06 19:15:03 +00:00
Adam Langley fbea9de163 Check enum values in handoff. 
Casting an out-of-range value to an enum is undefined behaviour in C.

Bug: oss-fuzz:20546
Change-Id: I11c6bc533b898430bd791e3cdcb271943b95c101
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39904
Commit-Queue: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-06 18:24:43 +00:00
David Benjamin 921bb9e224 Restore fuzz/cert_corpus. 
This was accidentally deleted in https://boringssl-review.googlesource.com/c/boringssl/+/39805

Change-Id: Iba1ee7b03e0e531a4aa86ec6c048523d87bd2c72
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39884
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-06 17:55:42 +00:00
David Benjamin bf17f4f6f1 Add a -sigalgs option to bssl client. 
Change-Id: I6247e02c6a9a9cc6ff5005eafe96f89f864cb12c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39846
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-02-06 00:53:13 +00:00
David Benjamin f0a815cce5 Add SSL_set_verify_algorithm_prefs. 
We already had the state for it, but no API. This will allow us to
configure the signature preferences individually per socket in Chromium
and get a better measurement for how often SHA-1 in TLS 1.2 is still
needed. See associated bug for details.

Bug: chromium:658905
Change-Id: Id6198afc91f8275492995992e03d75a7ff328909
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39845
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-06 00:43:12 +00:00
David Benjamin ebad508ef1 Switch verify sigalg pref functions to SSL_HANDSHAKE. 
Functions that take SSL* do not necessarily have an ssl->config
available because it is released post-handshake, whereas hs->config can
be accessed without a null check.

Change-Id: I3d9f3838c1f2d79f92beac363a90fb6046671053
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39844
Reviewed-by: Adam Langley <agl@google.com>
 2020-02-05 23:21:08 +00:00
David Schinazi 10165d82c1 Add SSL_AD_NO_APPLICATION_PROTOCOL 
This is based on AGL's comment on
https://boringssl-review.googlesource.com/c/boringssl/+/39784

Change-Id: I3204a64084288a2c025bc3e4c769a153126a1f9f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39785
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
 2020-02-05 14:36:02 +00:00
Matthew Braithwaite 3d53d1ffe6 Refresh corpora due to TLS 1.3 changes in handoff serialization. 
Along the way, update |refresh_ssl_corpora.sh| to use the right
handshaker path.

How to:

(rm -rf build-fuzz && mkdir build-fuzz && cd build-fuzz && CC=clang CXX=clang++ cmake -GNinja -DFUZZ=1 .. && ninja all)

(rm -rf build-no-fuzzer-mode && mkdir build-no-fuzzer-mode && cd build-no-fuzzer-mode && CC=clang CXX=clang++ cmake -GNinja -DFUZZ=1 -DNO_FUZZER_MODE=1 .. && ninja all)

(cd ~/boringssl/fuzz && ../fuzz/refresh_ssl_corpora.sh ../build-fuzz ../build-no-fuzzer-mode ) 2>&1 | tee /tmp/refresh-log

Change-Id: I1115dfe45d25bd74ace1048c80d614afb26223ee
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39805
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Matt Braithwaite <mab@google.com>
 2020-02-05 00:34:02 +00:00
Matthew Braithwaite 9e23361aa0 handoff: set |enable_early_data| as part of handback. 
This doesn't change the serialization: it just adds
|enable_early_data| to the list of early data fields that get updated
by SSL_apply_handback().

This is needed because, for example, add_new_session_tickets(), which
runs after handback, performs certain actions iff |enable_early_data|
is set.  Plus it just seems cleaner.

Change-Id: Ibcdb745ff9bcbeb2af2475f69f9f798937e7ee63
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39804
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Matt Braithwaite <mab@google.com>
 2020-02-04 22:14:27 +00:00
David Schinazi 032fc660bc Add 109 and 120 to SSL_alert_desc_string_long 
Change-Id: Ie50fcbabec73bf14895c4eaba134409e010679c4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39784
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-04 16:41:56 +00:00
Matthew Braithwaite 6192ccbbfd runner: enable split handshake tests for TLS 1.3. 
Although the new tests are enabled by default, there is a flag to
(continue to) skip them.  This is to allow for inter-version
compatibility testing to be performed without a monstrous number of
failures from old versions that don't yet have TLS 1.3 support.

Change-Id: I9f5e201a21f775442859e127c906b5f77ad8755b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39388
Commit-Queue: Matt Braithwaite <mab@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-04 00:02:33 +00:00
Matthew Braithwaite f3c98ce9b7 Make TLS 1.3 split handshakes work with early data. 
Change-Id: Ib051447a4bdde4e08e84e54ec619d47535bb472c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39384
Commit-Queue: Matt Braithwaite <mab@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-02-03 22:54:43 +00:00
Matthew Braithwaite 093a823923 Split half-RTT tickets out into a separate TLS 1.3 state. 
This is prefactoring to allow a split handshake to be handed back
prior to sending the half-RTT ticket.

Change-Id: Ib5c335b3109a024391c2ec2cab0749eae43f4646
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39744
Commit-Queue: Matt Braithwaite <mab@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
 2020-01-29 20:40:05 +00:00
Augusto Righetto bc7e2cb92d Use BCryptGenRandom when building as Windows UWP app. 
RtlGenRandom is a legacy API that might be altered and is unavailable
for UWP apps. BCryptGenRandom is the recommended API for generating
random numbers on UWP.

This change causes BCryptGenRandom to be used for UWP apps and
RtlGenRandom to be used on non-UWP apps (i.e. desktop apps). For non-UWP
configurations, RtlGenRandom is used instead of BCryptGenRandom to avoid
accessing resources that may be unavailable inside the Chromium sandbox.

