grpc 1.72.0 → 1.73.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/prime.cc.inc

@@ -290,9 +290,7 @@ void *BN_GENCB_get_arg(const BN_GENCB *callback) { return callback->arg; }
 int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add,
                          const BIGNUM *rem, BN_GENCB *cb) {
   BIGNUM *t;
-  int found = 0;
   int i, j, c1 = 0;
-  BN_CTX *ctx;
   int checks = BN_prime_checks_for_size(bits);
 
   if (bits < 2) {
@@ -305,43 +303,43 @@ int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add,
     return 0;
   }
 
-  ctx = BN_CTX_new();
-  if (ctx == NULL) {
-    goto err;
+  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  if (ctx == nullptr) {
+    return 0;
   }
-  BN_CTX_start(ctx);
-  t = BN_CTX_get(ctx);
+  bssl::BN_CTXScope scope(ctx.get());
+  t = BN_CTX_get(ctx.get());
   if (!t) {
-    goto err;
+    return 0;
   }
 
 loop:
   // make a random number and set the top and bottom bits
   if (add == NULL) {
     if (!probable_prime(ret, bits)) {
-      goto err;
+      return 0;
     }
   } else {
     if (safe) {
-      if (!probable_prime_dh_safe(ret, bits, add, rem, ctx)) {
-        goto err;
+      if (!probable_prime_dh_safe(ret, bits, add, rem, ctx.get())) {
+        return 0;
       }
     } else {
-      if (!probable_prime_dh(ret, bits, add, rem, ctx)) {
-        goto err;
+      if (!probable_prime_dh(ret, bits, add, rem, ctx.get())) {
+        return 0;
       }
     }
   }
 
   if (!BN_GENCB_call(cb, BN_GENCB_GENERATED, c1++)) {
     // aborted
-    goto err;
+    return 0;
   }
 
   if (!safe) {
-    i = BN_is_prime_fasttest_ex(ret, checks, ctx, 0, cb);
+    i = BN_is_prime_fasttest_ex(ret, checks, ctx.get(), 0, cb);
     if (i == -1) {
-      goto err;
+      return 0;
     } else if (i == 0) {
       goto loop;
     }
@@ -349,7 +347,7 @@ loop:
     // for "safe prime" generation, check that (p-1)/2 is prime. Since a prime
     // is odd, We just need to divide by 2
     if (!BN_rshift1(t, ret)) {
-      goto err;
+      return 0;
     }
 
     // Interleave |ret| and |t|'s primality tests to avoid paying the full
@@ -358,37 +356,29 @@ loop:
     // TODO(davidben): This doesn't quite work because an iteration count of 1
     // still runs the blinding mechanism.
     for (i = 0; i < checks; i++) {
-      j = BN_is_prime_fasttest_ex(ret, 1, ctx, 0, NULL);
+      j = BN_is_prime_fasttest_ex(ret, 1, ctx.get(), 0, NULL);
       if (j == -1) {
-        goto err;
+        return 0;
       } else if (j == 0) {
         goto loop;
       }
 
-      j = BN_is_prime_fasttest_ex(t, 1, ctx, 0, NULL);
+      j = BN_is_prime_fasttest_ex(t, 1, ctx.get(), 0, NULL);
       if (j == -1) {
-        goto err;
+        return 0;
       } else if (j == 0) {
         goto loop;
       }
 
       if (!BN_GENCB_call(cb, BN_GENCB_PRIME_TEST, i)) {
-        goto err;
+        return 0;
       }
       // We have a safe prime test pass
     }
   }
 
   // we have a prime :-)
-  found = 1;
-
-err:
-  if (ctx != NULL) {
-    BN_CTX_end(ctx);
-    BN_CTX_free(ctx);
-  }
-
-  return found;
+  return 1;
 }
 
 static int bn_trial_division(uint16_t *out, const BIGNUM *bn) {
@@ -453,8 +443,7 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
                               int *out_is_possibly_prime, const BIGNUM *b,
                               const BN_MONT_CTX *mont, BN_CTX *ctx) {
   // This function corresponds to steps 4.3 through 4.5 of FIPS 186-4, C.3.1.
-  int ret = 0;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
 
   // Step 4.3. We use Montgomery-encoding for better performance and to avoid
   // timing leaks.
@@ -464,7 +453,7 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
   if (z == NULL ||
       !BN_mod_exp_mont_consttime(z, b, miller_rabin->m, w, ctx, mont) ||
       !BN_to_montgomery(z, z, mont, ctx)) {
-    goto err;
+    return 0;
   }
 
