grpc 1.53.2 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/crypto.c

@@ -14,20 +14,21 @@
 
 #include <openssl/crypto.h>
 
-#include <openssl/cpu.h>
+#include <assert.h>
 
 #include "fipsmodule/rand/fork_detect.h"
 #include "fipsmodule/rand/internal.h"
 #include "internal.h"
 
 
+static_assert(sizeof(ossl_ssize_t) == sizeof(size_t),
+              "ossl_ssize_t should be the same size as size_t");
+
 #if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_STATIC_ARMCAP) && \
-    (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) || \
-     defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64) || \
-     defined(OPENSSL_PPC64LE))
-// x86, x86_64, the ARMs and ppc64le need to record the result of a
-// cpuid/getauxval call for the asm to work correctly, unless compiled without
-// asm code.
+    (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) ||            \
+     defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64))
+// x86, x86_64, and the ARMs need to record the result of a cpuid/getauxval call
+// for the asm to work correctly, unless compiled without asm code.
 #define NEED_CPUID
 
 #else
@@ -38,8 +39,7 @@
 #define BORINGSSL_NO_STATIC_INITIALIZER
 #endif
 
-#endif  // !NO_ASM && !STATIC_ARMCAP &&
-        // (X86 || X86_64 || ARM || AARCH64 || PPC64LE)
+#endif  // !NO_ASM && !STATIC_ARMCAP && (X86 || X86_64 || ARM || AARCH64)
 
 
 // Our assembly does not use the GOT to reference symbols, which means
@@ -78,32 +78,37 @@ HIDDEN uint8_t BORINGSSL_function_hit[7] = {0};
 // This value must be explicitly initialized to zero. See similar comment above.
 HIDDEN uint32_t OPENSSL_ia32cap_P[4] = {0};
 
-#elif defined(OPENSSL_PPC64LE)
-
-HIDDEN unsigned long OPENSSL_ppc64le_hwcap2 = 0;
-
 #elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
 
 #include <openssl/arm_arch.h>
 
 #if defined(OPENSSL_STATIC_ARMCAP)
 
+// See ARM ACLE for the definitions of these macros. Note |__ARM_FEATURE_AES|
+// covers both AES and PMULL and |__ARM_FEATURE_SHA2| covers SHA-1 and SHA-256.
+// https://developer.arm.com/architectures/system-architectures/software-standards/acle
+// https://github.com/ARM-software/acle/issues/152
+//
+// TODO(davidben): Do we still need |OPENSSL_STATIC_ARMCAP_*| or are the
+// standard flags and -march sufficient?
 HIDDEN uint32_t OPENSSL_armcap_P =
-#if defined(OPENSSL_STATIC_ARMCAP_NEON) || \
-    (defined(__ARM_NEON__) || defined(__ARM_NEON))
+#if defined(OPENSSL_STATIC_ARMCAP_NEON) || defined(__ARM_NEON)
     ARMV7_NEON |
 #endif
-#if defined(OPENSSL_STATIC_ARMCAP_AES) || defined(__ARM_FEATURE_CRYPTO)
+#if defined(OPENSSL_STATIC_ARMCAP_AES) || defined(__ARM_FEATURE_AES)
     ARMV8_AES |
 #endif
-#if defined(OPENSSL_STATIC_ARMCAP_SHA1) || defined(__ARM_FEATURE_CRYPTO)
+#if defined(OPENSSL_STATIC_ARMCAP_PMULL) || defined(__ARM_FEATURE_AES)
+    ARMV8_PMULL |
+#endif
+#if defined(OPENSSL_STATIC_ARMCAP_SHA1) || defined(__ARM_FEATURE_SHA2)
     ARMV8_SHA1 |
 #endif
-#if defined(OPENSSL_STATIC_ARMCAP_SHA256) || defined(__ARM_FEATURE_CRYPTO)
+#if defined(OPENSSL_STATIC_ARMCAP_SHA256) || defined(__ARM_FEATURE_SHA2)
     ARMV8_SHA256 |
 #endif
-#if defined(OPENSSL_STATIC_ARMCAP_PMULL) || defined(__ARM_FEATURE_CRYPTO)
-    ARMV8_PMULL |
+#if defined(__ARM_FEATURE_SHA512)
+    ARMV8_SHA512 |
 #endif
     0;
 

data/third_party/boringssl-with-bazel/src/crypto/curve25519/curve25519.c

@@ -24,11 +24,9 @@
 #include <assert.h>
 #include <string.h>
 
-#include <openssl/cpu.h>
 #include <openssl/mem.h>
 #include <openssl/rand.h>
 #include <openssl/sha.h>
-#include <openssl/type_check.h>
 
