grpc 1.55.0 → 1.58.0

data/third_party/boringssl-with-bazel/src/crypto/cipher_extra/tls_cbc.c

@@ -267,24 +267,115 @@ int EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
   return 1;
 }
 
-int EVP_tls_cbc_record_digest_supported(const EVP_MD *md) {
-  return EVP_MD_type(md) == NID_sha1;
+int EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
+                                        uint8_t out[SHA256_DIGEST_LENGTH],
+                                        const uint8_t *in, size_t len,
+                                        size_t max_len) {
+  // Bound the input length so |total_bits| below fits in four bytes. This is
+  // redundant with TLS record size limits. This also ensures |input_idx| below
+  // does not overflow.
+  size_t max_len_bits = max_len << 3;
+  if (ctx->Nh != 0 ||
+      (max_len_bits >> 3) != max_len ||  // Overflow
+      ctx->Nl + max_len_bits < max_len_bits ||
+      ctx->Nl + max_len_bits > UINT32_MAX) {
+    return 0;
+  }
+
+  // We need to hash the following into |ctx|:
+  //
+  // - ctx->data[:ctx->num]
+  // - in[:len]
+  // - A 0x80 byte
+  // - However many zero bytes are needed to pad up to a block.
+  // - Eight bytes of length.
+  size_t num_blocks = (ctx->num + len + 1 + 8 + SHA256_CBLOCK - 1) >> 6;
+  size_t last_block = num_blocks - 1;
+  size_t max_blocks = (ctx->num + max_len + 1 + 8 + SHA256_CBLOCK - 1) >> 6;
+
+  // The bounds above imply |total_bits| fits in four bytes.
+  size_t total_bits = ctx->Nl + (len << 3);
+  uint8_t length_bytes[4];
+  length_bytes[0] = (uint8_t)(total_bits >> 24);
+  length_bytes[1] = (uint8_t)(total_bits >> 16);
+  length_bytes[2] = (uint8_t)(total_bits >> 8);
+  length_bytes[3] = (uint8_t)total_bits;
+
+  // We now construct and process each expected block in constant-time.
+  uint8_t block[SHA256_CBLOCK] = {0};
+  uint32_t result[8] = {0};
+  // input_idx is the index into |in| corresponding to the current block.
+  // However, we allow this index to overflow beyond |max_len|, to simplify the
+  // 0x80 byte.
+  size_t input_idx = 0;
+  for (size_t i = 0; i < max_blocks; i++) {
+    // Fill |block| with data from the partial block in |ctx| and |in|. We copy
+    // as if we were hashing up to |max_len| and then zero the excess later.
+    size_t block_start = 0;
+    if (i == 0) {
+      OPENSSL_memcpy(block, ctx->data, ctx->num);
+      block_start = ctx->num;
+    }
+    if (input_idx < max_len) {
+      size_t to_copy = SHA256_CBLOCK - block_start;
+      if (to_copy > max_len - input_idx) {
+        to_copy = max_len - input_idx;
+      }
+      OPENSSL_memcpy(block + block_start, in + input_idx, to_copy);
+    }
+
+    // Zero any bytes beyond |len| and add the 0x80 byte.
+    for (size_t j = block_start; j < SHA256_CBLOCK; j++) {
+      // input[idx] corresponds to block[j].
+      size_t idx = input_idx + j - block_start;
+      // The barriers on |len| are not strictly necessary. However, without
+      // them, GCC compiles this code by incorporating |len| into the loop
+      // counter and subtracting it out later. This is still constant-time, but
+      // it frustrates attempts to validate this.
+      uint8_t is_in_bounds = constant_time_lt_8(idx, value_barrier_w(len));
+      uint8_t is_padding_byte = constant_time_eq_8(idx, value_barrier_w(len));
+      block[j] &= is_in_bounds;
+      block[j] |= 0x80 & is_padding_byte;
+    }
+
+    input_idx += SHA256_CBLOCK - block_start;
+
+    // Fill in the length if this is the last block.
+    crypto_word_t is_last_block = constant_time_eq_w(i, last_block);
+    for (size_t j = 0; j < 4; j++) {
+      block[SHA256_CBLOCK - 4 + j] |= is_last_block & length_bytes[j];
+    }
+
+    // Process the block and save the hash state if it is the final value.
+    SHA256_Transform(ctx, block);
+    for (size_t j = 0; j < 8; j++) {
+      result[j] |= is_last_block & ctx->h[j];
+    }
+  }
+
+  // Write the output.
+  for (size_t i = 0; i < 8; i++) {
+    CRYPTO_store_u32_be(out + 4 * i, result[i]);
+  }
+  return 1;
 }
 