   // is_possibly_prime is all ones if we have determined |b| is not a composite
@@ -493,7 +482,7 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
 
     // Step 4.5.1.
     if (!BN_mod_mul_montgomery(z, z, z, mont, ctx)) {
-      goto err;
+      return 0;
     }
 
     // Step 4.5.2. If z = w-1 and the loop is not done, this is not a composite
@@ -513,11 +502,7 @@ int bn_miller_rabin_iteration(const BN_MILLER_RABIN *miller_rabin,
   }
 
   *out_is_possibly_prime = constant_time_declassify_w(is_possibly_prime) & 1;
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w, int checks,
@@ -598,26 +583,25 @@ int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w, int checks,
     checks = BN_prime_checks_for_size(BN_num_bits(w));
   }
 
-  BN_CTX *new_ctx = NULL;
-  if (ctx == NULL) {
-    new_ctx = BN_CTX_new();
-    if (new_ctx == NULL) {
+  bssl::UniquePtr<BN_CTX> new_ctx;
+  if (ctx == nullptr) {
+    new_ctx.reset(BN_CTX_new());
+    if (new_ctx == nullptr) {
       return 0;
     }
-    ctx = new_ctx;
+    ctx = new_ctx.get();
   }
 
   // See C.3.1 from FIPS 186-4.
-  int ret = 0;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *b = BN_CTX_get(ctx);
-  BN_MONT_CTX *mont = BN_MONT_CTX_new_consttime(w, ctx);
+  bssl::UniquePtr<BN_MONT_CTX> mont(BN_MONT_CTX_new_consttime(w, ctx));
   BN_MILLER_RABIN miller_rabin;
   crypto_word_t uniform_iterations = 0;
-  if (b == NULL || mont == NULL ||
+  if (b == nullptr || mont == nullptr ||
       // Steps 1-3.
-      !bn_miller_rabin_init(&miller_rabin, mont, ctx)) {
-    goto err;
+      !bn_miller_rabin_init(&miller_rabin, mont.get(), ctx)) {
+    return 0;
   }
 
   // The following loop performs in inner iteration of the Miller-Rabin
@@ -657,39 +641,32 @@ int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w, int checks,
     // Step 4.1-4.2
     int is_uniform;
     if (!bn_rand_secret_range(b, &is_uniform, 2, miller_rabin.w1)) {
-      goto err;
+      return 0;
     }
     uniform_iterations += is_uniform;
 
     // Steps 4.3-4.5
     int is_possibly_prime = 0;
-    if (!bn_miller_rabin_iteration(&miller_rabin, &is_possibly_prime, b, mont,
-                                   ctx)) {
-      goto err;
+    if (!bn_miller_rabin_iteration(&miller_rabin, &is_possibly_prime, b,
+                                   mont.get(), ctx)) {
+      return 0;
     }
 
     if (!is_possibly_prime) {
       // Step 4.6. We did not see z = w-1 before z = 1, so w must be composite.
       *out_is_probably_prime = 0;
-      ret = 1;
-      goto err;
+      return 1;
     }
 
     // Step 4.7
     if (!BN_GENCB_call(cb, BN_GENCB_PRIME_TEST, i - 1)) {
-      goto err;
+      return 0;
     }
   }
 
   declassify_assert(uniform_iterations >= (crypto_word_t)checks);
   *out_is_probably_prime = 1;
-  ret = 1;
-
-err:
-  BN_MONT_CTX_free(mont);
-  BN_CTX_end(ctx);
-  BN_CTX_free(new_ctx);
-  return ret;
+  return 1;
 }
 
 int BN_is_prime_ex(const BIGNUM *candidate, int checks, BN_CTX *ctx,
@@ -720,41 +697,36 @@ int BN_enhanced_miller_rabin_primality_test(
     checks = BN_prime_checks_for_size(BN_num_bits(w));
   }
 
-  int ret = 0;
-  BN_MONT_CTX *mont = NULL;
-
-  BN_CTX_start(ctx);
-
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *w1 = BN_CTX_get(ctx);
-  BIGNUM *b, *g, *z, *x, *x1, *m;
-  int a;
-  if (w1 == NULL || !BN_copy(w1, w) || !BN_sub_word(w1, 1)) {
-    goto err;
+  if (w1 == nullptr || !BN_copy(w1, w) || !BN_sub_word(w1, 1)) {
+    return 0;
   }
 