Bug: 307
Change-Id: I49f445198b7b4f300a752f45e221a2875d17099e
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39584
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
 2020-01-28 16:27:53 +00:00
5800 changed files with 34580 additions and 282224 deletions
Expand all files Collapse all files
.clang-format
+11
View File
@@ -0,0 +1,11 @@
BasedOnStyle: Google
MaxEmptyLinesToKeep: 3
AllowShortIfStatementsOnASingleLine: false
AllowShortLoopsOnASingleLine: false
DerivePointerAlignment: false
PointerAlignment: Right
# TODO(davidben): The default for Google style is now Regroup, but the default
# IncludeCategories does not recognize <openssl/header.h>. We should
# reconfigure IncludeCategories to match. For now, keep it at Preserve.
IncludeBlocks: Preserve
src/.gitignore → .gitignore
View File
src/API-CONVENTIONS.md → API-CONVENTIONS.md
View File
src/BREAKING-CHANGES.md → BREAKING-CHANGES.md
View File
BUILD
-165
View File
@@ -1,165 +0,0 @@
# Copyright (c) 2016, Google Inc.
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
licenses(["notice"])
exports_files(["LICENSE"])
load(
":BUILD.generated.bzl",
"crypto_headers",
"crypto_internal_headers",
"crypto_sources",
"crypto_sources_linux_x86_64",
"crypto_sources_linux_ppc64le",
"crypto_sources_mac_x86_64",
"fips_fragments",
"ssl_headers",
"ssl_internal_headers",
"ssl_sources",
"tool_sources",
"tool_headers",
)
config_setting(
name = "linux_x86_64",
values = {"cpu": "k8"},
)
config_setting(
name = "linux_ppc64le",
values = {"cpu": "ppc"},
)
config_setting(
name = "mac_x86_64",
values = {"cpu": "darwin"},
)
config_setting(
name = "windows_x86_64",
values = {"cpu": "x64_windows"},
)
config_setting(
name = "android",
values = {"crosstool_top": "//external:android/crosstool"}
)
posix_copts = [
# Assembler option --noexecstack adds .note.GNU-stack to each object to
# ensure that binaries can be built with non-executable stack.
"-Wa,--noexecstack",
# This is needed on Linux systems (at least) to get rwlock in pthread.
"-D_XOPEN_SOURCE=700",
# This list of warnings should match those in the top-level CMakeLists.txt.
"-Wall",
"-Werror",
"-Wformat=2",
"-Wsign-compare",
"-Wmissing-field-initializers",
"-Wwrite-strings",
"-Wshadow",
"-fno-common",
# Modern build environments should be able to set this to use atomic
# operations for reference counting rather than locks. However, it's
# known not to work on some Android builds.
# "-DOPENSSL_C11_ATOMIC",
]
boringssl_copts = select({
":linux_x86_64": posix_copts,
":linux_ppc64le": posix_copts,
":mac_x86_64": posix_copts,
":windows_x86_64": [
"-DWIN32_LEAN_AND_MEAN",
"-DOPENSSL_NO_ASM",
],
"//conditions:default": ["-DOPENSSL_NO_ASM"],
})
crypto_sources_asm = select({
":linux_x86_64": crypto_sources_linux_x86_64,
":linux_ppc64le": crypto_sources_linux_ppc64le,
":mac_x86_64": crypto_sources_mac_x86_64,
"//conditions:default": [],
})
# For C targets only (not C++), compile with C11 support.
posix_copts_c11 = [
"-std=c11",
"-Wmissing-prototypes",
"-Wold-style-definition",
"-Wstrict-prototypes",
]
boringssl_copts_c11 = boringssl_copts + select({
":linux_x86_64": posix_copts_c11,
":linux_ppc64le": posix_copts_c11,
":mac_x86_64": posix_copts_c11,
"//conditions:default": [],
})
# For C++ targets only (not C), compile with C++11 support.
posix_copts_cxx = [
"-std=c++11",
"-Wmissing-declarations",
]
boringssl_copts_cxx = boringssl_copts + select({
":linux_x86_64": posix_copts_cxx,
":linux_ppc64le": posix_copts_cxx,
":mac_x86_64": posix_copts_cxx,
"//conditions:default": [],
})
cc_library(
name = "crypto",
srcs = crypto_sources + crypto_internal_headers + crypto_sources_asm,
hdrs = crypto_headers + fips_fragments,
copts = boringssl_copts_c11,
includes = ["src/include"],
linkopts = select({
":mac_x86_64": [],
# Android supports pthreads, but does not provide a libpthread
# to link against.
":android": [],
":windows_x86_64": ["-defaultlib:advapi32.lib"],
"//conditions:default": ["-lpthread"],
}),
visibility = ["//visibility:public"],
)
cc_library(
name = "ssl",
srcs = ssl_sources + ssl_internal_headers,
hdrs = ssl_headers,
copts = boringssl_copts_cxx,
includes = ["src/include"],
visibility = ["//visibility:public"],
deps = [
":crypto",
],
)
cc_binary(
name = "bssl",
srcs = tool_sources + tool_headers,
copts = boringssl_copts_cxx,
visibility = ["//visibility:public"],
deps = [":ssl"],
)
BUILD.generated.bzl
-678
View File
@@ -1,678 +0,0 @@
# This file is created by generate_build_files.py. Do not edit manually.
ssl_headers = [
"src/include/openssl/dtls1.h",
"src/include/openssl/srtp.h",
"src/include/openssl/ssl.h",
"src/include/openssl/ssl3.h",
"src/include/openssl/tls1.h",
]
fips_fragments = [
"src/crypto/fipsmodule/aes/aes.c",
"src/crypto/fipsmodule/aes/aes_nohw.c",
"src/crypto/fipsmodule/aes/key_wrap.c",
"src/crypto/fipsmodule/aes/mode_wrappers.c",
"src/crypto/fipsmodule/bn/add.c",
"src/crypto/fipsmodule/bn/asm/x86_64-gcc.c",
"src/crypto/fipsmodule/bn/bn.c",
"src/crypto/fipsmodule/bn/bytes.c",
"src/crypto/fipsmodule/bn/cmp.c",
"src/crypto/fipsmodule/bn/ctx.c",
"src/crypto/fipsmodule/bn/div.c",
"src/crypto/fipsmodule/bn/div_extra.c",
"src/crypto/fipsmodule/bn/exponentiation.c",
"src/crypto/fipsmodule/bn/gcd.c",
"src/crypto/fipsmodule/bn/gcd_extra.c",
"src/crypto/fipsmodule/bn/generic.c",
"src/crypto/fipsmodule/bn/jacobi.c",
"src/crypto/fipsmodule/bn/montgomery.c",
"src/crypto/fipsmodule/bn/montgomery_inv.c",
"src/crypto/fipsmodule/bn/mul.c",
"src/crypto/fipsmodule/bn/prime.c",
"src/crypto/fipsmodule/bn/random.c",
"src/crypto/fipsmodule/bn/rsaz_exp.c",
"src/crypto/fipsmodule/bn/shift.c",
"src/crypto/fipsmodule/bn/sqrt.c",
"src/crypto/fipsmodule/cipher/aead.c",
"src/crypto/fipsmodule/cipher/cipher.c",
"src/crypto/fipsmodule/cipher/e_aes.c",
"src/crypto/fipsmodule/cipher/e_des.c",
"src/crypto/fipsmodule/des/des.c",
"src/crypto/fipsmodule/digest/digest.c",
"src/crypto/fipsmodule/digest/digests.c",
"src/crypto/fipsmodule/ec/ec.c",
"src/crypto/fipsmodule/ec/ec_key.c",
"src/crypto/fipsmodule/ec/ec_montgomery.c",
"src/crypto/fipsmodule/ec/felem.c",
"src/crypto/fipsmodule/ec/oct.c",
"src/crypto/fipsmodule/ec/p224-64.c",
"src/crypto/fipsmodule/ec/p256-x86_64.c",
"src/crypto/fipsmodule/ec/scalar.c",
"src/crypto/fipsmodule/ec/simple.c",
"src/crypto/fipsmodule/ec/simple_mul.c",
"src/crypto/fipsmodule/ec/util.c",
"src/crypto/fipsmodule/ec/wnaf.c",
"src/crypto/fipsmodule/ecdh/ecdh.c",
"src/crypto/fipsmodule/ecdsa/ecdsa.c",
"src/crypto/fipsmodule/hmac/hmac.c",
"src/crypto/fipsmodule/md4/md4.c",
"src/crypto/fipsmodule/md5/md5.c",
"src/crypto/fipsmodule/modes/cbc.c",
"src/crypto/fipsmodule/modes/cfb.c",
"src/crypto/fipsmodule/modes/ctr.c",
"src/crypto/fipsmodule/modes/gcm.c",
"src/crypto/fipsmodule/modes/gcm_nohw.c",
"src/crypto/fipsmodule/modes/ofb.c",
"src/crypto/fipsmodule/modes/polyval.c",
"src/crypto/fipsmodule/rand/ctrdrbg.c",
"src/crypto/fipsmodule/rand/rand.c",
"src/crypto/fipsmodule/rand/urandom.c",
"src/crypto/fipsmodule/rsa/blinding.c",
"src/crypto/fipsmodule/rsa/padding.c",
"src/crypto/fipsmodule/rsa/rsa.c",
"src/crypto/fipsmodule/rsa/rsa_impl.c",
"src/crypto/fipsmodule/self_check/self_check.c",
"src/crypto/fipsmodule/sha/sha1-altivec.c",
"src/crypto/fipsmodule/sha/sha1.c",
"src/crypto/fipsmodule/sha/sha256.c",
"src/crypto/fipsmodule/sha/sha512.c",
"src/crypto/fipsmodule/tls/kdf.c",
"src/third_party/fiat/p256.c",
]
ssl_internal_headers = [
"src/ssl/internal.h",
]
ssl_sources = [
"src/ssl/bio_ssl.cc",
"src/ssl/d1_both.cc",
"src/ssl/d1_lib.cc",
"src/ssl/d1_pkt.cc",
"src/ssl/d1_srtp.cc",
"src/ssl/dtls_method.cc",
"src/ssl/dtls_record.cc",
"src/ssl/handoff.cc",
"src/ssl/handshake.cc",
"src/ssl/handshake_client.cc",
"src/ssl/handshake_server.cc",
"src/ssl/s3_both.cc",
"src/ssl/s3_lib.cc",
"src/ssl/s3_pkt.cc",
"src/ssl/ssl_aead_ctx.cc",
"src/ssl/ssl_asn1.cc",
"src/ssl/ssl_buffer.cc",
"src/ssl/ssl_cert.cc",
"src/ssl/ssl_cipher.cc",
"src/ssl/ssl_file.cc",
"src/ssl/ssl_key_share.cc",
"src/ssl/ssl_lib.cc",
"src/ssl/ssl_privkey.cc",
"src/ssl/ssl_session.cc",
"src/ssl/ssl_stat.cc",
"src/ssl/ssl_transcript.cc",
"src/ssl/ssl_versions.cc",
"src/ssl/ssl_x509.cc",
"src/ssl/t1_enc.cc",
"src/ssl/t1_lib.cc",
"src/ssl/tls13_both.cc",
"src/ssl/tls13_client.cc",
"src/ssl/tls13_enc.cc",
"src/ssl/tls13_server.cc",
"src/ssl/tls_method.cc",
"src/ssl/tls_record.cc",
]
crypto_headers = [
"src/include/openssl/aead.h",
"src/include/openssl/aes.h",
"src/include/openssl/arm_arch.h",
"src/include/openssl/asn1.h",
"src/include/openssl/asn1_mac.h",
"src/include/openssl/asn1t.h",
"src/include/openssl/base.h",
"src/include/openssl/base64.h",
"src/include/openssl/bio.h",
"src/include/openssl/blowfish.h",
"src/include/openssl/bn.h",
"src/include/openssl/buf.h",
"src/include/openssl/buffer.h",
"src/include/openssl/bytestring.h",
"src/include/openssl/cast.h",
"src/include/openssl/chacha.h",
"src/include/openssl/cipher.h",
"src/include/openssl/cmac.h",
"src/include/openssl/conf.h",
"src/include/openssl/cpu.h",
"src/include/openssl/crypto.h",
"src/include/openssl/curve25519.h",
"src/include/openssl/des.h",
"src/include/openssl/dh.h",
"src/include/openssl/digest.h",
"src/include/openssl/dsa.h",
"src/include/openssl/e_os2.h",
"src/include/openssl/ec.h",
"src/include/openssl/ec_key.h",
"src/include/openssl/ecdh.h",
"src/include/openssl/ecdsa.h",
"src/include/openssl/engine.h",
"src/include/openssl/err.h",
"src/include/openssl/evp.h",
"src/include/openssl/ex_data.h",
"src/include/openssl/hkdf.h",
"src/include/openssl/hmac.h",
