grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/rsa/internal.h

@@ -21,71 +21,85 @@
 #include <openssl/rsa.h>
 
 #include "../../internal.h"
+#include "../../mem_internal.h"
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
 
+DECLARE_OPAQUE_STRUCT(rsa_st, RSAImpl)
 
-typedef struct bn_blinding_st BN_BLINDING;
+BSSL_NAMESPACE_BEGIN
 
-struct rsa_st {
-  RSA_METHOD *meth;
+// TODO(crbug.com/42290480): Raise this limit. 512-bit RSA was factored in 1999.
+#define OPENSSL_RSA_MIN_MODULUS_BITS 512
 
-  BIGNUM *n;
-  BIGNUM *e;
-  BIGNUM *d;
-  BIGNUM *p;
-  BIGNUM *q;
-  BIGNUM *dmp1;
-  BIGNUM *dmq1;
-  BIGNUM *iqmp;
+// TODO(davidben): This is inside BCM because `RSA` is inside BCM, but BCM never
+// uses this. Split the RSA type in two.
+enum rsa_pss_params_t {
+  // No parameters.
+  // TODO(davidben): Remove this and use std::optional where appropriate.
+  rsa_pss_none = 0,
+  // RSA-PSS using SHA-256, MGF1 with SHA-256, salt length 32.
+  rsa_pss_sha256,
+  // RSA-PSS using SHA-384, MGF1 with SHA-384, salt length 48.
+  rsa_pss_sha384,
+  // RSA-PSS using SHA-512, MGF1 with SHA-512, salt length 64.
+  rsa_pss_sha512,
+};
+
+class RSAImpl : public rsa_st, public RefCounted<RSAImpl> {
+ public:
+  explicit RSAImpl(const ENGINE *engine);
+
+  RSA_METHOD *meth = nullptr;
+
+  UniquePtr<BIGNUM> n;
+  UniquePtr<BIGNUM> e;
+  UniquePtr<BIGNUM> d;
+  UniquePtr<BIGNUM> p;
+  UniquePtr<BIGNUM> q;
+  UniquePtr<BIGNUM> dmp1;
+  UniquePtr<BIGNUM> dmq1;
+  UniquePtr<BIGNUM> iqmp;
 
   // be careful using this if the RSA structure is shared
-  CRYPTO_EX_DATA ex_data;
-  CRYPTO_refcount_t references;
-  int flags;
+  CRYPTO_EX_DATA ex_data = {};
+  int flags = 0;
 
-  CRYPTO_MUTEX lock;
+  Mutex lock;
 
   // Used to cache montgomery values. The creation of these values is protected
-  // by |lock|.
-  BN_MONT_CTX *mont_n;
-  BN_MONT_CTX *mont_p;
-  BN_MONT_CTX *mont_q;
+  // by `lock`.
+  UniquePtr<BN_MONT_CTX> mont_n;
+  UniquePtr<BN_MONT_CTX> mont_p;
+  UniquePtr<BN_MONT_CTX> mont_q;
 
-  // The following fields are copies of |d|, |dmp1|, and |dmq1|, respectively,
+  // The following fields are copies of `d`, `dmp1`, and `dmq1`, respectively,
   // but with the correct widths to prevent side channels. These must use
   // separate copies due to threading concerns caused by OpenSSL's API
   // mistakes. See https://github.com/openssl/openssl/issues/5158 and
-  // the |freeze_private_key| implementation.
-  BIGNUM *d_fixed, *dmp1_fixed, *dmq1_fixed;
-
-  // iqmp_mont is q^-1 mod p in Montgomery form, using |mont_p|.
-  BIGNUM *iqmp_mont;
-
-  // num_blindings contains the size of the |blindings| and |blindings_inuse|
-  // arrays. This member and the |blindings_inuse| array are protected by
-  // |lock|.
-  size_t num_blindings;
-  // blindings is an array of BN_BLINDING structures that can be reserved by a
-  // thread by locking |lock| and changing the corresponding element in
-  // |blindings_inuse| from 0 to 1.
-  BN_BLINDING **blindings;
-  unsigned char *blindings_inuse;
-  uint64_t blinding_fork_generation;
+  // the `freeze_private_key` implementation.
+  UniquePtr<BIGNUM> d_fixed, dmp1_fixed, dmq1_fixed;
+
+  // iqmp_mont is q^-1 mod p in Montgomery form, using `mont_p`.
+  UniquePtr<BIGNUM> iqmp_mont;
+
+  // pss_params is the RSA-PSS parameters associated with the key. This is not
+  // used by the low-level RSA implementation, just the EVP layer.
+  bssl::rsa_pss_params_t pss_params = bssl::rsa_pss_none;
 
   // private_key_frozen is one if the key has been used for a private key
   // operation and may no longer be mutated.
-  unsigned private_key_frozen:1;
-};
+  unsigned private_key_frozen = 0;
 
+ private:
+  friend RefCounted;
+  ~RSAImpl();
+};
 
 #define RSA_PKCS1_PADDING_SIZE 11
 
 // Default implementations of RSA operations.
 