   // Write w1 as m*2^a (Steps 1 and 2).
-  a = 0;
+  int a = 0;
   while (!BN_is_bit_set(w1, a)) {
     a++;
   }
-  m = BN_CTX_get(ctx);
-  if (m == NULL || !BN_rshift(m, w1, a)) {
-    goto err;
+  BIGNUM *m = BN_CTX_get(ctx);
+  if (m == nullptr || !BN_rshift(m, w1, a)) {
+    return 0;
   }
 
-  b = BN_CTX_get(ctx);
-  g = BN_CTX_get(ctx);
-  z = BN_CTX_get(ctx);
-  x = BN_CTX_get(ctx);
-  x1 = BN_CTX_get(ctx);
-  if (b == NULL || g == NULL || z == NULL || x == NULL || x1 == NULL) {
-    goto err;
+  BIGNUM *b = BN_CTX_get(ctx);
+  BIGNUM *g = BN_CTX_get(ctx);
+  BIGNUM *z = BN_CTX_get(ctx);
+  BIGNUM *x = BN_CTX_get(ctx);
+  BIGNUM *x1 = BN_CTX_get(ctx);
+  if (b == nullptr || g == nullptr || z == nullptr || x == nullptr ||
+      x1 == nullptr) {
+    return 0;
   }
 
   // Montgomery setup for computations mod w
-  mont = BN_MONT_CTX_new_for_modulus(w, ctx);
-  if (mont == NULL) {
-    goto err;
+  bssl::UniquePtr<BN_MONT_CTX> mont(BN_MONT_CTX_new_for_modulus(w, ctx));
+  if (mont == nullptr) {
+    return 0;
   }
 
   // The following loop performs in inner iteration of the Enhanced Miller-Rabin
@@ -762,22 +734,21 @@ int BN_enhanced_miller_rabin_primality_test(
   for (int i = 1; i <= checks; i++) {
     // Step 4.1-4.2
     if (!BN_rand_range_ex(b, 2, w1)) {
-      goto err;
+      return 0;
     }
 
     // Step 4.3-4.4
     if (!BN_gcd(g, b, w, ctx)) {
-      goto err;
+      return 0;
     }
     if (BN_cmp_word(g, 1) > 0) {
       *out_result = bn_composite;
-      ret = 1;
-      goto err;
+      return 1;
     }
 
     // Step 4.5
-    if (!BN_mod_exp_mont(z, b, m, w, ctx, mont)) {
-      goto err;
+    if (!BN_mod_exp_mont(z, b, m, w, ctx, mont.get())) {
+      return 0;
     }
 
     // Step 4.6
@@ -788,7 +759,7 @@ int BN_enhanced_miller_rabin_primality_test(
     // Step 4.7
     for (int j = 1; j < a; j++) {
       if (!BN_copy(x, z) || !BN_mod_mul(z, x, x, w, ctx)) {
-        goto err;
+        return 0;
       }
       if (BN_cmp(z, w1) == 0) {
         goto loop;
@@ -800,18 +771,18 @@ int BN_enhanced_miller_rabin_primality_test(
 
     // Step 4.8-4.9
     if (!BN_copy(x, z) || !BN_mod_mul(z, x, x, w, ctx)) {
-      goto err;
+      return 0;
     }
 
     // Step 4.10-4.11
     if (!BN_is_one(z) && !BN_copy(x, z)) {
-      goto err;
+      return 0;
     }
 
   composite:
     // Step 4.12-4.14
     if (!BN_copy(x1, x) || !BN_sub_word(x1, 1) || !BN_gcd(g, x1, w, ctx)) {
-      goto err;
+      return 0;
     }
     if (BN_cmp_word(g, 1) > 0) {
       *out_result = bn_composite;
@@ -819,24 +790,17 @@ int BN_enhanced_miller_rabin_primality_test(
       *out_result = bn_non_prime_power_composite;
     }
 
-    ret = 1;
-    goto err;
+    return 1;
 
   loop:
     // Step 4.15
     if (!BN_GENCB_call(cb, BN_GENCB_PRIME_TEST, i - 1)) {
-      goto err;
+      return 0;
     }
   }
 