-int EVP_tls_cbc_digest_record(const EVP_MD *md, uint8_t *md_out,
-                              size_t *md_out_size, const uint8_t header[13],
-                              const uint8_t *data, size_t data_size,
-                              size_t data_plus_mac_plus_padding_size,
-                              const uint8_t *mac_secret,
-                              unsigned mac_secret_length) {
-  if (EVP_MD_type(md) != NID_sha1) {
-      // EVP_tls_cbc_record_digest_supported should have been called first to
-      // check that the hash function is supported.
-      assert(0);
-      *md_out_size = 0;
+int EVP_tls_cbc_record_digest_supported(const EVP_MD *md) {
+  switch (EVP_MD_type(md)) {
+    case NID_sha1:
+    case NID_sha256:
+      return 1;
+    default:
       return 0;
   }
+}
 
+static int tls_cbc_digest_record_sha1(uint8_t *md_out, size_t *md_out_size,
+                                      const uint8_t header[13],
+                                      const uint8_t *data, size_t data_size,
+                                      size_t data_plus_mac_plus_padding_size,
+                                      const uint8_t *mac_secret,
+                                      unsigned mac_secret_length) {
   if (mac_secret_length > SHA_CBLOCK) {
     // HMAC pads small keys with zeros and hashes large keys down. This function
     // should never reach the large key case.
@@ -336,3 +427,88 @@ int EVP_tls_cbc_digest_record(const EVP_MD *md, uint8_t *md_out,
   *md_out_size = SHA_DIGEST_LENGTH;
   return 1;
 }
+
+static int tls_cbc_digest_record_sha256(uint8_t *md_out, size_t *md_out_size,
+                                        const uint8_t header[13],
+                                        const uint8_t *data, size_t data_size,
+                                        size_t data_plus_mac_plus_padding_size,
+                                        const uint8_t *mac_secret,
+                                        unsigned mac_secret_length) {
+  if (mac_secret_length > SHA256_CBLOCK) {
+    // HMAC pads small keys with zeros and hashes large keys down. This function
+    // should never reach the large key case.
+    assert(0);
+    return 0;
+  }
+
+  // Compute the initial HMAC block.
+  uint8_t hmac_pad[SHA256_CBLOCK];
+  OPENSSL_memset(hmac_pad, 0, sizeof(hmac_pad));
+  OPENSSL_memcpy(hmac_pad, mac_secret, mac_secret_length);
+  for (size_t i = 0; i < SHA256_CBLOCK; i++) {
+    hmac_pad[i] ^= 0x36;
+  }
+
+  SHA256_CTX ctx;
+  SHA256_Init(&ctx);
+  SHA256_Update(&ctx, hmac_pad, SHA256_CBLOCK);
+  SHA256_Update(&ctx, header, 13);
+
+  // There are at most 256 bytes of padding, so we can compute the public
+  // minimum length for |data_size|.
+  size_t min_data_size = 0;
+  if (data_plus_mac_plus_padding_size > SHA256_DIGEST_LENGTH + 256) {
+    min_data_size =
+        data_plus_mac_plus_padding_size - SHA256_DIGEST_LENGTH - 256;
+  }
+
+  // Hash the public minimum length directly. This reduces the number of blocks
+  // that must be computed in constant-time.
+  SHA256_Update(&ctx, data, min_data_size);
+
+  // Hash the remaining data without leaking |data_size|.
+  uint8_t mac_out[SHA256_DIGEST_LENGTH];
+  if (!EVP_sha256_final_with_secret_suffix(
+          &ctx, mac_out, data + min_data_size, data_size - min_data_size,
+          data_plus_mac_plus_padding_size - min_data_size)) {
+    return 0;
+  }
+
+  // Complete the HMAC in the standard manner.
+  SHA256_Init(&ctx);
+  for (size_t i = 0; i < SHA256_CBLOCK; i++) {
+    hmac_pad[i] ^= 0x6a;
+  }
+
+  SHA256_Update(&ctx, hmac_pad, SHA256_CBLOCK);
+  SHA256_Update(&ctx, mac_out, SHA256_DIGEST_LENGTH);
+  SHA256_Final(md_out, &ctx);
+  *md_out_size = SHA256_DIGEST_LENGTH;
+  return 1;
+}
+
+int EVP_tls_cbc_digest_record(const EVP_MD *md, uint8_t *md_out,
+                              size_t *md_out_size, const uint8_t header[13],
+                              const uint8_t *data, size_t data_size,
+                              size_t data_plus_mac_plus_padding_size,
+                              const uint8_t *mac_secret,
+                              unsigned mac_secret_length) {
+  switch (EVP_MD_type(md)) {
+    case NID_sha1:
+      return tls_cbc_digest_record_sha1(
+          md_out, md_out_size, header, data, data_size,
+          data_plus_mac_plus_padding_size, mac_secret, mac_secret_length);
+
+    case NID_sha256:
+      return tls_cbc_digest_record_sha256(
+          md_out, md_out_size, header, data, data_size,
+          data_plus_mac_plus_padding_size, mac_secret, mac_secret_length);
+
+    default:
+      // EVP_tls_cbc_record_digest_supported should have been called first to
+      // check that the hash function is supported.
+      assert(0);
+      *md_out_size = 0;
+      return 0;
+  }
+}