-const RSA_METHOD *RSA_default_method(void);
+const RSA_METHOD *RSA_default_method();
 
 int rsa_default_sign_raw(RSA *rsa, size_t *out_len, uint8_t *out,
                          size_t max_out, const uint8_t *in, size_t in_len,
@@ -94,15 +108,6 @@ int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
                                   size_t len);
 
 
-BN_BLINDING *BN_BLINDING_new(void);
-void BN_BLINDING_free(BN_BLINDING *b);
-void BN_BLINDING_invalidate(BN_BLINDING *b);
-int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, const BIGNUM *e,
-                        const BN_MONT_CTX *mont_ctx, BN_CTX *ctx);
-int BN_BLINDING_invert(BIGNUM *n, const BN_BLINDING *b, BN_MONT_CTX *mont_ctx,
-                       BN_CTX *ctx);
-
-
 int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed, size_t seed_len,
                const EVP_MD *md);
 int RSA_padding_add_PKCS1_type_1(uint8_t *to, size_t to_len,
@@ -113,34 +118,29 @@ int RSA_padding_check_PKCS1_type_1(uint8_t *out, size_t *out_len,
 int RSA_padding_add_none(uint8_t *to, size_t to_len, const uint8_t *from,
                          size_t from_len);
 
-// rsa_check_public_key checks that |rsa|'s public modulus and exponent are
+// rsa_check_public_key checks that `rsa`'s public modulus and exponent are
 // within DoS bounds.
 int rsa_check_public_key(const RSA *rsa);
 
 // rsa_private_transform_no_self_test calls either the method-specific
-// |private_transform| function (if given) or the generic one. See the comment
-// for |private_transform| in |rsa_meth_st|.
+// `private_transform` function (if given) or the generic one. See the comment
+// for `private_transform` in `rsa_meth_st`.
 int rsa_private_transform_no_self_test(RSA *rsa, uint8_t *out,
                                        const uint8_t *in, size_t len);
 
-// rsa_private_transform acts the same as |rsa_private_transform_no_self_test|
+// rsa_private_transform acts the same as `rsa_private_transform_no_self_test`
 // but, in FIPS mode, performs an RSA self test before calling the default RSA
 // implementation.
 int rsa_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
                           size_t len);
 
-// rsa_invalidate_key is called after |rsa| has been mutated, to invalidate
+// rsa_invalidate_key is called after `rsa` has been mutated, to invalidate
 // fields derived from the original structure. This function assumes exclusive
-// access to |rsa|. In particular, no other thread may be concurrently signing,
-// etc., with |rsa|.
+// access to `rsa`. In particular, no other thread may be concurrently signing,
+// etc., with `rsa`.
 void rsa_invalidate_key(RSA *rsa);
 
 
-// This constant is exported for test purposes.
-extern const BN_ULONG kBoringSSLRSASqrtTwo[];
-extern const size_t kBoringSSLRSASqrtTwoLen;
-
-
 // Functions that avoid self-tests.
 //
 // Self-tests need to call functions that don't try and ensure that the
@@ -162,9 +162,6 @@ int rsa_sign_no_self_test(int hash_nid, const uint8_t *digest,
                           size_t digest_len, uint8_t *out, unsigned *out_len,
                           RSA *rsa);
 
-
-#if defined(__cplusplus)
-}  // extern C
-#endif
+BSSL_NAMESPACE_END
 
 #endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_RSA_INTERNAL_H

data/third_party/boringssl-with-bazel/crypto/fipsmodule/rsa/padding.cc.inc

@@ -29,8 +29,10 @@
 #include "internal.h"
 
 
-int RSA_padding_add_PKCS1_type_1(uint8_t *to, size_t to_len,
-                                 const uint8_t *from, size_t from_len) {
+using namespace bssl;
+
+int bssl::RSA_padding_add_PKCS1_type_1(uint8_t *to, size_t to_len,
+                                       const uint8_t *from, size_t from_len) {
   // See RFC 8017, section 9.2.
   if (to_len < RSA_PKCS1_PADDING_SIZE) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
@@ -50,9 +52,9 @@ int RSA_padding_add_PKCS1_type_1(uint8_t *to, size_t to_len,
   return 1;
 }
 