 #include "internal.h"
 #include "../internal.h"
@@ -148,8 +146,8 @@ typedef uint32_t fe_limb_t;
 
 #endif  // BORINGSSL_CURVE25519_64BIT
 
-OPENSSL_STATIC_ASSERT(sizeof(fe) == sizeof(fe_limb_t) * FE_NUM_LIMBS,
-                      "fe_limb_t[FE_NUM_LIMBS] is inconsistent with fe");
+static_assert(sizeof(fe) == sizeof(fe_limb_t) * FE_NUM_LIMBS,
+              "fe_limb_t[FE_NUM_LIMBS] is inconsistent with fe");
 
 static void fe_frombytes_strict(fe *h, const uint8_t s[32]) {
   // |fiat_25519_from_bytes| requires the top-most bit be clear.
@@ -312,8 +310,7 @@ static void fe_copy(fe *h, const fe *f) {
 }
 
 static void fe_copy_lt(fe_loose *h, const fe *f) {
-  OPENSSL_STATIC_ASSERT(sizeof(fe_loose) == sizeof(fe),
-                        "fe and fe_loose mismatch");
+  static_assert(sizeof(fe_loose) == sizeof(fe), "fe and fe_loose mismatch");
   OPENSSL_memmove(h, f, sizeof(fe));
 }
 #if !defined(OPENSSL_SMALL)
@@ -503,27 +500,21 @@ static void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h) {
 int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t s[32]) {
   fe u;
   fe_loose v;
-  fe v3;
+  fe w;
   fe vxx;
   fe_loose check;
 
   fe_frombytes(&h->Y, s);
   fe_1(&h->Z);
-  fe_sq_tt(&v3, &h->Y);
-  fe_mul_ttt(&vxx, &v3, &d);
-  fe_sub(&v, &v3, &h->Z);  // u = y^2-1
+  fe_sq_tt(&w, &h->Y);
+  fe_mul_ttt(&vxx, &w, &d);
+  fe_sub(&v, &w, &h->Z);  // u = y^2-1
   fe_carry(&u, &v);
   fe_add(&v, &vxx, &h->Z);  // v = dy^2+1
 
-  fe_sq_tl(&v3, &v);
-  fe_mul_ttl(&v3, &v3, &v);  // v3 = v^3
-  fe_sq_tt(&h->X, &v3);
-  fe_mul_ttl(&h->X, &h->X, &v);
-  fe_mul_ttt(&h->X, &h->X, &u);  // x = uv^7
-
-  fe_pow22523(&h->X, &h->X);  // x = (uv^7)^((q-5)/8)
-  fe_mul_ttt(&h->X, &h->X, &v3);
-  fe_mul_ttt(&h->X, &h->X, &u);  // x = uv^3(uv^7)^((q-5)/8)
+  fe_mul_ttl(&w, &u, &v);  // w = u*v
+  fe_pow22523(&h->X, &w);  // x = w^((q-5)/8)
+  fe_mul_ttt(&h->X, &h->X, &u);  // x = u*w^((q-5)/8)
 
   fe_sq_tt(&vxx, &h->X);
   fe_mul_ttl(&vxx, &vxx, &v);
@@ -1939,11 +1930,8 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
   OPENSSL_memcpy(pkcopy, public_key, 32);
   uint8_t rcopy[32];
   OPENSSL_memcpy(rcopy, signature, 32);
-  union {
-    uint64_t u64[4];
-    uint8_t u8[32];
-  } scopy;
-  OPENSSL_memcpy(&scopy.u8[0], signature + 32, 32);
+  uint8_t scopy[32];
+  OPENSSL_memcpy(scopy, signature + 32, 32);
 