"src/include/openssl/hrss.h",
"src/include/openssl/is_boringssl.h",
"src/include/openssl/lhash.h",
"src/include/openssl/md4.h",
"src/include/openssl/md5.h",
"src/include/openssl/mem.h",
"src/include/openssl/nid.h",
"src/include/openssl/obj.h",
"src/include/openssl/obj_mac.h",
"src/include/openssl/objects.h",
"src/include/openssl/opensslconf.h",
"src/include/openssl/opensslv.h",
"src/include/openssl/ossl_typ.h",
"src/include/openssl/pem.h",
"src/include/openssl/pkcs12.h",
"src/include/openssl/pkcs7.h",
"src/include/openssl/pkcs8.h",
"src/include/openssl/poly1305.h",
"src/include/openssl/pool.h",
"src/include/openssl/rand.h",
"src/include/openssl/rc4.h",
"src/include/openssl/ripemd.h",
"src/include/openssl/rsa.h",
"src/include/openssl/safestack.h",
"src/include/openssl/sha.h",
"src/include/openssl/siphash.h",
"src/include/openssl/span.h",
"src/include/openssl/stack.h",
"src/include/openssl/thread.h",
"src/include/openssl/type_check.h",
"src/include/openssl/x509.h",
"src/include/openssl/x509_vfy.h",
"src/include/openssl/x509v3.h",
]
crypto_internal_headers = [
"src/crypto/asn1/asn1_locl.h",
"src/crypto/bio/internal.h",
"src/crypto/bytestring/internal.h",
"src/crypto/chacha/internal.h",
"src/crypto/cipher_extra/internal.h",
"src/crypto/conf/conf_def.h",
"src/crypto/conf/internal.h",
"src/crypto/cpu-arm-linux.h",
"src/crypto/err/internal.h",
"src/crypto/evp/internal.h",
"src/crypto/fipsmodule/aes/internal.h",
"src/crypto/fipsmodule/bn/internal.h",
"src/crypto/fipsmodule/bn/rsaz_exp.h",
"src/crypto/fipsmodule/cipher/internal.h",
"src/crypto/fipsmodule/delocate.h",
"src/crypto/fipsmodule/des/internal.h",
"src/crypto/fipsmodule/digest/internal.h",
"src/crypto/fipsmodule/digest/md32_common.h",
"src/crypto/fipsmodule/ec/internal.h",
"src/crypto/fipsmodule/ec/p256-x86_64-table.h",
"src/crypto/fipsmodule/ec/p256-x86_64.h",
"src/crypto/fipsmodule/md5/internal.h",
"src/crypto/fipsmodule/modes/internal.h",
"src/crypto/fipsmodule/rand/internal.h",
"src/crypto/fipsmodule/rsa/internal.h",
"src/crypto/fipsmodule/sha/internal.h",
"src/crypto/fipsmodule/tls/internal.h",
"src/crypto/hrss/internal.h",
"src/crypto/internal.h",
"src/crypto/obj/obj_dat.h",
"src/crypto/pkcs7/internal.h",
"src/crypto/pkcs8/internal.h",
"src/crypto/poly1305/internal.h",
"src/crypto/pool/internal.h",
"src/crypto/x509/charmap.h",
"src/crypto/x509/internal.h",
"src/crypto/x509/vpm_int.h",
"src/crypto/x509v3/ext_dat.h",
"src/crypto/x509v3/internal.h",
"src/crypto/x509v3/pcy_int.h",
"src/third_party/fiat/curve25519_32.h",
"src/third_party/fiat/curve25519_64.h",
"src/third_party/fiat/curve25519_tables.h",
"src/third_party/fiat/internal.h",
"src/third_party/fiat/p256_32.h",
"src/third_party/fiat/p256_64.h",
]
crypto_sources = [
"err_data.c",
"src/crypto/asn1/a_bitstr.c",
"src/crypto/asn1/a_bool.c",
"src/crypto/asn1/a_d2i_fp.c",
"src/crypto/asn1/a_dup.c",
"src/crypto/asn1/a_enum.c",
"src/crypto/asn1/a_gentm.c",
"src/crypto/asn1/a_i2d_fp.c",
"src/crypto/asn1/a_int.c",
"src/crypto/asn1/a_mbstr.c",
"src/crypto/asn1/a_object.c",
"src/crypto/asn1/a_octet.c",
"src/crypto/asn1/a_print.c",
"src/crypto/asn1/a_strnid.c",
"src/crypto/asn1/a_time.c",
"src/crypto/asn1/a_type.c",
"src/crypto/asn1/a_utctm.c",
"src/crypto/asn1/a_utf8.c",
"src/crypto/asn1/asn1_lib.c",
"src/crypto/asn1/asn1_par.c",
"src/crypto/asn1/asn_pack.c",
"src/crypto/asn1/f_enum.c",
"src/crypto/asn1/f_int.c",
"src/crypto/asn1/f_string.c",
"src/crypto/asn1/tasn_dec.c",
"src/crypto/asn1/tasn_enc.c",
"src/crypto/asn1/tasn_fre.c",
"src/crypto/asn1/tasn_new.c",
"src/crypto/asn1/tasn_typ.c",
"src/crypto/asn1/tasn_utl.c",
"src/crypto/asn1/time_support.c",
"src/crypto/base64/base64.c",
"src/crypto/bio/bio.c",
"src/crypto/bio/bio_mem.c",
"src/crypto/bio/connect.c",
"src/crypto/bio/fd.c",
"src/crypto/bio/file.c",
"src/crypto/bio/hexdump.c",
"src/crypto/bio/pair.c",
"src/crypto/bio/printf.c",
"src/crypto/bio/socket.c",
"src/crypto/bio/socket_helper.c",
"src/crypto/bn_extra/bn_asn1.c",
"src/crypto/bn_extra/convert.c",
"src/crypto/buf/buf.c",
"src/crypto/bytestring/asn1_compat.c",
"src/crypto/bytestring/ber.c",
"src/crypto/bytestring/cbb.c",
"src/crypto/bytestring/cbs.c",
"src/crypto/bytestring/unicode.c",
"src/crypto/chacha/chacha.c",
"src/crypto/cipher_extra/cipher_extra.c",
"src/crypto/cipher_extra/derive_key.c",
"src/crypto/cipher_extra/e_aesccm.c",
"src/crypto/cipher_extra/e_aesctrhmac.c",
"src/crypto/cipher_extra/e_aesgcmsiv.c",
"src/crypto/cipher_extra/e_chacha20poly1305.c",
"src/crypto/cipher_extra/e_null.c",
"src/crypto/cipher_extra/e_rc2.c",
"src/crypto/cipher_extra/e_rc4.c",
"src/crypto/cipher_extra/e_tls.c",
"src/crypto/cipher_extra/tls_cbc.c",
"src/crypto/cmac/cmac.c",
"src/crypto/conf/conf.c",
"src/crypto/cpu-aarch64-fuchsia.c",
"src/crypto/cpu-aarch64-linux.c",
"src/crypto/cpu-arm-linux.c",
"src/crypto/cpu-arm.c",
"src/crypto/cpu-intel.c",
"src/crypto/cpu-ppc64le.c",
"src/crypto/crypto.c",
"src/crypto/curve25519/spake25519.c",
"src/crypto/dh/check.c",
"src/crypto/dh/dh.c",
"src/crypto/dh/dh_asn1.c",
"src/crypto/dh/params.c",
"src/crypto/digest_extra/digest_extra.c",
"src/crypto/dsa/dsa.c",
"src/crypto/dsa/dsa_asn1.c",
"src/crypto/ec_extra/ec_asn1.c",
"src/crypto/ec_extra/ec_derive.c",
"src/crypto/ecdh_extra/ecdh_extra.c",
"src/crypto/ecdsa_extra/ecdsa_asn1.c",
"src/crypto/engine/engine.c",
"src/crypto/err/err.c",
"src/crypto/evp/digestsign.c",
"src/crypto/evp/evp.c",
"src/crypto/evp/evp_asn1.c",
"src/crypto/evp/evp_ctx.c",
"src/crypto/evp/p_dsa_asn1.c",
"src/crypto/evp/p_ec.c",
"src/crypto/evp/p_ec_asn1.c",
"src/crypto/evp/p_ed25519.c",
"src/crypto/evp/p_ed25519_asn1.c",
"src/crypto/evp/p_rsa.c",
"src/crypto/evp/p_rsa_asn1.c",
"src/crypto/evp/p_x25519.c",
"src/crypto/evp/p_x25519_asn1.c",
"src/crypto/evp/pbkdf.c",
"src/crypto/evp/print.c",
"src/crypto/evp/scrypt.c",
"src/crypto/evp/sign.c",
"src/crypto/ex_data.c",
"src/crypto/fipsmodule/bcm.c",
"src/crypto/fipsmodule/fips_shared_support.c",
"src/crypto/fipsmodule/is_fips.c",
"src/crypto/hkdf/hkdf.c",
"src/crypto/hrss/hrss.c",
"src/crypto/lhash/lhash.c",
"src/crypto/mem.c",
"src/crypto/obj/obj.c",
"src/crypto/obj/obj_xref.c",
"src/crypto/pem/pem_all.c",
"src/crypto/pem/pem_info.c",
"src/crypto/pem/pem_lib.c",
"src/crypto/pem/pem_oth.c",
"src/crypto/pem/pem_pk8.c",
"src/crypto/pem/pem_pkey.c",
"src/crypto/pem/pem_x509.c",
"src/crypto/pem/pem_xaux.c",
"src/crypto/pkcs7/pkcs7.c",
"src/crypto/pkcs7/pkcs7_x509.c",
"src/crypto/pkcs8/p5_pbev2.c",
"src/crypto/pkcs8/pkcs8.c",
"src/crypto/pkcs8/pkcs8_x509.c",
"src/crypto/poly1305/poly1305.c",
"src/crypto/poly1305/poly1305_arm.c",
"src/crypto/poly1305/poly1305_vec.c",
"src/crypto/pool/pool.c",
"src/crypto/rand_extra/deterministic.c",
"src/crypto/rand_extra/forkunsafe.c",
"src/crypto/rand_extra/fuchsia.c",
"src/crypto/rand_extra/rand_extra.c",
"src/crypto/rand_extra/windows.c",
"src/crypto/rc4/rc4.c",
"src/crypto/refcount_c11.c",
"src/crypto/refcount_lock.c",
"src/crypto/rsa_extra/rsa_asn1.c",
"src/crypto/rsa_extra/rsa_print.c",
"src/crypto/siphash/siphash.c",
"src/crypto/stack/stack.c",
"src/crypto/thread.c",
"src/crypto/thread_none.c",
"src/crypto/thread_pthread.c",
"src/crypto/thread_win.c",
"src/crypto/x509/a_digest.c",
"src/crypto/x509/a_sign.c",
"src/crypto/x509/a_strex.c",
"src/crypto/x509/a_verify.c",
"src/crypto/x509/algorithm.c",
"src/crypto/x509/asn1_gen.c",
"src/crypto/x509/by_dir.c",
"src/crypto/x509/by_file.c",
"src/crypto/x509/i2d_pr.c",
"src/crypto/x509/rsa_pss.c",
"src/crypto/x509/t_crl.c",
"src/crypto/x509/t_req.c",
"src/crypto/x509/t_x509.c",
"src/crypto/x509/t_x509a.c",
"src/crypto/x509/x509.c",
"src/crypto/x509/x509_att.c",
"src/crypto/x509/x509_cmp.c",
"src/crypto/x509/x509_d2.c",
"src/crypto/x509/x509_def.c",
"src/crypto/x509/x509_ext.c",
"src/crypto/x509/x509_lu.c",
"src/crypto/x509/x509_obj.c",
"src/crypto/x509/x509_r2x.c",
"src/crypto/x509/x509_req.c",
"src/crypto/x509/x509_set.c",
"src/crypto/x509/x509_trs.c",
"src/crypto/x509/x509_txt.c",
"src/crypto/x509/x509_v3.c",
"src/crypto/x509/x509_vfy.c",
"src/crypto/x509/x509_vpm.c",
"src/crypto/x509/x509cset.c",
"src/crypto/x509/x509name.c",
"src/crypto/x509/x509rset.c",
"src/crypto/x509/x509spki.c",
"src/crypto/x509/x_algor.c",
"src/crypto/x509/x_all.c",
"src/crypto/x509/x_attrib.c",
"src/crypto/x509/x_crl.c",
"src/crypto/x509/x_exten.c",
"src/crypto/x509/x_info.c",
"src/crypto/x509/x_name.c",
"src/crypto/x509/x_pkey.c",
"src/crypto/x509/x_pubkey.c",
"src/crypto/x509/x_req.c",
"src/crypto/x509/x_sig.c",
"src/crypto/x509/x_spki.c",
"src/crypto/x509/x_val.c",
"src/crypto/x509/x_x509.c",
"src/crypto/x509/x_x509a.c",
"src/crypto/x509v3/pcy_cache.c",
"src/crypto/x509v3/pcy_data.c",
"src/crypto/x509v3/pcy_lib.c",
"src/crypto/x509v3/pcy_map.c",
"src/crypto/x509v3/pcy_node.c",
"src/crypto/x509v3/pcy_tree.c",
"src/crypto/x509v3/v3_akey.c",
"src/crypto/x509v3/v3_akeya.c",
"src/crypto/x509v3/v3_alt.c",
"src/crypto/x509v3/v3_bcons.c",
"src/crypto/x509v3/v3_bitst.c",
"src/crypto/x509v3/v3_conf.c",
"src/crypto/x509v3/v3_cpols.c",
"src/crypto/x509v3/v3_crld.c",
"src/crypto/x509v3/v3_enum.c",
"src/crypto/x509v3/v3_extku.c",
"src/crypto/x509v3/v3_genn.c",
"src/crypto/x509v3/v3_ia5.c",
"src/crypto/x509v3/v3_info.c",
"src/crypto/x509v3/v3_int.c",
"src/crypto/x509v3/v3_lib.c",
"src/crypto/x509v3/v3_ncons.c",
"src/crypto/x509v3/v3_ocsp.c",
"src/crypto/x509v3/v3_pci.c",
"src/crypto/x509v3/v3_pcia.c",
"src/crypto/x509v3/v3_pcons.c",
"src/crypto/x509v3/v3_pku.c",
"src/crypto/x509v3/v3_pmaps.c",
"src/crypto/x509v3/v3_prn.c",