   *out_result = bn_probably_prime;
-  ret = 1;
-
-err:
-  BN_MONT_CTX_free(mont);
-  BN_CTX_end(ctx);
-
-  return ret;
+  return 1;
 }
 
 static int probable_prime(BIGNUM *rnd, int bits) {
@@ -850,111 +814,99 @@ static int probable_prime(BIGNUM *rnd, int bits) {
 
 static int probable_prime_dh(BIGNUM *rnd, int bits, const BIGNUM *add,
                              const BIGNUM *rem, BN_CTX *ctx) {
-  int ret = 0;
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *t1;
-
-  BN_CTX_start(ctx);
-  size_t num_primes;
-  if ((t1 = BN_CTX_get(ctx)) == NULL) {
-    goto err;
+  if ((t1 = BN_CTX_get(ctx)) == nullptr) {
+    return 0;
   }
 
   if (!BN_rand(rnd, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD)) {
-    goto err;
+    return 0;
   }
 
   // we need ((rnd-rem) % add) == 0
-
   if (!BN_mod(t1, rnd, add, ctx)) {
-    goto err;
+    return 0;
   }
   if (!BN_sub(rnd, rnd, t1)) {
-    goto err;
+    return 0;
   }
-  if (rem == NULL) {
+  if (rem == nullptr) {
     if (!BN_add_word(rnd, 1)) {
-      goto err;
+      return 0;
     }
   } else {
     if (!BN_add(rnd, rnd, rem)) {
-      goto err;
+      return 0;
     }
   }
   // we now have a random number 'rand' to test.
 
-  num_primes = num_trial_division_primes(rnd);
+  size_t num_primes = num_trial_division_primes(rnd);
 loop:
   for (size_t i = 1; i < num_primes; i++) {
     // check that rnd is a prime
     if (bn_mod_u16_consttime(rnd, kPrimes[i]) <= 1) {
       if (!BN_add(rnd, rnd, add)) {
-        goto err;
+        return 0;
       }
       goto loop;
     }
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 static int probable_prime_dh_safe(BIGNUM *p, int bits, const BIGNUM *padd,
                                   const BIGNUM *rem, BN_CTX *ctx) {
-  int ret = 0;
-  BIGNUM *t1, *qadd, *q;
-
   bits--;
-  BN_CTX_start(ctx);
-  t1 = BN_CTX_get(ctx);
-  q = BN_CTX_get(ctx);
-  qadd = BN_CTX_get(ctx);
-  size_t num_primes;
+  bssl::BN_CTXScope scope(ctx);
+  BIGNUM *t1 = BN_CTX_get(ctx);
+  BIGNUM *q = BN_CTX_get(ctx);
+  BIGNUM *qadd = BN_CTX_get(ctx);
   if (qadd == NULL) {
-    goto err;
+    return 0;
   }
 
   if (!BN_rshift1(qadd, padd)) {
-    goto err;
+    return 0;
   }
 
   if (!BN_rand(q, bits, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ODD)) {
-    goto err;
+    return 0;
   }
 
   // we need ((rnd-rem) % add) == 0
   if (!BN_mod(t1, q, qadd, ctx)) {
-    goto err;
+    return 0;
   }
 
   if (!BN_sub(q, q, t1)) {
-    goto err;
+    return 0;
   }
 
   if (rem == NULL) {
     if (!BN_add_word(q, 1)) {
-      goto err;
+      return 0;
     }
   } else {
     if (!BN_rshift1(t1, rem)) {
-      goto err;
+      return 0;
     }
     if (!BN_add(q, q, t1)) {
-      goto err;
+      return 0;
     }
   }
 
   // we now have a random number 'rand' to test.
   if (!BN_lshift1(p, q)) {
-    goto err;
+    return 0;
   }
   if (!BN_add_word(p, 1)) {
-    goto err;
+    return 0;
   }
 
-  num_primes = num_trial_division_primes(p);
+  size_t num_primes = num_trial_division_primes(p);
 loop:
   for (size_t i = 1; i < num_primes; i++) {
     // check that p and q are prime
@@ -963,18 +915,14 @@ loop:
     if (bn_mod_u16_consttime(p, kPrimes[i]) == 0 ||
         bn_mod_u16_consttime(q, kPrimes[i]) == 0) {
       if (!BN_add(p, p, padd)) {
-        goto err;
+        return 0;
       }
       if (!BN_add(q, q, qadd)) {
-        goto err;
+        return 0;
       }
       goto loop;
     }
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/rsaz_exp.h

@@ -17,8 +17,8 @@
 // (1) Intel Corporation, Israel Development Center, Haifa, Israel
 // (2) University of Haifa, Israel
 
