OERV-RUNTIME/boringssl
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update main-with-bazel from master branch

Browse Source
This commit is contained in:
BoringSSL Robot
2024-10-02 21:50:25 +00:00
parent 9eda0880c4 f8cadd8974
commit 1ea1b18bab
5 changed files with 43 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/crypto/bcm_support.h
+6
View File
@@ -17,6 +17,8 @@
#include <openssl/base.h>
#include <stdio.h>
// Provided by libcrypto, called from BCM
#if defined(__cplusplus)
@@ -105,6 +107,10 @@ OPENSSL_EXPORT uint64_t CRYPTO_get_fork_generation(void);
OPENSSL_EXPORT void CRYPTO_fork_detect_force_madv_wipeonfork_for_testing(
int on);
// CRYPTO_get_stderr returns stderr. This function exists to avoid BCM needing
// a data dependency on libc.
FILE *CRYPTO_get_stderr(void);
#if defined(__cplusplus)
} // extern C
src/crypto/crypto.c
+3
View File
@@ -15,6 +15,7 @@
#include <openssl/crypto.h>
#include <assert.h>
#include <stdio.h>
#include "fipsmodule/rand/internal.h"
#include "bcm_support.h"
@@ -186,3 +187,5 @@ int OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) {
}
void OPENSSL_cleanup(void) {}
FILE *CRYPTO_get_stderr(void) { return stderr; }
src/crypto/fipsmodule/bcm.c
+4 -3
View File
@@ -29,6 +29,7 @@
#include <openssl/sha.h>
#include "bcm_interface.h"
#include "../bcm_support.h"
#include "../internal.h"
// TODO(crbug.com/362530616): When delocate is removed, build these files as
@@ -136,7 +137,7 @@ static void assert_within(const void *start, const void *symbol,
}
fprintf(
stderr,
CRYPTO_get_stderr(),
"FIPS module doesn't span expected symbol. Expected %p <= %p < %p\n",
start, symbol, end);
BORINGSSL_FIPS_abort();
@@ -224,7 +225,7 @@ int BORINGSSL_integrity_test(void) {
HMAC_CTX_init(&hmac_ctx);
if (!HMAC_Init_ex(&hmac_ctx, kHMACKey, sizeof(kHMACKey), kHashFunction,
NULL /* no ENGINE */)) {
fprintf(stderr, "HMAC_Init_ex failed.\n");
fprintf(CRYPTO_get_stderr(), "HMAC_Init_ex failed.\n");
return 0;
}
@@ -244,7 +245,7 @@ int BORINGSSL_integrity_test(void) {
if (!HMAC_Final(&hmac_ctx, result, &result_len) ||
result_len != sizeof(result)) {
fprintf(stderr, "HMAC failed.\n");
fprintf(CRYPTO_get_stderr(), "HMAC failed.\n");
return 0;
}
HMAC_CTX_cleanse(&hmac_ctx); // FIPS 140-3, AS05.10.
src/crypto/fipsmodule/rand/rand.c.inc
+2 -2
View File
@@ -275,7 +275,7 @@ static void rand_get_seed(struct rand_thread_state *state,
// rate of failure is small enough not to be a problem in practice.
if (CRYPTO_memcmp(state->last_block, entropy, sizeof(state->last_block)) ==
0) {
fprintf(stderr, "CRNGT failed.\n");
fprintf(CRYPTO_get_stderr(), "CRNGT failed.\n");
BORINGSSL_FIPS_abort();
}
@@ -283,7 +283,7 @@ static void rand_get_seed(struct rand_thread_state *state,
for (size_t i = CRNGT_BLOCK_SIZE; i < entropy_len; i += CRNGT_BLOCK_SIZE) {
if (CRYPTO_memcmp(entropy + i - CRNGT_BLOCK_SIZE, entropy + i,
CRNGT_BLOCK_SIZE) == 0) {
fprintf(stderr, "CRNGT failed.\n");
fprintf(CRYPTO_get_stderr(), "CRNGT failed.\n");
BORINGSSL_FIPS_abort();
}
}
src/crypto/fipsmodule/self_check/self_check.c.inc
+28 -26
View File
@@ -32,6 +32,7 @@
#include <openssl/rsa.h>
#include <openssl/sha.h>
#include "../../bcm_support.h"
#include "../../internal.h"
#include "../delocate.h"
#include "../dh/internal.h"