-int RSA_padding_check_PKCS1_type_1(uint8_t *out, size_t *out_len,
-                                   size_t max_out, const uint8_t *from,
-                                   size_t from_len) {
+int bssl::RSA_padding_check_PKCS1_type_1(uint8_t *out, size_t *out_len,
+                                         size_t max_out, const uint8_t *from,
+                                         size_t from_len) {
   // See RFC 8017, section 9.2. This is part of signature verification and thus
   // does not need to run in constant-time.
   if (from_len < 2) {
@@ -102,8 +104,8 @@ int RSA_padding_check_PKCS1_type_1(uint8_t *out, size_t *out_len,
   return 1;
 }
 
-int RSA_padding_add_none(uint8_t *to, size_t to_len, const uint8_t *from,
-                         size_t from_len) {
+int bssl::RSA_padding_add_none(uint8_t *to, size_t to_len, const uint8_t *from,
+                               size_t from_len) {
   if (from_len > to_len) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
     return 0;
@@ -118,11 +120,10 @@ int RSA_padding_add_none(uint8_t *to, size_t to_len, const uint8_t *from,
   return 1;
 }
 
-int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed, size_t seed_len,
-               const EVP_MD *md) {
+int bssl::PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed,
+                     size_t seed_len, const EVP_MD *md) {
   int ret = 0;
-  EVP_MD_CTX ctx;
-  EVP_MD_CTX_init(&ctx);
+  ScopedEVP_MD_CTX ctx;
   FIPS_service_indicator_lock_state();
 
   size_t md_len = EVP_MD_size(md);
@@ -133,21 +134,21 @@ int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed, size_t seed_len,
     counter[1] = (uint8_t)(i >> 16);
     counter[2] = (uint8_t)(i >> 8);
     counter[3] = (uint8_t)i;
-    if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
-        !EVP_DigestUpdate(&ctx, seed, seed_len) ||
-        !EVP_DigestUpdate(&ctx, counter, sizeof(counter))) {
+    if (!EVP_DigestInit_ex(ctx.get(), md, nullptr) ||
+        !EVP_DigestUpdate(ctx.get(), seed, seed_len) ||
+        !EVP_DigestUpdate(ctx.get(), counter, sizeof(counter))) {
       goto err;
     }
 
     if (md_len <= len) {
-      if (!EVP_DigestFinal_ex(&ctx, out, NULL)) {
+      if (!EVP_DigestFinal_ex(ctx.get(), out, nullptr)) {
         goto err;
       }
       out += md_len;
       len -= md_len;
     } else {
       uint8_t digest[EVP_MAX_MD_SIZE];
-      if (!EVP_DigestFinal_ex(&ctx, digest, NULL)) {
+      if (!EVP_DigestFinal_ex(ctx.get(), digest, nullptr)) {
         goto err;
       }
       OPENSSL_memcpy(out, digest, len);
@@ -158,7 +159,6 @@ int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed, size_t seed_len,
   ret = 1;
 
 err:
-  EVP_MD_CTX_cleanup(&ctx);
   FIPS_service_indicator_unlock_state();
   return ret;
 }
@@ -168,34 +168,31 @@ static const uint8_t kPSSZeroes[] = {0, 0, 0, 0, 0, 0, 0, 0};
 int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
                               const EVP_MD *Hash, const EVP_MD *mgf1Hash,
                               const uint8_t *EM, int sLen) {
-  if (mgf1Hash == NULL) {
+  if (mgf1Hash == nullptr) {
     mgf1Hash = Hash;
   }
 
   int ret = 0;
-  uint8_t *DB = NULL;
+  uint8_t *DB = nullptr;
   const uint8_t *H;
-  EVP_MD_CTX ctx;
-  EVP_MD_CTX_init(&ctx);
+  ScopedEVP_MD_CTX ctx;
   unsigned MSBits;
   size_t emLen, maskedDBLen, salt_start;
   FIPS_service_indicator_lock_state();
 
-  // Negative sLen has special meanings:
-  //   -1      sLen == hLen
-  //   -2      salt length is autorecovered from signature
-  //   -N      reserved
   size_t hLen = EVP_MD_size(Hash);
-  if (sLen == -1) {
+  if (sLen == RSA_PSS_SALTLEN_DIGEST) {
     sLen = (int)hLen;
-  } else if (sLen == -2) {
-    sLen = -2;
-  } else if (sLen < -2) {
+  } else if (sLen == RSA_PSS_SALTLEN_AUTO) {
+    // Leave `sLen` negative, which will trigger the logic below to recover and
+    // allow any salt length.
+  } else if (sLen < 0) {
+    // Other negative values are reserved.
     OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED);
     goto err;
   }
 