-#ifndef OPENSSL_HEADER_BN_RSAZ_EXP_H
-#define OPENSSL_HEADER_BN_RSAZ_EXP_H
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_RSAZ_EXP_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_RSAZ_EXP_H
 
 #include <openssl/bn.h>
 
@@ -108,4 +108,4 @@ void rsaz_1024_red2norm_avx2(BN_ULONG norm[16], const BN_ULONG red[40]);
 }  // extern "C"
 #endif
 
-#endif  // OPENSSL_HEADER_BN_RSAZ_EXP_H
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_RSAZ_EXP_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/shift.cc.inc

@@ -129,12 +129,11 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n) {
 
 int bn_rshift_secret_shift(BIGNUM *r, const BIGNUM *a, unsigned n,
                            BN_CTX *ctx) {
-  int ret = 0;
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   unsigned max_bits;
   if (tmp == NULL || !BN_copy(r, a) || !bn_wexpand(tmp, r->width)) {
-    goto err;
+    return 0;
   }
 
   // Shift conditionally by powers of two.
@@ -147,11 +146,7 @@ int bn_rshift_secret_shift(BIGNUM *r, const BIGNUM *a, unsigned n,
                     r->d /* ignore shift */, r->width);
   }
 
-  ret = 1;
-
-err:
-  BN_CTX_end(ctx);
-  return ret;
+  return 1;
 }
 
 void bn_rshift1_words(BN_ULONG *r, const BN_ULONG *a, size_t num) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/sqrt.cc.inc

@@ -63,7 +63,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
     return ret;
   }
 
-  BN_CTX_start(ctx);
+  bssl::BN_CTXScope scope(ctx);
   A = BN_CTX_get(ctx);
   b = BN_CTX_get(ctx);
   q = BN_CTX_get(ctx);
@@ -378,82 +378,5 @@ end:
     }
     ret = NULL;
   }
-  BN_CTX_end(ctx);
   return ret;
 }
-
-int BN_sqrt(BIGNUM *out_sqrt, const BIGNUM *in, BN_CTX *ctx) {
-  BIGNUM *estimate, *tmp, *delta, *last_delta, *tmp2;
-  int ok = 0, last_delta_valid = 0;
-
-  if (in->neg) {
-    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
-    return 0;
-  }
-  if (BN_is_zero(in)) {
-    BN_zero(out_sqrt);
-    return 1;
-  }
-
-  BN_CTX_start(ctx);
-  if (out_sqrt == in) {
-    estimate = BN_CTX_get(ctx);
-  } else {
-    estimate = out_sqrt;
-  }
-  tmp = BN_CTX_get(ctx);
-  last_delta = BN_CTX_get(ctx);
-  delta = BN_CTX_get(ctx);
-  if (estimate == NULL || tmp == NULL || last_delta == NULL || delta == NULL) {
-    goto err;
-  }
-
-  // We estimate that the square root of an n-bit number is 2^{n/2}.
-  if (!BN_lshift(estimate, BN_value_one(), BN_num_bits(in)/2)) {
-    goto err;
-  }
-
-  // This is Newton's method for finding a root of the equation |estimate|^2 -
-  // |in| = 0.
-  for (;;) {
-    // |estimate| = 1/2 * (|estimate| + |in|/|estimate|)
-    if (!BN_div(tmp, NULL, in, estimate, ctx) ||
-        !BN_add(tmp, tmp, estimate) ||
-        !BN_rshift1(estimate, tmp) ||
-        // |tmp| = |estimate|^2
-        !BN_sqr(tmp, estimate, ctx) ||
-        // |delta| = |in| - |tmp|
-        !BN_sub(delta, in, tmp)) {
-      OPENSSL_PUT_ERROR(BN, ERR_R_BN_LIB);
-      goto err;
-    }
-
-    delta->neg = 0;
-    // The difference between |in| and |estimate| squared is required to always
-    // decrease. This ensures that the loop always terminates, but I don't have
-    // a proof that it always finds the square root for a given square.
-    if (last_delta_valid && BN_cmp(delta, last_delta) >= 0) {
-      break;
-    }
-
-    last_delta_valid = 1;
-
-    tmp2 = last_delta;
-    last_delta = delta;
-    delta = tmp2;
-  }
-
-  if (BN_cmp(tmp, in) != 0) {
-    OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
-    goto err;
-  }
-
-  ok = 1;
-
-err:
-  if (ok && out_sqrt == in && !BN_copy(out_sqrt, estimate)) {
-    ok = 0;
-  }
-  BN_CTX_end(ctx);
-  return ok;
-}