data/third_party/boringssl-with-bazel/src/crypto/conf/conf.c

@@ -68,21 +68,10 @@
 #include "conf_def.h"
 #include "internal.h"
 #include "../internal.h"
-#include "../lhash/internal.h"
 
 
-DEFINE_LHASH_OF(CONF_VALUE)
-
-struct conf_st {
-  LHASH_OF(CONF_VALUE) *data;
-};
-
 static const char kDefaultSectionName[] = "default";
 
-// The maximum length we can grow a value to after variable expansion. 64k
-// should be more than enough for all reasonable uses.
-#define MAX_CONF_VALUE_LENGTH 65536
-
 static uint32_t conf_value_hash(const CONF_VALUE *v) {
   const uint32_t section_hash = v->section ? OPENSSL_strhash(v->section) : 0;
   const uint32_t name_hash = v->name ? OPENSSL_strhash(v->name) : 0;
@@ -139,24 +128,23 @@ CONF_VALUE *CONF_VALUE_new(void) {
 }
 
 static void value_free_contents(CONF_VALUE *value) {
-  if (value->section) {
-    OPENSSL_free(value->section);
-  }
+  OPENSSL_free(value->section);
   if (value->name) {
     OPENSSL_free(value->name);
-    if (value->value) {
-      OPENSSL_free(value->value);
-    }
+    OPENSSL_free(value->value);
   } else {
-    if (value->value) {
-      sk_CONF_VALUE_free((STACK_OF(CONF_VALUE)*)value->value);
-    }
+    // TODO(davidben): When |value->name| is NULL, |CONF_VALUE| is actually an
+    // entirely different structure. This is fragile and confusing. Make a
+    // proper |CONF_SECTION| type that doesn't require this.
+    sk_CONF_VALUE_free((STACK_OF(CONF_VALUE) *)value->value);
   }
 }
 
 static void value_free(CONF_VALUE *value) {
-  value_free_contents(value);
-  OPENSSL_free(value);
+  if (value != NULL) {
+    value_free_contents(value);
+    OPENSSL_free(value);
+  }
 }
 
 static void value_free_arg(CONF_VALUE *value, void *arg) { value_free(value); }
@@ -192,28 +180,21 @@ static CONF_VALUE *NCONF_new_section(const CONF *conf, const char *section) {
   if (!lh_CONF_VALUE_insert(conf->data, &old_value, v)) {
     goto err;
   }
-  if (old_value) {
-    value_free(old_value);
-  }
+  value_free(old_value);
   ok = 1;
 