"src/crypto/x509v3/v3_purp.c",
"src/crypto/x509v3/v3_skey.c",
"src/crypto/x509v3/v3_sxnet.c",
"src/crypto/x509v3/v3_utl.c",
"src/third_party/fiat/curve25519.c",
]
tool_sources = [
"src/tool/args.cc",
"src/tool/ciphers.cc",
"src/tool/client.cc",
"src/tool/const.cc",
"src/tool/digest.cc",
"src/tool/file.cc",
"src/tool/generate_ed25519.cc",
"src/tool/genrsa.cc",
"src/tool/pkcs12.cc",
"src/tool/rand.cc",
"src/tool/server.cc",
"src/tool/sign.cc",
"src/tool/speed.cc",
"src/tool/tool.cc",
"src/tool/transport_common.cc",
]
tool_headers = [
"src/tool/internal.h",
"src/tool/transport_common.h",
]
crypto_sources_ios_aarch64 = [
"ios-aarch64/crypto/chacha/chacha-armv8.S",
"ios-aarch64/crypto/fipsmodule/aesv8-armx64.S",
"ios-aarch64/crypto/fipsmodule/armv8-mont.S",
"ios-aarch64/crypto/fipsmodule/ghash-neon-armv8.S",
"ios-aarch64/crypto/fipsmodule/ghashv8-armx64.S",
"ios-aarch64/crypto/fipsmodule/sha1-armv8.S",
"ios-aarch64/crypto/fipsmodule/sha256-armv8.S",
"ios-aarch64/crypto/fipsmodule/sha512-armv8.S",
"ios-aarch64/crypto/fipsmodule/vpaes-armv8.S",
"ios-aarch64/crypto/test/trampoline-armv8.S",
]
crypto_sources_ios_arm = [
"ios-arm/crypto/chacha/chacha-armv4.S",
"ios-arm/crypto/fipsmodule/aesv8-armx32.S",
"ios-arm/crypto/fipsmodule/armv4-mont.S",
"ios-arm/crypto/fipsmodule/bsaes-armv7.S",
"ios-arm/crypto/fipsmodule/ghash-armv4.S",
"ios-arm/crypto/fipsmodule/ghashv8-armx32.S",
"ios-arm/crypto/fipsmodule/sha1-armv4-large.S",
"ios-arm/crypto/fipsmodule/sha256-armv4.S",
"ios-arm/crypto/fipsmodule/sha512-armv4.S",
"ios-arm/crypto/fipsmodule/vpaes-armv7.S",
"ios-arm/crypto/test/trampoline-armv4.S",
]
crypto_sources_linux_aarch64 = [
"linux-aarch64/crypto/chacha/chacha-armv8.S",
"linux-aarch64/crypto/fipsmodule/aesv8-armx64.S",
"linux-aarch64/crypto/fipsmodule/armv8-mont.S",
"linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S",
"linux-aarch64/crypto/fipsmodule/ghashv8-armx64.S",
"linux-aarch64/crypto/fipsmodule/sha1-armv8.S",
"linux-aarch64/crypto/fipsmodule/sha256-armv8.S",
"linux-aarch64/crypto/fipsmodule/sha512-armv8.S",
"linux-aarch64/crypto/fipsmodule/vpaes-armv8.S",
"linux-aarch64/crypto/test/trampoline-armv8.S",
]
crypto_sources_linux_arm = [
"linux-arm/crypto/chacha/chacha-armv4.S",
"linux-arm/crypto/fipsmodule/aesv8-armx32.S",
"linux-arm/crypto/fipsmodule/armv4-mont.S",
"linux-arm/crypto/fipsmodule/bsaes-armv7.S",
"linux-arm/crypto/fipsmodule/ghash-armv4.S",
"linux-arm/crypto/fipsmodule/ghashv8-armx32.S",
"linux-arm/crypto/fipsmodule/sha1-armv4-large.S",
"linux-arm/crypto/fipsmodule/sha256-armv4.S",
"linux-arm/crypto/fipsmodule/sha512-armv4.S",
"linux-arm/crypto/fipsmodule/vpaes-armv7.S",
"linux-arm/crypto/test/trampoline-armv4.S",
"src/crypto/curve25519/asm/x25519-asm-arm.S",
"src/crypto/poly1305/poly1305_arm_asm.S",
]
crypto_sources_linux_ppc64le = [
"linux-ppc64le/crypto/fipsmodule/aesp8-ppc.S",
"linux-ppc64le/crypto/fipsmodule/ghashp8-ppc.S",
"linux-ppc64le/crypto/test/trampoline-ppc.S",
]
crypto_sources_linux_x86 = [
"linux-x86/crypto/chacha/chacha-x86.S",
"linux-x86/crypto/fipsmodule/aesni-x86.S",
"linux-x86/crypto/fipsmodule/bn-586.S",
"linux-x86/crypto/fipsmodule/co-586.S",
"linux-x86/crypto/fipsmodule/ghash-ssse3-x86.S",
"linux-x86/crypto/fipsmodule/ghash-x86.S",
"linux-x86/crypto/fipsmodule/md5-586.S",
"linux-x86/crypto/fipsmodule/sha1-586.S",
"linux-x86/crypto/fipsmodule/sha256-586.S",
"linux-x86/crypto/fipsmodule/sha512-586.S",
"linux-x86/crypto/fipsmodule/vpaes-x86.S",
"linux-x86/crypto/fipsmodule/x86-mont.S",
"linux-x86/crypto/test/trampoline-x86.S",
]
crypto_sources_linux_x86_64 = [
"linux-x86_64/crypto/chacha/chacha-x86_64.S",
"linux-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S",
"linux-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S",
"linux-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.S",
"linux-x86_64/crypto/fipsmodule/aesni-x86_64.S",
"linux-x86_64/crypto/fipsmodule/ghash-ssse3-x86_64.S",
"linux-x86_64/crypto/fipsmodule/ghash-x86_64.S",
"linux-x86_64/crypto/fipsmodule/md5-x86_64.S",
"linux-x86_64/crypto/fipsmodule/p256-x86_64-asm.S",
"linux-x86_64/crypto/fipsmodule/p256_beeu-x86_64-asm.S",
"linux-x86_64/crypto/fipsmodule/rdrand-x86_64.S",
"linux-x86_64/crypto/fipsmodule/rsaz-avx2.S",
"linux-x86_64/crypto/fipsmodule/sha1-x86_64.S",
"linux-x86_64/crypto/fipsmodule/sha256-x86_64.S",
"linux-x86_64/crypto/fipsmodule/sha512-x86_64.S",
"linux-x86_64/crypto/fipsmodule/vpaes-x86_64.S",
"linux-x86_64/crypto/fipsmodule/x86_64-mont.S",
"linux-x86_64/crypto/fipsmodule/x86_64-mont5.S",
"linux-x86_64/crypto/test/trampoline-x86_64.S",
"src/crypto/hrss/asm/poly_rq_mul.S",
]
crypto_sources_mac_x86 = [
"mac-x86/crypto/chacha/chacha-x86.S",
"mac-x86/crypto/fipsmodule/aesni-x86.S",
"mac-x86/crypto/fipsmodule/bn-586.S",
"mac-x86/crypto/fipsmodule/co-586.S",
"mac-x86/crypto/fipsmodule/ghash-ssse3-x86.S",
"mac-x86/crypto/fipsmodule/ghash-x86.S",
"mac-x86/crypto/fipsmodule/md5-586.S",
"mac-x86/crypto/fipsmodule/sha1-586.S",
"mac-x86/crypto/fipsmodule/sha256-586.S",
"mac-x86/crypto/fipsmodule/sha512-586.S",
"mac-x86/crypto/fipsmodule/vpaes-x86.S",
"mac-x86/crypto/fipsmodule/x86-mont.S",
"mac-x86/crypto/test/trampoline-x86.S",
]
crypto_sources_mac_x86_64 = [
"mac-x86_64/crypto/chacha/chacha-x86_64.S",
"mac-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.S",
"mac-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.S",
"mac-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.S",
"mac-x86_64/crypto/fipsmodule/aesni-x86_64.S",
"mac-x86_64/crypto/fipsmodule/ghash-ssse3-x86_64.S",
"mac-x86_64/crypto/fipsmodule/ghash-x86_64.S",
"mac-x86_64/crypto/fipsmodule/md5-x86_64.S",
"mac-x86_64/crypto/fipsmodule/p256-x86_64-asm.S",
"mac-x86_64/crypto/fipsmodule/p256_beeu-x86_64-asm.S",
"mac-x86_64/crypto/fipsmodule/rdrand-x86_64.S",
"mac-x86_64/crypto/fipsmodule/rsaz-avx2.S",
"mac-x86_64/crypto/fipsmodule/sha1-x86_64.S",
"mac-x86_64/crypto/fipsmodule/sha256-x86_64.S",
"mac-x86_64/crypto/fipsmodule/sha512-x86_64.S",
"mac-x86_64/crypto/fipsmodule/vpaes-x86_64.S",
"mac-x86_64/crypto/fipsmodule/x86_64-mont.S",
"mac-x86_64/crypto/fipsmodule/x86_64-mont5.S",
"mac-x86_64/crypto/test/trampoline-x86_64.S",
]
crypto_sources_win_x86 = [
"win-x86/crypto/chacha/chacha-x86.asm",
"win-x86/crypto/fipsmodule/aesni-x86.asm",
"win-x86/crypto/fipsmodule/bn-586.asm",
"win-x86/crypto/fipsmodule/co-586.asm",
"win-x86/crypto/fipsmodule/ghash-ssse3-x86.asm",
"win-x86/crypto/fipsmodule/ghash-x86.asm",
"win-x86/crypto/fipsmodule/md5-586.asm",
"win-x86/crypto/fipsmodule/sha1-586.asm",
"win-x86/crypto/fipsmodule/sha256-586.asm",
"win-x86/crypto/fipsmodule/sha512-586.asm",
"win-x86/crypto/fipsmodule/vpaes-x86.asm",
"win-x86/crypto/fipsmodule/x86-mont.asm",
"win-x86/crypto/test/trampoline-x86.asm",
]
crypto_sources_win_x86_64 = [
"win-x86_64/crypto/chacha/chacha-x86_64.asm",
"win-x86_64/crypto/cipher_extra/aes128gcmsiv-x86_64.asm",
"win-x86_64/crypto/cipher_extra/chacha20_poly1305_x86_64.asm",
"win-x86_64/crypto/fipsmodule/aesni-gcm-x86_64.asm",
"win-x86_64/crypto/fipsmodule/aesni-x86_64.asm",
"win-x86_64/crypto/fipsmodule/ghash-ssse3-x86_64.asm",
"win-x86_64/crypto/fipsmodule/ghash-x86_64.asm",
"win-x86_64/crypto/fipsmodule/md5-x86_64.asm",
"win-x86_64/crypto/fipsmodule/p256-x86_64-asm.asm",
"win-x86_64/crypto/fipsmodule/p256_beeu-x86_64-asm.asm",
"win-x86_64/crypto/fipsmodule/rdrand-x86_64.asm",
"win-x86_64/crypto/fipsmodule/rsaz-avx2.asm",
"win-x86_64/crypto/fipsmodule/sha1-x86_64.asm",
"win-x86_64/crypto/fipsmodule/sha256-x86_64.asm",
"win-x86_64/crypto/fipsmodule/sha512-x86_64.asm",
"win-x86_64/crypto/fipsmodule/vpaes-x86_64.asm",
"win-x86_64/crypto/fipsmodule/x86_64-mont.asm",
"win-x86_64/crypto/fipsmodule/x86_64-mont5.asm",
"win-x86_64/crypto/test/trampoline-x86_64.asm",
]
BUILD.generated_tests.bzl
-277
View File
@@ -1,277 +0,0 @@
# This file is created by generate_build_files.py. Do not edit manually.
test_support_sources = [
"src/crypto/asn1/asn1_locl.h",
"src/crypto/bio/internal.h",
"src/crypto/bytestring/internal.h",
"src/crypto/chacha/internal.h",
"src/crypto/cipher_extra/internal.h",
"src/crypto/conf/conf_def.h",
"src/crypto/conf/internal.h",
"src/crypto/cpu-arm-linux.h",
"src/crypto/err/internal.h",
"src/crypto/evp/internal.h",
"src/crypto/fipsmodule/aes/internal.h",
"src/crypto/fipsmodule/bn/internal.h",
"src/crypto/fipsmodule/bn/rsaz_exp.h",
"src/crypto/fipsmodule/cipher/internal.h",
"src/crypto/fipsmodule/delocate.h",
"src/crypto/fipsmodule/des/internal.h",
"src/crypto/fipsmodule/digest/internal.h",
"src/crypto/fipsmodule/digest/md32_common.h",
"src/crypto/fipsmodule/ec/internal.h",
"src/crypto/fipsmodule/ec/p256-x86_64-table.h",
"src/crypto/fipsmodule/ec/p256-x86_64.h",
"src/crypto/fipsmodule/md5/internal.h",
"src/crypto/fipsmodule/modes/internal.h",
"src/crypto/fipsmodule/rand/internal.h",
"src/crypto/fipsmodule/rsa/internal.h",
"src/crypto/fipsmodule/sha/internal.h",
"src/crypto/fipsmodule/tls/internal.h",
"src/crypto/hrss/internal.h",
"src/crypto/internal.h",
"src/crypto/obj/obj_dat.h",
"src/crypto/pkcs7/internal.h",
"src/crypto/pkcs8/internal.h",
"src/crypto/poly1305/internal.h",
"src/crypto/pool/internal.h",
"src/crypto/test/abi_test.h",
"src/crypto/test/file_test.cc",
"src/crypto/test/file_test.h",
"src/crypto/test/gtest_main.h",
"src/crypto/test/test_util.cc",
"src/crypto/test/test_util.h",
"src/crypto/test/wycheproof_util.cc",
"src/crypto/test/wycheproof_util.h",
"src/crypto/x509/charmap.h",
"src/crypto/x509/internal.h",
"src/crypto/x509/vpm_int.h",