@@ -53,21 +54,22 @@ int BORINGSSL_self_test(void) {
#else
static void hexdump(const uint8_t *in, size_t len) {
static void hexdump(FILE *out, const uint8_t *in, size_t len) {
for (size_t i = 0; i < len; i++) {
fprintf(stderr, "%02x", in[i]);
fprintf(out, "%02x", in[i]);
}
}
static int check_test(const void *expected, const void *actual,
size_t expected_len, const char *name) {
if (OPENSSL_memcmp(actual, expected, expected_len) != 0) {
fprintf(stderr, "%s failed.\nExpected: ", name);
hexdump(expected, expected_len);
fprintf(stderr, "\nCalculated: ");
hexdump(actual, expected_len);
fprintf(stderr, "\n");
fflush(stderr);
FILE *err = CRYPTO_get_stderr();
fprintf(err, "%s failed.\nExpected: ", name);
hexdump(err, expected, expected_len);
fprintf(err, "\nCalculated: ");
hexdump(err, actual, expected_len);
fprintf(err, "\n");
fflush(err);
return 0;
}
return 1;
@@ -294,7 +296,7 @@ static int boringssl_self_test_rsa(void) {
RSA *const rsa_key = self_test_rsa_key();
if (rsa_key == NULL) {
fprintf(stderr, "RSA key construction failed\n");
fprintf(CRYPTO_get_stderr(), "RSA key construction failed\n");
goto err;
}
// Disable blinding for the power-on tests because it's not needed and
@@ -338,7 +340,7 @@ static int boringssl_self_test_rsa(void) {
output, &sig_len, rsa_key) ||
!check_test(kRSASignSignature, output, sizeof(kRSASignSignature),
"RSA-sign KAT")) {
fprintf(stderr, "RSA signing test failed.\n");
fprintf(CRYPTO_get_stderr(), "RSA signing test failed.\n");
goto err;
}
@@ -376,7 +378,7 @@ static int boringssl_self_test_rsa(void) {
if (!rsa_verify_no_self_test(NID_sha256, kRSAVerifyDigest,
sizeof(kRSAVerifyDigest), kRSAVerifySignature,
sizeof(kRSAVerifySignature), rsa_key)) {
fprintf(stderr, "RSA-verify KAT failed.\n");
fprintf(CRYPTO_get_stderr(), "RSA-verify KAT failed.\n");
goto err;
}
@@ -397,7 +399,7 @@ static int boringssl_self_test_ecc(void) {
ec_key = self_test_ecdsa_key();
if (ec_key == NULL) {
fprintf(stderr, "ECDSA KeyGen failed\n");
fprintf(CRYPTO_get_stderr(), "ECDSA KeyGen failed\n");
goto err;
}
@@ -429,7 +431,7 @@ static int boringssl_self_test_ecc(void) {
sizeof(ecdsa_k)) ||
!check_test(kECDSASignSig, ecdsa_sign_output, sizeof(ecdsa_sign_output),
"ECDSA-sign signature")) {
fprintf(stderr, "ECDSA-sign KAT failed.\n");
fprintf(CRYPTO_get_stderr(), "ECDSA-sign KAT failed.\n");
goto err;
}
@@ -450,7 +452,7 @@ static int boringssl_self_test_ecc(void) {
if (!ecdsa_verify_fixed_no_self_test(
kECDSAVerifyDigest, sizeof(kECDSAVerifyDigest), kECDSAVerifySig,
sizeof(kECDSAVerifySig), ec_key)) {
fprintf(stderr, "ECDSA-verify KAT failed.\n");
fprintf(CRYPTO_get_stderr(), "ECDSA-verify KAT failed.\n");
goto err;
}
@@ -496,7 +498,7 @@ static int boringssl_self_test_ecc(void) {
z_comp_result, sizeof(z_comp_result), NULL) ||
!check_test(kP256PointResult, z_comp_result, sizeof(z_comp_result),
"Z Computation Result")) {
fprintf(stderr, "Z-computation KAT failed.\n");
fprintf(CRYPTO_get_stderr(), "Z-computation KAT failed.\n");
goto err;
}
@@ -575,7 +577,7 @@ static int boringssl_self_test_ffdh(void) {
dh_compute_key_padded_no_self_test(dh_out, ffdhe2048_value, dh) !=
sizeof(dh_out) ||
!check_test(kDHOutput, dh_out, sizeof(dh_out), "FFC DH")) {
fprintf(stderr, "FFDH failed.\n");