 err:
   if (!ok) {
-    if (sk != NULL) {
-      sk_CONF_VALUE_free(sk);
-    }
-    if (v != NULL) {
-      OPENSSL_free(v);
-    }
+    sk_CONF_VALUE_free(sk);
+    OPENSSL_free(v);
     v = NULL;
   }
   return v;
 }
 
 static int str_copy(CONF *conf, char *section, char **pto, char *from) {
-  int q, r, rr = 0, to = 0, len = 0;
-  char *s, *e, *rp, *rrp, *np, *cp, v;
-  const char *p;
+  int q, to = 0, len = 0;
+  char v;
   BUF_MEM *buf;
 
   buf = BUF_MEM_new();
@@ -242,22 +223,6 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from) {
       if (*from == q) {
         from++;
       }
-    } else if (IS_DQUOTE(conf, *from)) {
-      q = *from;
-      from++;
-      while (!IS_EOF(conf, *from)) {
-        if (*from == q) {
-          if (*(from + 1) == q) {
-            from++;
-          } else {
-            break;
-          }
-        }
-        buf->data[to++] = *(from++);
-      }
-      if (*from == q) {
-        from++;
-      }
     } else if (IS_ESC(conf, *from)) {
       from++;
       v = *(from++);
@@ -276,102 +241,23 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from) {
     } else if (IS_EOF(conf, *from)) {
       break;
     } else if (*from == '$') {
-      // try to expand it
-      rrp = NULL;
-      s = &(from[1]);
-      if (*s == '{') {
-        q = '}';
-      } else if (*s == '(') {
-        q = ')';
-      } else {
-        q = 0;
-      }
-
-      if (q) {
-        s++;
-      }
-      cp = section;
-      e = np = s;
-      while (IS_ALPHA_NUMERIC(conf, *e)) {
-        e++;
-      }
-      if (e[0] == ':' && e[1] == ':') {
-        cp = np;
-        rrp = e;
-        rr = *e;
-        *rrp = '\0';
-        e += 2;
-        np = e;
-        while (IS_ALPHA_NUMERIC(conf, *e)) {
-          e++;
-        }
-      }
-      r = *e;
-      *e = '\0';
-      rp = e;
-      if (q) {
-        if (r != q) {
-          OPENSSL_PUT_ERROR(CONF, CONF_R_NO_CLOSE_BRACE);
-          goto err;
-        }
-        e++;
-      }
-      // So at this point we have
-      // np which is the start of the name string which is
-      //   '\0' terminated.
-      // cp which is the start of the section string which is
-      //   '\0' terminated.
-      // e is the 'next point after'.
-      // r and rr are the chars replaced by the '\0'
-      // rp and rrp is where 'r' and 'rr' came from.
-      p = NCONF_get_string(conf, cp, np);
-      if (rrp != NULL) {
-        *rrp = rr;
-      }
-      *rp = r;
-      if (p == NULL) {
-        OPENSSL_PUT_ERROR(CONF, CONF_R_VARIABLE_HAS_NO_VALUE);
-        goto err;
-      }
-      size_t newsize = strlen(p) + buf->length - (e - from);
-      if (newsize > MAX_CONF_VALUE_LENGTH) {
-        OPENSSL_PUT_ERROR(CONF, CONF_R_VARIABLE_EXPANSION_TOO_LONG);
-        goto err;
-      }
-      if (!BUF_MEM_grow_clean(buf, newsize)) {
-        goto err;
-      }
-      while (*p) {
-        buf->data[to++] = *(p++);
-      }
-
-      /* Since we change the pointer 'from', we also have
-         to change the perceived length of the string it
-         points at.  /RL */
-      len -= e - from;
-      from = e;
-
-      /* In case there were no braces or parenthesis around
-         the variable reference, we have to put back the
-         character that was replaced with a '\0'.  /RL */
-      *rp = r;
+      // Historically, $foo would expand to a previously-parsed value. This
+      // feature has been removed as it was unused and is a DoS vector.
+      OPENSSL_PUT_ERROR(CONF, CONF_R_VARIABLE_EXPANSION_NOT_SUPPORTED);
+      goto err;
     } else {
       buf->data[to++] = *(from++);
     }
   }
 
   buf->data[to] = '\0';
-  if (*pto != NULL) {
-    OPENSSL_free(*pto);
-  }
+  OPENSSL_free(*pto);
   *pto = buf->data;
   OPENSSL_free(buf);
   return 1;
 
 err:
-  if (buf != NULL) {
-    BUF_MEM_free(buf);
-  }
+  BUF_MEM_free(buf);
   return 0;
 }
 