"src/crypto/x509v3/ext_dat.h",
"src/crypto/x509v3/internal.h",
"src/crypto/x509v3/pcy_int.h",
"src/ssl/internal.h",
"src/ssl/test/async_bio.h",
"src/ssl/test/fuzzer.h",
"src/ssl/test/fuzzer_tags.h",
"src/ssl/test/handshake_util.h",
"src/ssl/test/mock_quic_transport.h",
"src/ssl/test/packeted_bio.h",
"src/ssl/test/settings_writer.h",
"src/ssl/test/test_config.h",
"src/ssl/test/test_state.h",
"src/third_party/fiat/curve25519_32.h",
"src/third_party/fiat/curve25519_64.h",
"src/third_party/fiat/curve25519_tables.h",
"src/third_party/fiat/internal.h",
"src/third_party/fiat/p256_32.h",
"src/third_party/fiat/p256_64.h",
]
crypto_test_sources = [
"crypto_test_data.cc",
"src/crypto/abi_self_test.cc",
"src/crypto/asn1/asn1_test.cc",
"src/crypto/base64/base64_test.cc",
"src/crypto/bio/bio_test.cc",
"src/crypto/buf/buf_test.cc",
"src/crypto/bytestring/bytestring_test.cc",
"src/crypto/chacha/chacha_test.cc",
"src/crypto/cipher_extra/aead_test.cc",
"src/crypto/cipher_extra/cipher_test.cc",
"src/crypto/cmac/cmac_test.cc",
"src/crypto/compiler_test.cc",
"src/crypto/constant_time_test.cc",
"src/crypto/cpu-arm-linux_test.cc",
"src/crypto/curve25519/ed25519_test.cc",
"src/crypto/curve25519/spake25519_test.cc",
"src/crypto/curve25519/x25519_test.cc",
"src/crypto/dh/dh_test.cc",
"src/crypto/digest_extra/digest_test.cc",
"src/crypto/dsa/dsa_test.cc",
"src/crypto/ecdh_extra/ecdh_test.cc",
"src/crypto/err/err_test.cc",
"src/crypto/evp/evp_extra_test.cc",
"src/crypto/evp/evp_test.cc",
"src/crypto/evp/pbkdf_test.cc",
"src/crypto/evp/scrypt_test.cc",
"src/crypto/fipsmodule/aes/aes_test.cc",
"src/crypto/fipsmodule/bn/bn_test.cc",
"src/crypto/fipsmodule/ec/ec_test.cc",
"src/crypto/fipsmodule/ec/p256-x86_64_test.cc",
"src/crypto/fipsmodule/ecdsa/ecdsa_test.cc",
"src/crypto/fipsmodule/md5/md5_test.cc",
"src/crypto/fipsmodule/modes/gcm_test.cc",
"src/crypto/fipsmodule/rand/ctrdrbg_test.cc",
"src/crypto/fipsmodule/sha/sha_test.cc",
"src/crypto/hkdf/hkdf_test.cc",
"src/crypto/hmac_extra/hmac_test.cc",
"src/crypto/hrss/hrss_test.cc",
"src/crypto/impl_dispatch_test.cc",
"src/crypto/lhash/lhash_test.cc",
"src/crypto/obj/obj_test.cc",
"src/crypto/pem/pem_test.cc",
"src/crypto/pkcs7/pkcs7_test.cc",
"src/crypto/pkcs8/pkcs12_test.cc",
"src/crypto/pkcs8/pkcs8_test.cc",
"src/crypto/poly1305/poly1305_test.cc",
"src/crypto/pool/pool_test.cc",
"src/crypto/rand_extra/rand_test.cc",
"src/crypto/refcount_test.cc",
"src/crypto/rsa_extra/rsa_test.cc",
"src/crypto/self_test.cc",
"src/crypto/siphash/siphash_test.cc",
"src/crypto/stack/stack_test.cc",
"src/crypto/test/abi_test.cc",
"src/crypto/test/file_test_gtest.cc",
"src/crypto/test/gtest_main.cc",
"src/crypto/thread_test.cc",
"src/crypto/x509/x509_test.cc",
"src/crypto/x509/x509_time_test.cc",
"src/crypto/x509v3/tab_test.cc",
"src/crypto/x509v3/v3name_test.cc",
]
ssl_test_sources = [
"src/crypto/test/abi_test.cc",
"src/crypto/test/gtest_main.cc",
"src/ssl/span_test.cc",
"src/ssl/ssl_c_test.c",
"src/ssl/ssl_test.cc",
]
crypto_test_data = [
"src/crypto/cipher_extra/test/aes_128_cbc_sha1_tls_implicit_iv_tests.txt",
"src/crypto/cipher_extra/test/aes_128_cbc_sha1_tls_tests.txt",
"src/crypto/cipher_extra/test/aes_128_cbc_sha256_tls_tests.txt",
"src/crypto/cipher_extra/test/aes_128_ccm_bluetooth_8_tests.txt",
"src/crypto/cipher_extra/test/aes_128_ccm_bluetooth_tests.txt",
"src/crypto/cipher_extra/test/aes_128_ctr_hmac_sha256.txt",
"src/crypto/cipher_extra/test/aes_128_gcm_siv_tests.txt",
"src/crypto/cipher_extra/test/aes_128_gcm_tests.txt",
"src/crypto/cipher_extra/test/aes_192_gcm_tests.txt",
"src/crypto/cipher_extra/test/aes_256_cbc_sha1_tls_implicit_iv_tests.txt",
"src/crypto/cipher_extra/test/aes_256_cbc_sha1_tls_tests.txt",
"src/crypto/cipher_extra/test/aes_256_cbc_sha256_tls_tests.txt",
"src/crypto/cipher_extra/test/aes_256_cbc_sha384_tls_tests.txt",
"src/crypto/cipher_extra/test/aes_256_ctr_hmac_sha256.txt",
"src/crypto/cipher_extra/test/aes_256_gcm_siv_tests.txt",
"src/crypto/cipher_extra/test/aes_256_gcm_tests.txt",
"src/crypto/cipher_extra/test/chacha20_poly1305_tests.txt",
"src/crypto/cipher_extra/test/cipher_tests.txt",
"src/crypto/cipher_extra/test/des_ede3_cbc_sha1_tls_implicit_iv_tests.txt",
"src/crypto/cipher_extra/test/des_ede3_cbc_sha1_tls_tests.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_128_cbc.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_128_ctr.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_128_gcm.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_192_cbc.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_192_ctr.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_256_cbc.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_256_ctr.txt",
"src/crypto/cipher_extra/test/nist_cavp/aes_256_gcm.txt",
"src/crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt",
"src/crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt",
"src/crypto/cipher_extra/test/xchacha20_poly1305_tests.txt",
"src/crypto/cmac/cavp_3des_cmac_tests.txt",
"src/crypto/cmac/cavp_aes128_cmac_tests.txt",
"src/crypto/cmac/cavp_aes192_cmac_tests.txt",
"src/crypto/cmac/cavp_aes256_cmac_tests.txt",
"src/crypto/curve25519/ed25519_tests.txt",
"src/crypto/ecdh_extra/ecdh_tests.txt",
"src/crypto/evp/evp_tests.txt",
"src/crypto/evp/scrypt_tests.txt",
"src/crypto/fipsmodule/aes/aes_tests.txt",
"src/crypto/fipsmodule/bn/bn_tests.txt",
"src/crypto/fipsmodule/bn/miller_rabin_tests.txt",
"src/crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt",
"src/crypto/fipsmodule/ec/p256-x86_64_tests.txt",
"src/crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt",
"src/crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
"src/crypto/fipsmodule/modes/gcm_tests.txt",
"src/crypto/fipsmodule/rand/ctrdrbg_vectors.txt",
"src/crypto/hmac_extra/hmac_tests.txt",
"src/crypto/poly1305/poly1305_tests.txt",
"src/crypto/siphash/siphash_tests.txt",
"src/crypto/x509/many_constraints.pem",
"src/crypto/x509/many_names1.pem",
"src/crypto/x509/many_names2.pem",
"src/crypto/x509/many_names3.pem",
"src/crypto/x509/some_names1.pem",
"src/crypto/x509/some_names2.pem",
"src/crypto/x509/some_names3.pem",
"src/third_party/wycheproof_testvectors/aes_cbc_pkcs5_test.txt",
"src/third_party/wycheproof_testvectors/aes_cmac_test.txt",
"src/third_party/wycheproof_testvectors/aes_gcm_siv_test.txt",
"src/third_party/wycheproof_testvectors/aes_gcm_test.txt",
"src/third_party/wycheproof_testvectors/chacha20_poly1305_test.txt",
"src/third_party/wycheproof_testvectors/dsa_test.txt",
"src/third_party/wycheproof_testvectors/ecdh_secp224r1_test.txt",
"src/third_party/wycheproof_testvectors/ecdh_secp256r1_test.txt",
"src/third_party/wycheproof_testvectors/ecdh_secp384r1_test.txt",
"src/third_party/wycheproof_testvectors/ecdh_secp521r1_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp224r1_sha224_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp224r1_sha256_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp224r1_sha512_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp256r1_sha256_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp256r1_sha512_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp384r1_sha384_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp384r1_sha512_test.txt",
"src/third_party/wycheproof_testvectors/ecdsa_secp521r1_sha512_test.txt",
"src/third_party/wycheproof_testvectors/eddsa_test.txt",
"src/third_party/wycheproof_testvectors/hkdf_sha1_test.txt",
"src/third_party/wycheproof_testvectors/hkdf_sha256_test.txt",
"src/third_party/wycheproof_testvectors/hkdf_sha384_test.txt",
"src/third_party/wycheproof_testvectors/hkdf_sha512_test.txt",
"src/third_party/wycheproof_testvectors/hmac_sha1_test.txt",
"src/third_party/wycheproof_testvectors/hmac_sha224_test.txt",
"src/third_party/wycheproof_testvectors/hmac_sha256_test.txt",
"src/third_party/wycheproof_testvectors/hmac_sha384_test.txt",
"src/third_party/wycheproof_testvectors/hmac_sha512_test.txt",
"src/third_party/wycheproof_testvectors/kw_test.txt",
"src/third_party/wycheproof_testvectors/kwp_test.txt",
"src/third_party/wycheproof_testvectors/primality_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha1_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha224_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha224_mgf1sha224_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha256_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha256_mgf1sha256_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha384_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha384_mgf1sha384_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha512_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_2048_sha512_mgf1sha512_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_3072_sha256_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_3072_sha256_mgf1sha256_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_3072_sha512_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_3072_sha512_mgf1sha512_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_4096_sha256_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_4096_sha256_mgf1sha256_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_4096_sha512_mgf1sha1_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_4096_sha512_mgf1sha512_test.txt",