-  MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
+  MSBits = (RSA_bits(rsa) - 1) & 0x7;
   emLen = RSA_size(rsa);
   if (EM[0] & (0xFF << MSBits)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_FIRST_OCTET_INVALID);
@@ -205,7 +202,7 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
     EM++;
     emLen--;
   }
-  // |sLen| may be -2 for the non-standard salt length recovery mode.
+  // `sLen` may be negative for the non-standard salt length recovery mode.
   if (emLen < hLen + 2 || (sLen >= 0 && emLen < hLen + (size_t)sLen + 2)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE);
     goto err;
@@ -247,11 +244,11 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
     goto err;
   }
   uint8_t H_[EVP_MAX_MD_SIZE];
-  if (!EVP_DigestInit_ex(&ctx, Hash, NULL) ||
-      !EVP_DigestUpdate(&ctx, kPSSZeroes, sizeof(kPSSZeroes)) ||
-      !EVP_DigestUpdate(&ctx, mHash, hLen) ||
-      !EVP_DigestUpdate(&ctx, DB + salt_start, maskedDBLen - salt_start) ||
-      !EVP_DigestFinal_ex(&ctx, H_, NULL)) {
+  if (!EVP_DigestInit_ex(ctx.get(), Hash, nullptr) ||
+      !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) ||
+      !EVP_DigestUpdate(ctx.get(), mHash, hLen) ||
+      !EVP_DigestUpdate(ctx.get(), DB + salt_start, maskedDBLen - salt_start) ||
+      !EVP_DigestFinal_ex(ctx.get(), H_, nullptr)) {
     goto err;
   }
   if (OPENSSL_memcmp(H_, H, hLen) != 0) {
@@ -263,7 +260,6 @@ int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
 
 err:
   OPENSSL_free(DB);
-  EVP_MD_CTX_cleanup(&ctx);
   FIPS_service_indicator_unlock_state();
   return ret;
 }
@@ -272,24 +268,26 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
                                    const unsigned char *mHash,
                                    const EVP_MD *Hash, const EVP_MD *mgf1Hash,
                                    int sLenRequested) {
-  int ret = 0, digest_ok;
+  int ret = 0;
+  ScopedEVP_MD_CTX ctx;
   size_t maskedDBLen, MSBits, emLen;
   size_t hLen;
-  unsigned char *H, *salt = NULL, *p;
+  unsigned char *H, *salt = nullptr, *p;
 
-  if (mgf1Hash == NULL) {
+  if (mgf1Hash == nullptr) {
     mgf1Hash = Hash;
   }
 
   FIPS_service_indicator_lock_state();
   hLen = EVP_MD_size(Hash);
 
-  if (BN_is_zero(rsa->n)) {
+  unsigned rsa_bits = RSA_bits(rsa);
+  if (rsa_bits == 0) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_EMPTY_PUBLIC_KEY);
     goto err;
   }
 
-  MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
+  MSBits = (rsa_bits - 1) & 0x7;
   emLen = RSA_size(rsa);
   if (MSBits == 0) {
     assert(emLen >= 1);
@@ -302,16 +300,14 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
     goto err;
   }
 
-  // Negative sLenRequested has special meanings:
-  //   -1  sLen == hLen
-  //   -2  salt length is maximized
-  //   -N  reserved
   size_t sLen;
-  if (sLenRequested == -1) {
+  if (sLenRequested == RSA_PSS_SALTLEN_DIGEST) {
     sLen = hLen;
-  } else if (sLenRequested == -2) {
+  } else if (sLenRequested == RSA_PSS_SALTLEN_AUTO) {
+    // Use the maximum possible salt length.
     sLen = emLen - hLen - 2;
   } else if (sLenRequested < 0) {
+    // Other negative values are reserved.
     OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED);
     goto err;
   } else {
@@ -333,15 +329,11 @@ int RSA_padding_add_PKCS1_PSS_mgf1(const RSA *rsa, unsigned char *EM,
   maskedDBLen = emLen - hLen - 1;
   H = EM + maskedDBLen;
 
-  EVP_MD_CTX ctx;
-  EVP_MD_CTX_init(&ctx);
-  digest_ok = EVP_DigestInit_ex(&ctx, Hash, NULL) &&
-              EVP_DigestUpdate(&ctx, kPSSZeroes, sizeof(kPSSZeroes)) &&
-              EVP_DigestUpdate(&ctx, mHash, hLen) &&
-              EVP_DigestUpdate(&ctx, salt, sLen) &&
-              EVP_DigestFinal_ex(&ctx, H, NULL);
-  EVP_MD_CTX_cleanup(&ctx);
-  if (!digest_ok) {
+  if (!EVP_DigestInit_ex(ctx.get(), Hash, nullptr) ||
+      !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) ||
+      !EVP_DigestUpdate(ctx.get(), mHash, hLen) ||
+      !EVP_DigestUpdate(ctx.get(), salt, sLen) ||
+      !EVP_DigestFinal_ex(ctx.get(), H, nullptr)) {
     goto err;
   }