@@ -472,33 +358,8 @@ static char *scan_quote(CONF *conf, char *p) {
   return p;
 }
 
-
-static char *scan_dquote(CONF *conf, char *p) {
-  int q = *p;
-
-  p++;
-  while (!(IS_EOF(conf, *p))) {
-    if (*p == q) {
-      if (*(p + 1) == q) {
-        p++;
-      } else {
-        break;
-      }
-    }
-    p++;
-  }
-  if (*p == q) {
-    p++;
-  }
-  return p;
-}
-
 static void clear_comments(CONF *conf, char *p) {
   for (;;) {
-    if (IS_FCOMMENT(conf, *p)) {
-      *p = '\0';
-      return;
-    }
     if (!IS_WS(conf, *p)) {
       break;
     }
@@ -510,10 +371,6 @@ static void clear_comments(CONF *conf, char *p) {
       *p = '\0';
       return;
     }
-    if (IS_DQUOTE(conf, *p)) {
-      p = scan_dquote(conf, p);
-      continue;
-    }
     if (IS_QUOTE(conf, *p)) {
       p = scan_quote(conf, p);
       continue;
@@ -530,7 +387,7 @@ static void clear_comments(CONF *conf, char *p) {
   }
 }
 
-static int def_load_bio(CONF *conf, BIO *in, long *out_error_line) {
+int NCONF_load_bio(CONF *conf, BIO *in, long *out_error_line) {
   static const size_t CONFBUFSIZE = 512;
   int bufnum = 0, i, ii;
   BUF_MEM *buff = NULL;
@@ -707,37 +564,23 @@ static int def_load_bio(CONF *conf, BIO *in, long *out_error_line) {
       v = NULL;
     }
   }
-  if (buff != NULL) {
-    BUF_MEM_free(buff);
-  }
-  if (section != NULL) {
-    OPENSSL_free(section);
-  }
+  BUF_MEM_free(buff);
+  OPENSSL_free(section);
   return 1;
 
 err:
-  if (buff != NULL) {
-    BUF_MEM_free(buff);
-  }
-  if (section != NULL) {
-    OPENSSL_free(section);
-  }
+  BUF_MEM_free(buff);
+  OPENSSL_free(section);
   if (out_error_line != NULL) {
     *out_error_line = eline;
   }
-  BIO_snprintf(btmp, sizeof btmp, "%ld", eline);
+  snprintf(btmp, sizeof btmp, "%ld", eline);
   ERR_add_error_data(2, "line ", btmp);
 
   if (v != NULL) {
-    if (v->name != NULL) {
-      OPENSSL_free(v->name);
-    }
-    if (v->value != NULL) {
-      OPENSSL_free(v->value);
-    }
-    if (v != NULL) {
-      OPENSSL_free(v);
-    }
+    OPENSSL_free(v->name);
+    OPENSSL_free(v->value);
+    OPENSSL_free(v);
   }
   return 0;
 }
@@ -751,16 +594,12 @@ int NCONF_load(CONF *conf, const char *filename, long *out_error_line) {
     return 0;
   }
 
-  ret = def_load_bio(conf, in, out_error_line);
+  ret = NCONF_load_bio(conf, in, out_error_line);
   BIO_free(in);
 
   return ret;
 }
 
-int NCONF_load_bio(CONF *conf, BIO *bio, long *out_error_line) {
-  return def_load_bio(conf, bio, out_error_line);
-}
-
 int CONF_parse_list(const char *list, char sep, int remove_whitespace,
                     int (*list_cb)(const char *elem, size_t len, void *usr),
                     void *arg) {

data/third_party/boringssl-with-bazel/src/crypto/conf/conf_def.h

@@ -55,8 +55,9 @@
  * [including the GNU Public Licence.]
  */
 
-/* THIS FILE WAS AUTOMAGICALLY GENERATED!
-   Please modify and use keysets.pl to regenerate it. */
+// This file was historically generated by keysets.pl in OpenSSL.
+//
+// TODO(davidben): Replace it with something more readable.
 