"src/third_party/wycheproof_testvectors/rsa_oaep_misc_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pkcs1_2048_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pkcs1_3072_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pkcs1_4096_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pss_2048_sha1_mgf1_20_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pss_2048_sha256_mgf1_0_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pss_2048_sha256_mgf1_32_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pss_3072_sha256_mgf1_32_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pss_4096_sha256_mgf1_32_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pss_4096_sha512_mgf1_32_test.txt",
"src/third_party/wycheproof_testvectors/rsa_pss_misc_test.txt",
"src/third_party/wycheproof_testvectors/rsa_sig_gen_misc_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_2048_sha224_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_2048_sha256_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_2048_sha384_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_2048_sha512_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_3072_sha256_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_3072_sha384_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_3072_sha512_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_4096_sha384_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_4096_sha512_test.txt",
"src/third_party/wycheproof_testvectors/rsa_signature_test.txt",
"src/third_party/wycheproof_testvectors/x25519_test.txt",
"src/third_party/wycheproof_testvectors/xchacha20_poly1305_test.txt",
]
urandom_test_sources = [
"src/crypto/fipsmodule/rand/urandom_test.cc",
]
src/BUILDING.md → BUILDING.md
View File
CMakeLists.txt
+544 -559
View File
File diff suppressed because it is too large Load Diff
src/CONTRIBUTING.md → CONTRIBUTING.md
View File
src/FUZZING.md → FUZZING.md
View File
src/INCORPORATING.md → INCORPORATING.md
View File
src/PORTING.md → PORTING.md
View File
Package.swift
-3409
View File
File diff suppressed because it is too large Load Diff
src/README.md → README.md
+1
View File
@@ -39,3 +39,4 @@ There are other files in this directory which might be helpful:
* [FUZZING.md](/FUZZING.md): information about fuzzing BoringSSL.
* [CONTRIBUTING.md](/CONTRIBUTING.md): how to contribute to BoringSSL.
* [BREAKING-CHANGES.md](/BREAKING-CHANGES.md): notes on potentially-breaking changes.
* [SANDBOXING.md](/SANDBOXING.md): notes on using BoringSSL in a sandboxed environment.
SANDBOXING.md
+138
View File
@@ -0,0 +1,138 @@
# Using BoringSSL in a Sandbox
Sandboxes are a valuable tool for securing applications, so BoringSSL aims to
support them. However, it is difficult to make concrete API guarantees with
sandboxes. Sandboxes remove low-level OS resources and system calls, which
breaks platform abstractions. A syscall-filtering sandbox may, for instance, be
sensitive to otherwise non-breaking changes to use newer syscalls
in either BoringSSL or the C library.
Some functions in BoringSSL, such as `BIO_new_file`, inherently need OS
resources like the filesystem. We assume that sandboxed consumers either avoid
those functions or make necessary resources available. Other functions like
`RSA_sign` are purely computational, but still have some baseline OS
dependencies.
Sandboxes which drop privileges partway through a process's lifetime are
additionally sensitive to OS resources retained across the transitions. For
instance, if a library function internally opened and retained a handle to the
user's home directory, and then the application called `chroot`, that handle
would be a sandbox escape.
This document attempts to describe these baseline OS dependencies and long-lived
internal resources. These dependencies may change over time, but we aim to
[work with sandboxed consumers](/BREAKING-CHANGES.md) when they do. However,
each sandbox imposes different constraints, so, above all, sandboxed consumers
must have ample test coverage to detect issues as they arise.
## Baseline dependencies
Callers must assume that any BoringSSL function may perform one of the following
operations:
### Memory allocation
Any BoringSSL function may allocate memory via `malloc` and related functions.
### Thread synchronization
Any BoringSSL function may call into the platform's thread synchronization
primitives, including read/write locks and the equivalent of `pthread_once`.
These must succeed, or BoringSSL will abort the process. Callers, however, can
assume that BoringSSL functions will not spawn internal threads, unless
otherwise documented.
Syscall-filtering sandboxes should note that BoringSSL uses `pthread_rwlock_t`
on POSIX systems, which is less common and may not be part of other libraries'
syscall surface. Additionally, thread synchronization primitives usually have an
atomics-based fast path. If a sandbox blocks a necessary pthreads syscall, it
may not show up in testing without lock contention.
### Standard error
Any BoringSSL function may write to `stderr` or file descriptor
`STDERR_FILENO` (2), either via `FILE` APIs or low-level functions like `write`.
Writes to `stderr` may fail, but there must some file at `STDERR_FILENO` which
will tolerate error messages from BoringSSL. (The file descriptor must be
allocated so calls to `open` do not accidentally open something else there.)
Note some C standard library implementations also log to `stderr`, so callers
should ensure this regardless.
### Entropy
Any BoringSSL function may draw entropy from the OS. On Windows, this uses
`RtlGenRandom` and, on POSIX systems, this uses `getrandom`, `getentropy`, or a
`read` from a file descriptor to `/dev/urandom`. These operations must succeed
or BoringSSL will abort the process. BoringSSL only probes for `getrandom`
support once and assumes support is consistent for the lifetime of the address
space (and any copies made via `fork`). If a syscall-filtering sandbox is
enabled partway through this lifetime and changes whether `getrandom` works,
BoringSSL may abort the process. Sandboxes are recommended to allow
`getrandom`.
Note even deterministic algorithms may require OS entropy. For example,
RSASSA-PKCS1-v1_5 is deterministic, but BoringSSL draws entropy to implement
RSA blinding.
Entropy gathering additionally has some initialization dependencies described in
the following section.
## Initialization
BoringSSL has some uncommon OS dependencies which are only used once to
initialize some state. Sandboxes which drop privileges after some setup work may
use `CRYPTO_pre_sandbox_init` to initialize this state ahead of time. Otherwise,
callers must assume any BoringSSL function may depend on these resources, in
addition to the operations above.
### CPU capabilities
On Linux ARM platforms, BoringSSL depends on OS APIs to query CPU capabilities.
32-bit and 64-bit ARM both depend on the `getauxval` function. 32-bit ARM, to
work around bugs in older Android devices, may additionally read `/proc/cpuinfo`
and `/proc/self/auxv`.
If querying CPU capabilities fails, BoringSSL will still function, but may not
perform as well.
### Entropy
On Linux systems without a working `getrandom`, drawing entropy from the OS
additionally requires opening `/dev/urandom`. If this fails, BoringSSL will
abort the process. BoringSSL retains the resulting file descriptor, even across
privilege transitions.
### Fork protection
On Linux, BoringSSL allocates a page and calls `madvise` with `MADV_WIPEONFORK`
to protect single-use state from `fork`. This operation must not crash, but if
it fails, BoringSSL will use alternate fork-safety strategies, potentially at a
performance cost. If it succeeds, BoringSSL assumes `MADV_WIPEONFORK` is
functional and relies on it for fork-safety. Sandboxes must not report success
if they ignore the `MADV_WIPEONFORK` flag. As of writing, QEMU will ignore
`madvise` calls and report success, so BoringSSL detects this by calling
`madvise` with -1. Sandboxes must cleanly report an error instead of crashing.
Once initialized, this mechanism does not require system calls in the steady
state, though note the configured page will be inherited across privilege
transitions.
## C and C++ standard library
BoringSSL depends on the C and C++ standard libraries which, themselves, do not
make any guarantees about sandboxes. If it produces the correct answer and has
no observable invalid side effects, it is possible, though unreasonable, for
`memcmp` to create and close a socket.
BoringSSL assumes that functions in the C and C++ library only have the platform
dependencies which would be "reasonable". For instance, a function in BoringSSL
which aims not to open files will still freely call any libc memory and
string functions.
Note some C functions, such as `strerror`, may read files relating to the user's
locale. BoringSSL may trigger these paths and assumes the sandbox environment
will tolerate this. BoringSSL additionally cannot make guarantees about which
system calls are used by standard library's syscall wrappers. In some cases, the
compiler may add dependencies. (Some C++ language features emit locking code.)
Syscall-filtering sandboxes may need updates as these dependencies change.
src/STYLE.md → STYLE.md
View File
WORKSPACE
-1
View File
@@ -1 +0,0 @@
workspace(name = "boringssl")
src/codereview.settings → codereview.settings
View File
src/crypto/CMakeLists.txt → crypto/CMakeLists.txt
+10 -2
View File
@@ -184,6 +184,7 @@ add_custom_command(
err/pkcs8.errordata
err/rsa.errordata
err/ssl.errordata
err/trust_token.errordata
err/x509.errordata
err/x509v3.errordata
WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/err