   // https://tools.ietf.org/html/rfc8032#section-5.1.7 requires that s be in
   // the range [0, order) in order to prevent signature malleability.
@@ -1956,9 +1944,10 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
     UINT64_C(0x1000000000000000),
   };
   for (size_t i = 3;; i--) {
-    if (scopy.u64[i] > kOrder[i]) {
+    uint64_t word = CRYPTO_load_u64_le(scopy + i * 8);
+    if (word > kOrder[i]) {
       return 0;
-    } else if (scopy.u64[i] < kOrder[i]) {
+    } else if (word < kOrder[i]) {
       break;
     } else if (i == 0) {
       return 0;
@@ -1976,7 +1965,7 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
   x25519_sc_reduce(h);
 
   ge_p2 R;
-  ge_double_scalarmult_vartime(&R, h, &A, scopy.u8);
+  ge_double_scalarmult_vartime(&R, h, &A, scopy);
 
   uint8_t rcheck[32];
   x25519_ge_tobytes(rcheck, &R);

data/third_party/boringssl-with-bazel/src/crypto/curve25519/spake25519.c

@@ -22,6 +22,7 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
+#include "../fipsmodule/bn/internal.h"
 #include "../internal.h"
 #include "./internal.h"
 
@@ -314,46 +315,30 @@ static void left_shift_3(uint8_t n[32]) {
   }
 }
 
-typedef union {
-  uint8_t bytes[32];
-  uint32_t words[8];
+typedef struct {
+  BN_ULONG words[32 / sizeof(BN_ULONG)];
 } scalar;
 
-// kOrder is the order of the prime-order subgroup of curve25519 in
-// little-endian order.
-static const scalar kOrder = {{0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
-                               0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
-                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10}};
+// kOrder is the order of the prime-order subgroup of curve25519.
+static const scalar kOrder = {
+    {TOBN(0x5812631a, 0x5cf5d3ed), TOBN(0x14def9de, 0xa2f79cd6),
+     TOBN(0x00000000, 0x00000000), TOBN(0x10000000, 0x00000000)}};
 
 // scalar_cmov copies |src| to |dest| if |mask| is all ones.
 static void scalar_cmov(scalar *dest, const scalar *src, crypto_word_t mask) {
-  for (size_t i = 0; i < 8; i++) {
-    dest->words[i] =
-        constant_time_select_w(mask, src->words[i], dest->words[i]);
-  }
+  bn_select_words(dest->words, mask, src->words, dest->words,
+                  OPENSSL_ARRAY_SIZE(dest->words));
 }
 
 // scalar_double sets |s| to |2×s|.
 static void scalar_double(scalar *s) {
-  uint32_t carry = 0;
-
-  for (size_t i = 0; i < 8; i++) {
-    const uint32_t carry_out = s->words[i] >> 31;
-    s->words[i] = (s->words[i] << 1) | carry;
-    carry = carry_out;
-  }
+  bn_add_words(s->words, s->words, s->words, OPENSSL_ARRAY_SIZE(s->words));
 }
 
 // scalar_add sets |dest| to |dest| plus |src|.
 static void scalar_add(scalar *dest, const scalar *src) {
-  uint32_t carry = 0;
-
-  for (size_t i = 0; i < 8; i++) {
-    uint64_t tmp = ((uint64_t)dest->words[i] + src->words[i]) + carry;
-    dest->words[i] = (uint32_t)tmp;
-    carry = (uint32_t)(tmp >> 32);
-  }
+  bn_add_words(dest->words, dest->words, src->words,
+               OPENSSL_ARRAY_SIZE(dest->words));
 }
 
 int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
@@ -412,25 +397,25 @@ int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
 
     OPENSSL_memset(&tmp, 0, sizeof(tmp));
     scalar_cmov(&tmp, &order,
-                constant_time_eq_w(password_scalar.bytes[0] & 1, 1));
+                constant_time_eq_w(password_scalar.words[0] & 1, 1));
     scalar_add(&password_scalar, &tmp);
 
     scalar_double(&order);
     OPENSSL_memset(&tmp, 0, sizeof(tmp));
     scalar_cmov(&tmp, &order,
-                constant_time_eq_w(password_scalar.bytes[0] & 2, 2));
+                constant_time_eq_w(password_scalar.words[0] & 2, 2));
     scalar_add(&password_scalar, &tmp);
 
     scalar_double(&order);
     OPENSSL_memset(&tmp, 0, sizeof(tmp));
     scalar_cmov(&tmp, &order,
-                constant_time_eq_w(password_scalar.bytes[0] & 4, 4));
+                constant_time_eq_w(password_scalar.words[0] & 4, 4));
     scalar_add(&password_scalar, &tmp);
 
-    assert((password_scalar.bytes[0] & 7) == 0);
+    assert((password_scalar.words[0] & 7) == 0);
   }
 
-  OPENSSL_memcpy(ctx->password_scalar, password_scalar.bytes,
+  OPENSSL_memcpy(ctx->password_scalar, password_scalar.words,
                  sizeof(ctx->password_scalar));
 
   ge_p3 mask;