grpc 1.53.2 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/random.c

@@ -108,16 +108,17 @@
 
 #include <openssl/bn.h>
 
+#include <assert.h>
 #include <limits.h>
 #include <string.h>
 
 #include <openssl/err.h>
 #include <openssl/rand.h>
-#include <openssl/type_check.h>
 
-#include "internal.h"
 #include "../../internal.h"
 #include "../rand/internal.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
 
 
 int BN_rand(BIGNUM *rnd, int bits, int top, int bottom) {
@@ -155,7 +156,10 @@ int BN_rand(BIGNUM *rnd, int bits, int top, int bottom) {
     return 0;
   }
 
+  FIPS_service_indicator_lock_state();
   RAND_bytes((uint8_t *)rnd->d, words * sizeof(BN_ULONG));
+  FIPS_service_indicator_unlock_state();
+
   rnd->d[words - 1] &= mask;
   if (top != BN_RAND_TOP_ANY) {
     if (top == BN_RAND_TOP_TWO && bits > 1) {
@@ -195,8 +199,8 @@ static crypto_word_t bn_less_than_word_mask(const BN_ULONG *a, size_t len,
   }
 
   // |a| < |b| iff a[1..len-1] are all zero and a[0] < b.
-  OPENSSL_STATIC_ASSERT(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
-                        "crypto_word_t is too small");
+  static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
+                "crypto_word_t is too small");
   crypto_word_t mask = 0;
   for (size_t i = 1; i < len; i++) {
     mask |= a[i];
@@ -270,8 +274,10 @@ int bn_rand_range_words(BN_ULONG *out, BN_ULONG min_inclusive,
 
     // Steps 4 and 5. Use |words| and |mask| together to obtain a string of N
     // bits, where N is the bit length of |max_exclusive|.
+    FIPS_service_indicator_lock_state();
     RAND_bytes_with_additional_data((uint8_t *)out, words * sizeof(BN_ULONG),
                                     additional_data);
+    FIPS_service_indicator_unlock_state();
     out[words - 1] &= mask;
 
     // If out >= max_exclusive or out < min_inclusive, retry. This implements
@@ -313,7 +319,9 @@ int bn_rand_secret_range(BIGNUM *r, int *out_is_uniform, BN_ULONG min_inclusive,
   }
 
   // Select a uniform random number with num_bits(max_exclusive) bits.
+  FIPS_service_indicator_lock_state();
   RAND_bytes((uint8_t *)r->d, words * sizeof(BN_ULONG));
+  FIPS_service_indicator_unlock_state();
   r->d[words - 1] &= mask;
 
   // Check, in constant-time, if the value is in range.
@@ -328,7 +336,7 @@ int bn_rand_secret_range(BIGNUM *r, int *out_is_uniform, BN_ULONG min_inclusive,
   assert(bn_in_range_words(r->d, min_inclusive, max_exclusive->d, words));
 
   r->neg = 0;
-  r->width = words;
+  r->width = (int)words;
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/rsaz_exp.c

@@ -18,6 +18,8 @@
 
 #include <openssl/mem.h>
 
+#include <assert.h>
+
 #include "internal.h"
 #include "../../internal.h"
 
@@ -38,8 +40,8 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
                             const BN_ULONG m_norm[16], const BN_ULONG RR[16],
                             BN_ULONG k0,
                             BN_ULONG storage[MOD_EXP_CTIME_STORAGE_LEN]) {
-  OPENSSL_STATIC_ASSERT(MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH % 64 == 0,
-                        "MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH is too small");
+  static_assert(MOD_EXP_CTIME_ALIGN % 64 == 0,
+                "MOD_EXP_CTIME_ALIGN is too small");
   assert((uintptr_t)storage % 64 == 0);
 
   BN_ULONG *a_inv, *m, *result, *table_s = storage + 40 * 3, *R2 = table_s;
@@ -66,23 +68,14 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
   // R2 = 2^3052 * 2^80 / 2^1044 = 2^2088 = (2^1044)^2
 