@@ -262,6 +263,7 @@ add_library(
cpu-intel.c
cpu-ppc64le.c
crypto.c
curve25519/curve25519.c
curve25519/spake25519.c
dh/dh.c
dh/params.c
@@ -274,6 +276,7 @@ add_library(
ecdsa_extra/ecdsa_asn1.c
ec_extra/ec_asn1.c
ec_extra/ec_derive.c
ec_extra/hash_to_curve.c
err/err.c
err_data.c
engine/engine.c
@@ -296,6 +299,7 @@ add_library(
evp/sign.c
ex_data.c
hkdf/hkdf.c
hpke/hpke.c
hrss/hrss.c
lhash/lhash.c
mem.c
@@ -334,6 +338,8 @@ add_library(
thread_none.c
thread_pthread.c
thread_win.c
trust_token/pmbtoken.c
trust_token/trust_token.c
x509/a_digest.c
x509/a_sign.c
x509/a_strex.c
@@ -416,7 +422,6 @@ add_library(
x509v3/v3_skey.c
x509v3/v3_sxnet.c
x509v3/v3_utl.c
../third_party/fiat/curve25519.c
$<TARGET_OBJECTS:fipsmodule>
@@ -452,7 +457,7 @@ endif()
SET_TARGET_PROPERTIES(crypto PROPERTIES LINKER_LANGUAGE C)
if(NOT MSVC AND NOT ANDROID)
if(NOT WIN32 AND NOT ANDROID)
target_link_libraries(crypto pthread)
endif()
@@ -512,8 +517,10 @@ add_executable(
fipsmodule/md5/md5_test.cc
fipsmodule/modes/gcm_test.cc
fipsmodule/rand/ctrdrbg_test.cc
fipsmodule/rand/fork_detect_test.cc
fipsmodule/sha/sha_test.cc
hkdf/hkdf_test.cc
hpke/hpke_test.cc
hmac_extra/hmac_test.cc
hrss/hrss_test.cc
impl_dispatch_test.cc
@@ -533,6 +540,7 @@ add_executable(
siphash/siphash_test.cc
test/file_test_gtest.cc
thread_test.cc
trust_token/trust_token_test.cc
x509/x509_test.cc
x509/x509_time_test.cc
x509v3/tab_test.cc
src/crypto/abi_self_test.cc → crypto/abi_self_test.cc
View File
src/crypto/asn1/a_bitstr.c → crypto/asn1/a_bitstr.c
+3 -3
View File
@@ -70,7 +70,7 @@ int ASN1_BIT_STRING_set(ASN1_BIT_STRING *x, unsigned char *d, int len)
return M_ASN1_BIT_STRING_set(x, d, len);
}
int i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
int i2c_ASN1_BIT_STRING(const ASN1_BIT_STRING *a, unsigned char **pp)
{
int ret, j, bits, len;
unsigned char *p, *d;
@@ -233,7 +233,7 @@ int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
return (1);
}
int ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n)
int ASN1_BIT_STRING_get_bit(const ASN1_BIT_STRING *a, int n)
{
int w, v;
@@ -250,7 +250,7 @@ int ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n)
* which is not specified in 'flags', 1 otherwise.
* 'len' is the length of 'flags'.
*/
int ASN1_BIT_STRING_check(ASN1_BIT_STRING *a,
int ASN1_BIT_STRING_check(const ASN1_BIT_STRING *a,
unsigned char *flags, int flags_len)
{
int i, ok;
src/crypto/asn1/a_bool.c → crypto/asn1/a_bool.c
View File
src/crypto/asn1/a_d2i_fp.c → crypto/asn1/a_d2i_fp.c
View File
src/crypto/asn1/a_dup.c → crypto/asn1/a_dup.c
View File
src/crypto/asn1/a_enum.c → crypto/asn1/a_enum.c
+3 -3
View File
@@ -108,7 +108,7 @@ int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v)
return (1);
}
long ASN1_ENUMERATED_get(ASN1_ENUMERATED *a)
long ASN1_ENUMERATED_get(const ASN1_ENUMERATED *a)
{
int neg = 0, i;
@@ -147,7 +147,7 @@ long ASN1_ENUMERATED_get(ASN1_ENUMERATED *a)
return r;
}
ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(const BIGNUM *bn, ASN1_ENUMERATED *ai)
{
ASN1_ENUMERATED *ret;
int len, j;
@@ -183,7 +183,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
return (NULL);
}
BIGNUM *ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai, BIGNUM *bn)
BIGNUM *ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn)
{
BIGNUM *ret;
src/crypto/asn1/a_gentm.c → crypto/asn1/a_gentm.c
View File
src/crypto/asn1/a_i2d_fp.c → crypto/asn1/a_i2d_fp.c
View File
src/crypto/asn1/a_int.c → crypto/asn1/a_int.c
+1 -1
View File
@@ -115,7 +115,7 @@ int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y)
* followed by optional zeros isn't padded.
*/
int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
int i2c_ASN1_INTEGER(const ASN1_INTEGER *a, unsigned char **pp)
{
int pad = 0, ret, i, neg;
unsigned char *p, *n, pb = 0;
src/crypto/asn1/a_mbstr.c → crypto/asn1/a_mbstr.c
View File
src/crypto/asn1/a_object.c → crypto/asn1/a_object.c
+3 -3
View File
@@ -66,7 +66,7 @@
#include "../internal.h"
int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)
int i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp)
{
unsigned char *p, *allocated = NULL;
int objsize;
@@ -98,12 +98,12 @@ int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)
return objsize;
}
int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
int i2t_ASN1_OBJECT(char *buf, int buf_len, const ASN1_OBJECT *a)
{
return OBJ_obj2txt(buf, buf_len, a, 0);
}
int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT *a)
int i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a)
{
char buf[80], *p = buf;
int i;
src/crypto/asn1/a_octet.c → crypto/asn1/a_octet.c
View File
src/crypto/asn1/a_print.c → crypto/asn1/a_print.c
View File
src/crypto/asn1/a_strnid.c → crypto/asn1/a_strnid.c
View File
src/crypto/asn1/a_time.c → crypto/asn1/a_time.c
+2 -2
View File
@@ -100,7 +100,7 @@ ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t,
return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec);
}
int ASN1_TIME_check(ASN1_TIME *t)
int ASN1_TIME_check(const ASN1_TIME *t)
{
if (t->type == V_ASN1_GENERALIZEDTIME)
return ASN1_GENERALIZEDTIME_check(t);
@@ -110,7 +110,7 @@ int ASN1_TIME_check(ASN1_TIME *t)
}
/* Convert an ASN1_TIME structure to GeneralizedTime */
ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,
ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
ASN1_GENERALIZEDTIME **out)
{
ASN1_GENERALIZEDTIME *ret = NULL;
src/crypto/asn1/a_type.c → crypto/asn1/a_type.c
+1 -1
View File
@@ -61,7 +61,7 @@
#include <openssl/mem.h>
#include <openssl/obj.h>
int ASN1_TYPE_get(ASN1_TYPE *a)
int ASN1_TYPE_get(const ASN1_TYPE *a)
{
if ((a->value.ptr != NULL) || (a->type == V_ASN1_NULL))
return (a->type);
src/crypto/asn1/a_utctm.c → crypto/asn1/a_utctm.c
View File
src/crypto/asn1/a_utf8.c → crypto/asn1/a_utf8.c
View File
src/crypto/asn1/asn1_lib.c → crypto/asn1/asn1_lib.c
+1 -1
View File
@@ -430,7 +430,7 @@ void ASN1_STRING_length_set(ASN1_STRING *x, int len)
return;
}
int ASN1_STRING_type(ASN1_STRING *x)
int ASN1_STRING_type(const ASN1_STRING *x)
{
return M_ASN1_STRING_type(x);
}
src/crypto/asn1/asn1_locl.h → crypto/asn1/asn1_locl.h
View File
src/crypto/asn1/asn1_par.c → crypto/asn1/asn1_par.c
View File
src/crypto/asn1/asn1_test.cc → crypto/asn1/asn1_test.cc
+1 -1
View File
@@ -174,7 +174,7 @@ TEST(ASN1Test, SerializeObject) {
static const uint8_t kDER[] = {0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x01};
const ASN1_OBJECT *obj = OBJ_nid2obj(NID_rsaEncryption);
TestSerialize(const_cast<ASN1_OBJECT *>(obj), i2d_ASN1_OBJECT, kDER);
TestSerialize(obj, i2d_ASN1_OBJECT, kDER);
}
TEST(ASN1Test, SerializeBoolean) {
src/crypto/asn1/asn_pack.c → crypto/asn1/asn_pack.c
+1 -1
View File
@@ -93,7 +93,7 @@ ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_STRING **oct)
/* Extract an ASN1 object from an ASN1_STRING */
void *ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it)
void *ASN1_item_unpack(const ASN1_STRING *oct, const ASN1_ITEM *it)
{
const unsigned char *p;
void *ret;
src/crypto/asn1/charmap.pl → crypto/asn1/charmap.pl
View File
src/crypto/asn1/f_enum.c → crypto/asn1/f_enum.c
+1 -1
View File
@@ -60,7 +60,7 @@
/* Based on a_int.c: equivalent ENUMERATED functions */
int i2a_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *a)
int i2a_ASN1_ENUMERATED(BIO *bp, const ASN1_ENUMERATED *a)
{
int i, n = 0;
static const char *h = "0123456789ABCDEF";
src/crypto/asn1/f_int.c → crypto/asn1/f_int.c
+1 -1
View File
@@ -58,7 +58,7 @@
#include <openssl/bio.h>
int i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a)
int i2a_ASN1_INTEGER(BIO *bp, const ASN1_INTEGER *a)
{
int i, n = 0;
static const char *h = "0123456789ABCDEF";
src/crypto/asn1/f_string.c → crypto/asn1/f_string.c
+1 -1
View File
@@ -58,7 +58,7 @@
#include <openssl/bio.h>
int i2a_ASN1_STRING(BIO *bp, ASN1_STRING *a, int type)
int i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type)
{
int i, n = 0;
static const char *h = "0123456789ABCDEF";
src/crypto/asn1/tasn_dec.c → crypto/asn1/tasn_dec.c
View File
src/crypto/asn1/tasn_enc.c → crypto/asn1/tasn_enc.c
View File
src/crypto/asn1/tasn_fre.c → crypto/asn1/tasn_fre.c
View File
src/crypto/asn1/tasn_new.c → crypto/asn1/tasn_new.c
View File
src/crypto/asn1/tasn_typ.c → crypto/asn1/tasn_typ.c
View File
src/crypto/asn1/tasn_utl.c → crypto/asn1/tasn_utl.c
View File
src/crypto/asn1/time_support.c → crypto/asn1/time_support.c
View File
src/crypto/base64/base64.c → crypto/base64/base64.c
View File
src/crypto/base64/base64_test.cc → crypto/base64/base64_test.cc
View File
src/crypto/bio/bio.c → crypto/bio/bio.c
View File
src/crypto/bio/bio_mem.c → crypto/bio/bio_mem.c
View File
src/crypto/bio/bio_test.cc → crypto/bio/bio_test.cc
View File
src/crypto/bio/connect.c → crypto/bio/connect.c
View File
src/crypto/bio/fd.c → crypto/bio/fd.c
View File
src/crypto/bio/file.c → crypto/bio/file.c
View File
src/crypto/bio/hexdump.c → crypto/bio/hexdump.c
View File
src/crypto/bio/internal.h → crypto/bio/internal.h
View File
src/crypto/bio/pair.c → crypto/bio/pair.c
View File
src/crypto/bio/printf.c → crypto/bio/printf.c
View File
src/crypto/bio/socket.c → crypto/bio/socket.c
View File
src/crypto/bio/socket_helper.c → crypto/bio/socket_helper.c
View File
src/crypto/bn_extra/bn_asn1.c → crypto/bn_extra/bn_asn1.c
View File
src/crypto/bn_extra/convert.c → crypto/bn_extra/convert.c
View File
src/crypto/buf/buf.c → crypto/buf/buf.c
View File
src/crypto/buf/buf_test.cc → crypto/buf/buf_test.cc
View File