fprintf(CRYPTO_get_stderr(), "FFDH failed.\n");
goto err;
}
@@ -723,7 +725,7 @@ static int boringssl_self_test_fast(void) {
};
memcpy(aes_iv, kAESIV, sizeof(kAESIV));
if (AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) != 0) {
fprintf(stderr, "AES_set_encrypt_key failed.\n");
fprintf(CRYPTO_get_stderr(), "AES_set_encrypt_key failed.\n");
goto err;
}
AES_cbc_encrypt(kAESCBCEncPlaintext, output, sizeof(kAESCBCEncPlaintext),
@@ -746,7 +748,7 @@ static int boringssl_self_test_fast(void) {
};
memcpy(aes_iv, kAESIV, sizeof(kAESIV));
if (AES_set_decrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) != 0) {
fprintf(stderr, "AES_set_decrypt_key failed.\n");
fprintf(CRYPTO_get_stderr(), "AES_set_decrypt_key failed.\n");
goto err;
}
AES_cbc_encrypt(kAESCBCDecCiphertext, output, sizeof(kAESCBCDecCiphertext),
@@ -761,7 +763,7 @@ static int boringssl_self_test_fast(void) {
OPENSSL_memset(nonce, 0, sizeof(nonce));
if (!EVP_AEAD_CTX_init(&aead_ctx, EVP_aead_aes_128_gcm(), kAESKey,
sizeof(kAESKey), 0, NULL)) {
fprintf(stderr, "EVP_AEAD_CTX_init for AES-128-GCM failed.\n");
fprintf(CRYPTO_get_stderr(), "EVP_AEAD_CTX_init for AES-128-GCM failed.\n");
goto err;
}
@@ -783,7 +785,7 @@ static int boringssl_self_test_fast(void) {
0) ||
!check_test(kAESGCMCiphertext, output, sizeof(kAESGCMCiphertext),
"AES-GCM-encrypt KAT")) {
fprintf(stderr, "EVP_AEAD_CTX_seal for AES-128-GCM failed.\n");
fprintf(CRYPTO_get_stderr(), "EVP_AEAD_CTX_seal for AES-128-GCM failed.\n");
goto err;
}
@@ -806,7 +808,7 @@ static int boringssl_self_test_fast(void) {
NULL, 0) ||
!check_test(kAESGCMDecPlaintext, output, sizeof(kAESGCMDecPlaintext),
"AES-GCM-decrypt KAT")) {
fprintf(stderr,
fprintf(CRYPTO_get_stderr(),
"AES-GCM-decrypt KAT failed because EVP_AEAD_CTX_open failed.\n");
goto err;
}
@@ -875,7 +877,7 @@ static int boringssl_self_test_fast(void) {
sizeof(kDRBGAD)) ||
!check_test(kDRBGReseedOutput, output, sizeof(kDRBGReseedOutput),
"DRBG-reseed KAT")) {
fprintf(stderr, "CTR-DRBG failed.\n");
fprintf(CRYPTO_get_stderr(), "CTR-DRBG failed.\n");
goto err;
}
CTR_DRBG_clear(&drbg);
@@ -914,7 +916,7 @@ static int boringssl_self_test_fast(void) {
kTLSSeed2, sizeof(kTLSSeed2)) ||
!check_test(kTLS10Output, tls10_output, sizeof(kTLS10Output),
"TLS10-KDF KAT")) {
fprintf(stderr, "TLS KDF failed.\n");
fprintf(CRYPTO_get_stderr(), "TLS KDF failed.\n");
goto err;
}
@@ -935,7 +937,7 @@ static int boringssl_self_test_fast(void) {
kTLSSeed2, sizeof(kTLSSeed2)) ||
!check_test(kTLS12Output, tls12_output, sizeof(kTLS12Output),
"TLS12-KDF KAT")) {
fprintf(stderr, "TLS KDF failed.\n");
fprintf(CRYPTO_get_stderr(), "TLS KDF failed.\n");
goto err;
}
@@ -975,7 +977,7 @@ static int boringssl_self_test_fast(void) {
!check_test(kTLS13ExpandLabelOutput, tls13_expand_label_output,
sizeof(kTLS13ExpandLabelOutput),
"CRYPTO_tls13_hkdf_expand_label")) {
fprintf(stderr, "TLS13-KDF failed.\n");
fprintf(CRYPTO_get_stderr(), "TLS13-KDF failed.\n");
goto err;
}
@@ -1005,7 +1007,7 @@ static int boringssl_self_test_fast(void) {
sizeof(kHKDFSecret), kHKDFSalt, sizeof(kHKDFSalt), kHKDFInfo,
sizeof(kHKDFInfo)) ||
!check_test(kHKDFOutput, hkdf_output, sizeof(kHKDFOutput), "HKDF")) {
fprintf(stderr, "HKDF failed.\n");
fprintf(CRYPTO_get_stderr(), "HKDF failed.\n");
goto err;
}