   // table[0] = 1
-  rsaz_1024_mul_avx2(result, R2, one, m, k0);
   // table[1] = a_inv^1
+  rsaz_1024_mul_avx2(result, R2, one, m, k0);
   rsaz_1024_mul_avx2(a_inv, a_inv, R2, m, k0);
-
   rsaz_1024_scatter5_avx2(table_s, result, 0);
   rsaz_1024_scatter5_avx2(table_s, a_inv, 1);
-
   // table[2] = a_inv^2
   rsaz_1024_sqr_avx2(result, a_inv, m, k0, 1);
   rsaz_1024_scatter5_avx2(table_s, result, 2);
-#if 0
-  // This is almost 2x smaller and less than 1% slower.
-  for (int index = 3; index < 32; index++) {
-    rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-    rsaz_1024_scatter5_avx2(table_s, result, index);
-  }
-#else
   // table[4] = a_inv^4
   rsaz_1024_sqr_avx2(result, result, m, k0, 1);
   rsaz_1024_scatter5_avx2(table_s, result, 4);
@@ -92,109 +85,25 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
   // table[16] = a_inv^16
   rsaz_1024_sqr_avx2(result, result, m, k0, 1);
   rsaz_1024_scatter5_avx2(table_s, result, 16);
-  // table[17] = a_inv^17
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 17);
-
-  // table[3]
-  rsaz_1024_gather5_avx2(result, table_s, 2);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 3);
-  // table[6]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 6);
-  // table[12]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 12);
-  // table[24]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 24);
-  // table[25]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 25);
-
-  // table[5]
-  rsaz_1024_gather5_avx2(result, table_s, 4);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 5);
-  // table[10]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 10);
-  // table[20]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 20);
-  // table[21]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 21);
-
-  // table[7]
-  rsaz_1024_gather5_avx2(result, table_s, 6);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 7);
-  // table[14]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 14);
-  // table[28]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 28);
-  // table[29]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 29);
-
-  // table[9]
-  rsaz_1024_gather5_avx2(result, table_s, 8);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 9);
-  // table[18]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 18);
-  // table[19]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 19);
-
-  // table[11]
-  rsaz_1024_gather5_avx2(result, table_s, 10);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 11);
-  // table[22]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 22);
-  // table[23]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 23);
-
-  // table[13]
-  rsaz_1024_gather5_avx2(result, table_s, 12);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 13);
-  // table[26]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 26);
-  // table[27]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 27);
-
-  // table[15]
-  rsaz_1024_gather5_avx2(result, table_s, 14);
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 15);
-  // table[30]
-  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
-  rsaz_1024_scatter5_avx2(table_s, result, 30);
-  // table[31]
-  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
-  rsaz_1024_scatter5_avx2(table_s, result, 31);
-#endif
+  for (int i = 3; i < 32; i += 2) {
+    // table[i] = table[i-1] * a_inv = a_inv^i
+    rsaz_1024_gather5_avx2(result, table_s, i - 1);
+    rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
+    rsaz_1024_scatter5_avx2(table_s, result, i);
+    for (int j = 2 * i; j < 32; j *= 2) {
+      // table[j] = table[j/2]^2 = a_inv^j
+      rsaz_1024_sqr_avx2(result, result, m, k0, 1);
+      rsaz_1024_scatter5_avx2(table_s, result, j);
+    }
+  }
 
+  // Load the first window.
   const uint8_t *p_str = (const uint8_t *)exponent;
-
-  // load first window
   int wvalue = p_str[127] >> 3;
   rsaz_1024_gather5_avx2(result, table_s, wvalue);
 
   int index = 1014;
   while (index > -1) {  // Loop for the remaining 127 windows.
-
     rsaz_1024_sqr_avx2(result, result, m, k0, 5);
 
     uint16_t wvalue_16;
@@ -219,6 +128,8 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
   rsaz_1024_mul_avx2(result, result, one, m, k0);
 
   rsaz_1024_red2norm_avx2(result_norm, result);
+  BN_ULONG scratch[16];
+  bn_reduce_once_in_place(result_norm, /*carry=*/0, m_norm, scratch, 16);
 
   OPENSSL_cleanse(storage, MOD_EXP_CTIME_STORAGE_LEN * sizeof(BN_ULONG));
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/rsaz_exp.h

@@ -16,9 +16,9 @@
 #define OPENSSL_HEADER_BN_RSAZ_EXP_H
 
 #include <openssl/bn.h>
-#include <openssl/cpu.h>
 
 #include "internal.h"
+#include "../../internal.h"
 
 #if defined(__cplusplus)
 extern "C" {
@@ -32,8 +32,7 @@ extern "C" {
 // modulo |m_norm|. |base_norm| must be fully-reduced and |exponent| must have
 // the high bit set (it is 1024 bits wide). |RR| and |k0| must be |RR| and |n0|,
 // respectively, extracted from |m_norm|'s |BN_MONT_CTX|. |storage_words| is a
-// temporary buffer that must be aligned to |MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH|
-// bytes.
+// temporary buffer that must be aligned to |MOD_EXP_CTIME_ALIGN| bytes.
 void RSAZ_1024_mod_exp_avx2(BN_ULONG result[16], const BN_ULONG base_norm[16],
                             const BN_ULONG exponent[16],
                             const BN_ULONG m_norm[16], const BN_ULONG RR[16],
@@ -41,18 +40,17 @@ void RSAZ_1024_mod_exp_avx2(BN_ULONG result[16], const BN_ULONG base_norm[16],
                             BN_ULONG storage_words[MOD_EXP_CTIME_STORAGE_LEN]);
 