src/crypto/bytestring/asn1_compat.c → crypto/bytestring/asn1_compat.c
View File
src/crypto/bytestring/ber.c → crypto/bytestring/ber.c
View File
src/crypto/bytestring/bytestring_test.cc → crypto/bytestring/bytestring_test.cc
View File
src/crypto/bytestring/cbb.c → crypto/bytestring/cbb.c
View File
src/crypto/bytestring/cbs.c → crypto/bytestring/cbs.c
View File
src/crypto/bytestring/internal.h → crypto/bytestring/internal.h
View File
src/crypto/bytestring/unicode.c → crypto/bytestring/unicode.c
View File
src/crypto/chacha/asm/chacha-armv4.pl → crypto/chacha/asm/chacha-armv4.pl
View File
src/crypto/chacha/asm/chacha-armv8.pl → crypto/chacha/asm/chacha-armv8.pl
View File
src/crypto/chacha/asm/chacha-x86.pl → crypto/chacha/asm/chacha-x86.pl
View File
src/crypto/chacha/asm/chacha-x86_64.pl → crypto/chacha/asm/chacha-x86_64.pl
View File
src/crypto/chacha/chacha.c → crypto/chacha/chacha.c
View File
src/crypto/chacha/chacha_test.cc → crypto/chacha/chacha_test.cc
View File
src/crypto/chacha/internal.h → crypto/chacha/internal.h
View File
src/crypto/cipher_extra/aead_test.cc → crypto/cipher_extra/aead_test.cc
+86
View File
@@ -25,6 +25,7 @@
#include "../fipsmodule/cipher/internal.h"
#include "../internal.h"
#include "../test/abi_test.h"
#include "../test/file_test.h"
#include "../test/test_util.h"
#include "../test/wycheproof_util.h"
@@ -664,6 +665,91 @@ TEST_P(PerAEADTest, InvalidNonceLength) {
}
}
#if defined(SUPPORTS_ABI_TEST)
// CHECK_ABI can't pass enums, i.e. |evp_aead_seal| and |evp_aead_open|. Thus
// these two wrappers.
static int aead_ctx_init_for_seal(EVP_AEAD_CTX *ctx, const EVP_AEAD *aead,
const uint8_t *key, size_t key_len) {
return EVP_AEAD_CTX_init_with_direction(ctx, aead, key, key_len, 0,
evp_aead_seal);
}
static int aead_ctx_init_for_open(EVP_AEAD_CTX *ctx, const EVP_AEAD *aead,
const uint8_t *key, size_t key_len) {
return EVP_AEAD_CTX_init_with_direction(ctx, aead, key, key_len, 0,
evp_aead_open);
}
// CHECK_ABI can pass, at most, eight arguments. Thus these wrappers that
// figure out the output length from the input length, and take the nonce length
// from the configuration of the AEAD.
static int aead_ctx_seal(EVP_AEAD_CTX *ctx, uint8_t *out_ciphertext,
size_t *out_ciphertext_len, const uint8_t *nonce,
const uint8_t *plaintext, size_t plaintext_len,
const uint8_t *ad, size_t ad_len) {
const size_t nonce_len = EVP_AEAD_nonce_length(EVP_AEAD_CTX_aead(ctx));
return EVP_AEAD_CTX_seal(ctx, out_ciphertext, out_ciphertext_len,
plaintext_len + EVP_AEAD_MAX_OVERHEAD, nonce,
nonce_len, plaintext, plaintext_len, ad, ad_len);
}
static int aead_ctx_open(EVP_AEAD_CTX *ctx, uint8_t *out_plaintext,
size_t *out_plaintext_len, const uint8_t *nonce,
const uint8_t *ciphertext, size_t ciphertext_len,
const uint8_t *ad, size_t ad_len) {
const size_t nonce_len = EVP_AEAD_nonce_length(EVP_AEAD_CTX_aead(ctx));
return EVP_AEAD_CTX_open(ctx, out_plaintext, out_plaintext_len,
ciphertext_len, nonce, nonce_len, ciphertext,
ciphertext_len, ad, ad_len);
}
TEST_P(PerAEADTest, ABI) {
uint8_t key[EVP_AEAD_MAX_KEY_LENGTH];
OPENSSL_memset(key, 'K', sizeof(key));
const size_t key_len = EVP_AEAD_key_length(aead());
ASSERT_LE(key_len, sizeof(key));
bssl::ScopedEVP_AEAD_CTX ctx_seal;
ASSERT_TRUE(
CHECK_ABI(aead_ctx_init_for_seal, ctx_seal.get(), aead(), key, key_len));
bssl::ScopedEVP_AEAD_CTX ctx_open;
ASSERT_TRUE(
CHECK_ABI(aead_ctx_init_for_open, ctx_open.get(), aead(), key, key_len));
alignas(2) uint8_t plaintext[512];
OPENSSL_memset(plaintext, 'P', sizeof(plaintext));
alignas(2) uint8_t ad_buf[512];
OPENSSL_memset(ad_buf, 'A', sizeof(ad_buf));
const uint8_t *const ad = ad_buf + 1;
ASSERT_LE(GetParam().ad_len, sizeof(ad_buf) - 1);
const size_t ad_len =
GetParam().ad_len != 0 ? GetParam().ad_len : sizeof(ad_buf) - 1;
uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH];
const size_t nonce_len = EVP_AEAD_nonce_length(aead());
ASSERT_LE(nonce_len, sizeof(nonce));
alignas(2) uint8_t ciphertext[sizeof(plaintext) + EVP_AEAD_MAX_OVERHEAD + 1];
size_t ciphertext_len;
// Knock plaintext, ciphertext, and AD off alignment and give odd lengths for
// plaintext and AD. This hopefully triggers any edge-cases in the assembly.
ASSERT_TRUE(CHECK_ABI(aead_ctx_seal, ctx_seal.get(), ciphertext + 1,
&ciphertext_len, nonce, plaintext + 1,
sizeof(plaintext) - 1, ad, ad_len));
alignas(2) uint8_t plaintext2[sizeof(ciphertext) + 1];
size_t plaintext2_len;
ASSERT_TRUE(CHECK_ABI(aead_ctx_open, ctx_open.get(), plaintext2 + 1,
&plaintext2_len, nonce, ciphertext + 1, ciphertext_len,
ad, ad_len));
EXPECT_EQ(Bytes(plaintext + 1, sizeof(plaintext) - 1),
Bytes(plaintext2 + 1, plaintext2_len));
}
#endif // SUPPORTS_ABI_TEST
TEST(AEADTest, AESCCMLargeAD) {
static const std::vector<uint8_t> kKey(16, 'A');
static const std::vector<uint8_t> kNonce(13, 'N');
src/crypto/cipher_extra/asm/aes128gcmsiv-x86_64.pl → crypto/cipher_extra/asm/aes128gcmsiv-x86_64.pl
View File
src/crypto/cipher_extra/asm/chacha20_poly1305_x86_64.pl → crypto/cipher_extra/asm/chacha20_poly1305_x86_64.pl
+1 -1
View File
@@ -1273,7 +1273,7 @@ do_length_block:\n";
pop %rbp
.cfi_adjust_cfa_offset -8
ret
.cfi_adjust_cfa_offset (8 * 6) + 288 + 32
.cfi_adjust_cfa_offset (8 * 7) + 288 + 32
################################################################################
seal_sse_128:
movdqu .chacha20_consts(%rip), $A0\nmovdqa $A0, $A1\nmovdqa $A0, $A2
src/crypto/cipher_extra/cipher_extra.c → crypto/cipher_extra/cipher_extra.c
View File
src/crypto/cipher_extra/cipher_test.cc → crypto/cipher_extra/cipher_test.cc
+87
View File
@@ -61,8 +61,10 @@
#include <gtest/gtest.h>
#include <openssl/aes.h>
#include <openssl/cipher.h>
#include <openssl/err.h>
#include <openssl/nid.h>
#include <openssl/span.h>
#include "../test/file_test.h"
@@ -221,6 +223,91 @@ static void TestOperation(FileTest *t, const EVP_CIPHER *cipher, bool encrypt,
EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, tag.size(), rtag));
EXPECT_EQ(Bytes(tag), Bytes(rtag, tag.size()));
}
// Additionally test low-level AES mode APIs. Skip runs where |copy| because
// it does not apply.
if (!copy) {
int nid = EVP_CIPHER_nid(cipher);
bool is_ctr = nid == NID_aes_128_ctr || nid == NID_aes_192_ctr ||
nid == NID_aes_256_ctr;
bool is_cbc = nid == NID_aes_128_cbc || nid == NID_aes_192_cbc ||
nid == NID_aes_256_cbc;
bool is_ofb = nid == NID_aes_128_ofb128 || nid == NID_aes_192_ofb128 ||
nid == NID_aes_256_ofb128;
if (is_ctr || is_cbc || is_ofb) {
AES_KEY aes;
if (encrypt || !is_cbc) {
ASSERT_EQ(0, AES_set_encrypt_key(key.data(), key.size() * 8, &aes));
} else {
ASSERT_EQ(0, AES_set_decrypt_key(key.data(), key.size() * 8, &aes));
}
// The low-level APIs all work in-place.
bssl::Span<const uint8_t> input = *in;
result.clear();
if (in_place) {
result = *in;
input = result;
} else {
result.resize(out->size());
}
bssl::Span<uint8_t> output = bssl::MakeSpan(result);
ASSERT_EQ(input.size(), output.size());
// The low-level APIs all use block-size IVs.
ASSERT_EQ(iv.size(), size_t{AES_BLOCK_SIZE});
uint8_t ivec[AES_BLOCK_SIZE];
OPENSSL_memcpy(ivec, iv.data(), iv.size());
if (is_ctr) {
unsigned num = 0;
uint8_t ecount_buf[AES_BLOCK_SIZE];
if (chunk_size == 0) {
AES_ctr128_encrypt(input.data(), output.data(), input.size(), &aes,
ivec, ecount_buf, &num);
} else {
do {
size_t todo = std::min(input.size(), chunk_size);
AES_ctr128_encrypt(input.data(), output.data(), todo, &aes, ivec,
ecount_buf, &num);
input = input.subspan(todo);
output = output.subspan(todo);
} while (!input.empty());
}
EXPECT_EQ(Bytes(*out), Bytes(result));
} else if (is_cbc && chunk_size % AES_BLOCK_SIZE == 0) {
// Note |AES_cbc_encrypt| requires block-aligned chunks.
if (chunk_size == 0) {
AES_cbc_encrypt(input.data(), output.data(), input.size(), &aes, ivec,
encrypt);
} else {
do {
size_t todo = std::min(input.size(), chunk_size);
AES_cbc_encrypt(input.data(), output.data(), todo, &aes, ivec,
encrypt);
input = input.subspan(todo);
output = output.subspan(todo);
} while (!input.empty());
}
EXPECT_EQ(Bytes(*out), Bytes(result));
} else if (is_ofb) {
int num = 0;
if (chunk_size == 0) {
AES_ofb128_encrypt(input.data(), output.data(), input.size(), &aes,
ivec, &num);
} else {
do {
size_t todo = std::min(input.size(), chunk_size);
AES_ofb128_encrypt(input.data(), output.data(), todo, &aes, ivec,
&num);
input = input.subspan(todo);
output = output.subspan(todo);
} while (!input.empty());
}
EXPECT_EQ(Bytes(*out), Bytes(result));
}
}
}
}
static void TestCipher(FileTest *t) {
src/crypto/cipher_extra/derive_key.c → crypto/cipher_extra/derive_key.c
+1 -1
View File
@@ -86,7 +86,7 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
EVP_MD_CTX_init(&c);
for (;;) {
if (!EVP_DigestInit_ex(&c, md, NULL)) {
return 0;
goto err;
}
if (addmd++) {
if (!EVP_DigestUpdate(&c, md_buf, mds)) {
src/crypto/cipher_extra/e_aesccm.c → crypto/cipher_extra/e_aesccm.c
View File
src/crypto/cipher_extra/e_aesctrhmac.c → crypto/cipher_extra/e_aesctrhmac.c
View File
src/crypto/cipher_extra/e_aesgcmsiv.c → crypto/cipher_extra/e_aesgcmsiv.c
View File
src/crypto/cipher_extra/e_chacha20poly1305.c → crypto/cipher_extra/e_chacha20poly1305.c
View File
src/crypto/cipher_extra/e_null.c → crypto/cipher_extra/e_null.c
View File
src/crypto/cipher_extra/e_rc2.c → crypto/cipher_extra/e_rc2.c
View File
src/crypto/cipher_extra/e_rc4.c → crypto/cipher_extra/e_rc4.c
View File
src/crypto/cipher_extra/e_tls.c → crypto/cipher_extra/e_tls.c
View File

Some files were not shown because too many files have changed in this diff Show More