 #define CONF_NUMBER		1
 #define CONF_UPPER		2
@@ -66,9 +67,7 @@
 #define CONF_WS			16
 #define CONF_ESC		32
 #define CONF_QUOTE		64
-#define CONF_DQUOTE		1024
 #define CONF_COMMENT		128
-#define CONF_FCOMMENT		2048
 #define CONF_EOF		8
 #define CONF_HIGHBIT		4096
 #define CONF_ALPHA		(CONF_UPPER|CONF_LOWER)
@@ -78,7 +77,6 @@
 
 #define KEYTYPES(c)		CONF_type_default
 #define IS_COMMENT(c,a)		(KEYTYPES(c)[(a)&0xff]&CONF_COMMENT)
-#define IS_FCOMMENT(c,a)	(KEYTYPES(c)[(a)&0xff]&CONF_FCOMMENT)
 #define IS_EOF(c,a)		(KEYTYPES(c)[(a)&0xff]&CONF_EOF)
 #define IS_ESC(c,a)		(KEYTYPES(c)[(a)&0xff]&CONF_ESC)
 #define IS_NUMBER(c,a)		(KEYTYPES(c)[(a)&0xff]&CONF_NUMBER)
@@ -87,8 +85,6 @@
 #define IS_ALPHA_NUMERIC_PUNCT(c,a) \
 				(KEYTYPES(c)[(a)&0xff]&CONF_ALPHA_NUMERIC_PUNCT)
 #define IS_QUOTE(c,a)		(KEYTYPES(c)[(a)&0xff]&CONF_QUOTE)
-#define IS_DQUOTE(c,a)		(KEYTYPES(c)[(a)&0xff]&CONF_DQUOTE)
-#define IS_HIGHBIT(c,a)		(KEYTYPES(c)[(a)&0xff]&CONF_HIGHBIT)
 
 static const unsigned short CONF_type_default[256]={
 	0x0008,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000,

data/third_party/boringssl-with-bazel/src/crypto/conf/internal.h

@@ -17,11 +17,19 @@
 
 #include <openssl/base.h>
 
+#include "../lhash/internal.h"
+
 #if defined(__cplusplus)
 extern "C" {
 #endif
 
 
+DEFINE_LHASH_OF(CONF_VALUE)
+
+struct conf_st {
+  LHASH_OF(CONF_VALUE) *data;
+};
+
 // CONF_VALUE_new returns a freshly allocated and zeroed |CONF_VALUE|.
 CONF_VALUE *CONF_VALUE_new(void);
 

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_apple.c

@@ -23,8 +23,6 @@
 #include <openssl/arm_arch.h>
 
 
-extern uint32_t OPENSSL_armcap_P;
-
 static int has_hw_feature(const char *name) {
   int value;
   size_t len = sizeof(value);
@@ -65,6 +63,9 @@ void OPENSSL_cpuid_setup(void) {
   // available in macOS 12. For compatibility with macOS 11, we also support
   // the old names. The old names don't have values for features like FEAT_AES,
   // so instead we detect them statically above.
+  //
+  // If querying new sysctls, update the Chromium sandbox definition. See
+  // https://crrev.com/c/4415225.
   if (has_hw_feature("hw.optional.arm.FEAT_SHA512") ||
       has_hw_feature("hw.optional.armv8_2_sha512")) {
     OPENSSL_armcap_P |= ARMV8_SHA512;

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_fuchsia.c

@@ -23,7 +23,6 @@
 
 #include <openssl/arm_arch.h>
 
-extern uint32_t OPENSSL_armcap_P;
 
 void OPENSSL_cpuid_setup(void) {
   uint32_t hwcap;

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_linux.c

@@ -22,8 +22,6 @@
 #include <openssl/arm_arch.h>
 
 
-extern uint32_t OPENSSL_armcap_P;
-
 void OPENSSL_cpuid_setup(void) {
   unsigned long hwcap = getauxval(AT_HWCAP);