 OPENSSL_INLINE int rsaz_avx2_capable(void) {
-  const uint32_t *cap = OPENSSL_ia32cap_get();
-  return (cap[2] & (1 << 5)) != 0;  // AVX2
+  return CRYPTO_is_AVX2_capable();
 }
 
 OPENSSL_INLINE int rsaz_avx2_preferred(void) {
-  const uint32_t *cap = OPENSSL_ia32cap_get();
-  static const uint32_t kBMI2AndADX = (1 << 8) | (1 << 19);
-  if ((cap[2] & kBMI2AndADX) == kBMI2AndADX) {
-    // If BMI2 and ADX are available, x86_64-mont5.pl is faster.
+  if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
+      CRYPTO_is_ADX_capable()) {
+    // If BMI1, BMI2, and ADX are available, x86_64-mont5.pl is faster. See the
+    // .Lmulx4x_enter and .Lpowerx5_enter branches.
     return 0;
   }
-  return (cap[2] & (1 << 5)) != 0;  // AVX2
+  return CRYPTO_is_AVX2_capable();
 }
 
 
@@ -80,18 +78,24 @@ void rsaz_1024_sqr_avx2(BN_ULONG ret[40], const BN_ULONG a[40],
                         const BN_ULONG n[40], BN_ULONG k, int count);
 
 // rsaz_1024_scatter5_avx2 stores |val| at index |i| of |tbl|. |i| must be
-// positive and at most 31. Note the table only uses 18 |BN_ULONG|s per entry
-// instead of 40. It packs two 29-bit limbs into each |BN_ULONG| and only stores
-// 36 limbs rather than the padded 40.
+// positive and at most 31. It is treated as public. Note the table only uses 18
+// |BN_ULONG|s per entry instead of 40. It packs two 29-bit limbs into each
+// |BN_ULONG| and only stores 36 limbs rather than the padded 40.
 void rsaz_1024_scatter5_avx2(BN_ULONG tbl[32 * 18], const BN_ULONG val[40],
                              int i);
 
-// rsaz_1024_gather5_avx2 loads index |i| of |tbl| and writes it to |val|.
+// rsaz_1024_gather5_avx2 loads index |i| of |tbl| and writes it to |val|. |i|
+// must be positive and at most 31. It is treated as secret. |tbl| must be
+// aligned to 32 bytes.
 void rsaz_1024_gather5_avx2(BN_ULONG val[40], const BN_ULONG tbl[32 * 18],
                             int i);
 
 // rsaz_1024_red2norm_avx2 converts |red| from RSAZ to |BIGNUM| representation
-// and writes the result to |norm|.
+// and writes the result to |norm|. The result will be <= the modulus.
+//
+// WARNING: The result of this operation may not be fully reduced. |norm| may be
+// the modulus instead of zero. This function should be followed by a call to
+// |bn_reduce_once|.
 void rsaz_1024_red2norm_avx2(BN_ULONG norm[16], const BN_ULONG red[40]);
 
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/shift.c

@@ -56,10 +56,10 @@
 
 #include <openssl/bn.h>
 
+#include <assert.h>
 #include <string.h>
 
 #include <openssl/err.h>
-#include <openssl/type_check.h>
 
 #include "internal.h"
 
@@ -258,9 +258,9 @@ int BN_clear_bit(BIGNUM *a, int n) {
   return 1;
 }
 
-int bn_is_bit_set_words(const BN_ULONG *a, size_t num, unsigned bit) {
-  unsigned i = bit / BN_BITS2;
-  unsigned j = bit % BN_BITS2;
+int bn_is_bit_set_words(const BN_ULONG *a, size_t num, size_t bit) {
+  size_t i = bit / BN_BITS2;
+  size_t j = bit % BN_BITS2;
   if (i >= num) {
     return 0;
   }
@@ -296,15 +296,14 @@ int BN_mask_bits(BIGNUM *a, int n) {
 }
 
 static int bn_count_low_zero_bits_word(BN_ULONG l) {
-  OPENSSL_STATIC_ASSERT(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
-                        "crypto_word_t is too small");
-  OPENSSL_STATIC_ASSERT(sizeof(int) <= sizeof(crypto_word_t),
-                        "crypto_word_t is too small");
-  OPENSSL_STATIC_ASSERT(BN_BITS2 == sizeof(BN_ULONG) * 8,
-                        "BN_ULONG has padding bits");
+  static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
+                "crypto_word_t is too small");
+  static_assert(sizeof(int) <= sizeof(crypto_word_t),
+                "crypto_word_t is too small");
+  static_assert(BN_BITS2 == sizeof(BN_ULONG) * 8, "BN_ULONG has padding bits");
   // C has very bizarre rules for types smaller than an int.
-  OPENSSL_STATIC_ASSERT(sizeof(BN_ULONG) >= sizeof(int),
-                        "BN_ULONG gets promoted to int");
+  static_assert(sizeof(BN_ULONG) >= sizeof(int),
+                "BN_ULONG gets promoted to int");
 
   crypto_word_t mask;
   int bits = 0;
@@ -342,10 +341,10 @@ static int bn_count_low_zero_bits_word(BN_ULONG l) {
 }
 
 int BN_count_low_zero_bits(const BIGNUM *bn) {
-  OPENSSL_STATIC_ASSERT(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
-                        "crypto_word_t is too small");
-  OPENSSL_STATIC_ASSERT(sizeof(int) <= sizeof(crypto_word_t),
-                        "crypto_word_t is too small");
+  static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
+                "crypto_word_t is too small");
+  static_assert(sizeof(int) <= sizeof(crypto_word_t),
+                "crypto_word_t is too small");
 
   int ret = 0;
   crypto_word_t saw_nonzero = 0;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/sqrt.c

@@ -306,8 +306,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
   }
 
   // x := a^((q-1)/2)
-  if (BN_is_zero(t))  // special case: p = 2^e + 1
-  {
+  if (BN_is_zero(t)) {  // special case: p = 2^e + 1
     if (!BN_nnmod(t, A, p, ctx)) {
       goto end;
     }
@@ -350,7 +349,6 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
     // We have  a*b = x^2,
     //    y^2^(e-1) = -1,
     //    b^2^(e-1) = 1.
-
     if (BN_is_one(b)) {
       if (!BN_copy(ret, x)) {
         goto end;
@@ -359,23 +357,26 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
       goto vrfy;
     }
 
-
-    // find smallest  i  such that  b^(2^i) = 1
-    i = 1;
-    if (!BN_mod_sqr(t, b, p, ctx)) {
-      goto end;
-    }
-    while (!BN_is_one(t)) {
-      i++;
-      if (i == e) {
-        OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
-        goto end;
+    // Find the smallest i, 0 < i < e, such that b^(2^i) = 1
+    for (i = 1; i < e; i++) {
+      if (i == 1) {
+        if (!BN_mod_sqr(t, b, p, ctx)) {
+          goto end;
+        }
+      } else {
+        if (!BN_mod_mul(t, t, t, p, ctx)) {
+          goto end;
+        }
       }
-      if (!BN_mod_mul(t, t, t, p, ctx)) {
-        goto end;
+      if (BN_is_one(t)) {
+        break;
       }
     }
-
+    // If not found, a is not a square or p is not a prime.
+    if (i >= e) {
+      OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
+      goto end;
+    }
 
     // t := y^2^(e - i - 1)
     if (!BN_copy(t, y)) {
@@ -391,14 +392,15 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
         !BN_mod_mul(b, b, y, p, ctx)) {
       goto end;
     }
+
+    // e decreases each iteration, so this loop will terminate.
+    assert(i < e);
     e = i;
   }
 
 vrfy:
   if (!err) {
-    // verify the result -- the input might have been not a square
-    // (test added in 0.9.8)
-
+    // Verify the result. The input might have been not a square.
     if (!BN_mod_sqr(x, ret, p, ctx)) {
       err = 1;
     }
@@ -443,7 +445,6 @@ int BN_sqrt(BIGNUM *out_sqrt, const BIGNUM *in, BN_CTX *ctx) {
   last_delta = BN_CTX_get(ctx);
   delta = BN_CTX_get(ctx);
   if (estimate == NULL || tmp == NULL || last_delta == NULL || delta == NULL) {
-    OPENSSL_PUT_ERROR(BN, ERR_R_MALLOC_FAILURE);
     goto err;
   }
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/aead.c

@@ -51,6 +51,9 @@ EVP_AEAD_CTX *EVP_AEAD_CTX_new(const EVP_AEAD *aead, const uint8_t *key,
 }
 
 void EVP_AEAD_CTX_free(EVP_AEAD_CTX *ctx) {
+  if (ctx == NULL) {
+    return;
+  }
   EVP_AEAD_CTX_cleanup(ctx);
   OPENSSL_free(ctx);
 }