grpc 1.9.1 → 1.10.0.pre1

data/third_party/boringssl/crypto/rand/urandom.c

@@ -1,335 +0,0 @@
-/* Copyright (c) 2014, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
-
-#if !defined(_GNU_SOURCE)
-#define _GNU_SOURCE  /* needed for syscall() on Linux. */
-#endif
-
-#include <openssl/rand.h>
-
-#if !defined(OPENSSL_WINDOWS) && !defined(OPENSSL_FUCHSIA) && \
-    !defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
-
-#include <assert.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <string.h>
-#include <unistd.h>
-
-#if defined(OPENSSL_LINUX)
-#include <sys/syscall.h>
-#endif
-
-#include <openssl/thread.h>
-#include <openssl/mem.h>
-
-#include "internal.h"
-#include "../internal.h"
-
-
-#if defined(OPENSSL_LINUX)
-
-#if defined(OPENSSL_X86_64)
-#define EXPECTED_SYS_getrandom 318
-#elif defined(OPENSSL_X86)
-#define EXPECTED_SYS_getrandom 355
-#elif defined(OPENSSL_AARCH64)
-#define EXPECTED_SYS_getrandom 278
-#elif defined(OPENSSL_ARM)
-#define EXPECTED_SYS_getrandom 384
-#elif defined(OPENSSL_PPC64LE)
-#define EXPECTED_SYS_getrandom 359
-#endif
-
-#if defined(EXPECTED_SYS_getrandom)
-#define USE_SYS_getrandom
-
-#if defined(SYS_getrandom)
-
-#if SYS_getrandom != EXPECTED_SYS_getrandom
-#error "system call number for getrandom is not the expected value"
-#endif
-
-#else  /* SYS_getrandom */
-
-#define SYS_getrandom EXPECTED_SYS_getrandom
-
-#endif  /* SYS_getrandom */
-
-#endif /* EXPECTED_SYS_getrandom */
-
-#if !defined(GRND_NONBLOCK)
-#define GRND_NONBLOCK 1
-#endif
-
-#endif  /* OPENSSL_LINUX */
-
-/* This file implements a PRNG by reading from /dev/urandom, optionally with a
- * buffer, which is unsafe across |fork|. */
-
-#define BUF_SIZE 4096
-
-/* rand_buffer contains unused, random bytes, some of which may have been
- * consumed already. */
-struct rand_buffer {
-  size_t used;
-  uint8_t rand[BUF_SIZE];
-};
-
-/* requested_lock is used to protect the |*_requested| variables. */
-static struct CRYPTO_STATIC_MUTEX requested_lock = CRYPTO_STATIC_MUTEX_INIT;
-
-/* The following constants are magic values of |urandom_fd|. */
-static const int kUnset = -2;
-static const int kHaveGetrandom = -3;
-
-/* urandom_fd_requested is set by |RAND_set_urandom_fd|. It's protected by
- * |requested_lock|. */
-static int urandom_fd_requested = -2 /* kUnset */;
-
-/* urandom_fd is a file descriptor to /dev/urandom. It's protected by |once|. */
-static int urandom_fd = -2 /* kUnset */;
-
-/* urandom_buffering_requested is set by |RAND_enable_fork_unsafe_buffering|.
- * It's protected by |requested_lock|. */
-static int urandom_buffering_requested = 0;
-
-/* urandom_buffering controls whether buffering is enabled (1) or not (0). This
- * is protected by |once|. */
-static int urandom_buffering = 0;
-
-static CRYPTO_once_t once = CRYPTO_ONCE_INIT;
-
-/* init_once initializes the state of this module to values previously
- * requested. This is the only function that modifies |urandom_fd| and
- * |urandom_buffering|, whose values may be read safely after calling the
- * once. */
-static void init_once(void) {
-  CRYPTO_STATIC_MUTEX_lock_read(&requested_lock);
-  urandom_buffering = urandom_buffering_requested;
-  int fd = urandom_fd_requested;
-  CRYPTO_STATIC_MUTEX_unlock_read(&requested_lock);
-
-#if defined(USE_SYS_getrandom)
-  uint8_t dummy;
-  long getrandom_ret =
-      syscall(SYS_getrandom, &dummy, sizeof(dummy), GRND_NONBLOCK);
-
-  if (getrandom_ret == 1) {
-    urandom_fd = kHaveGetrandom;
-    return;
-  } else if (getrandom_ret == -1 && errno == EAGAIN) {
-    fprintf(stderr,
-            "getrandom indicates that the entropy pool has not been "
-            "initialized. Rather than continue with poor entropy, this process "
-            "will block until entropy is available.\n");
-    do {
-      getrandom_ret =
-          syscall(SYS_getrandom, &dummy, sizeof(dummy), 0 /* no flags */);
-    } while (getrandom_ret == -1 && errno == EINTR);
-
-    if (getrandom_ret == 1) {
-      urandom_fd = kHaveGetrandom;
-      return;
-    }
-  }
-#endif  /* USE_SYS_getrandom */
-
-  if (fd == kUnset) {
-    do {
-      fd = open("/dev/urandom", O_RDONLY);
-    } while (fd == -1 && errno == EINTR);
-  }
-
-  if (fd < 0) {
-    abort();
-  }
-
-  int flags = fcntl(fd, F_GETFD);
-  if (flags == -1) {
-    /* Native Client doesn't implement |fcntl|. */
-    if (errno != ENOSYS) {
-      abort();
-    }
-  } else {
-    flags |= FD_CLOEXEC;
-    if (fcntl(fd, F_SETFD, flags) == -1) {
-      abort();
-    }
-  }
-  urandom_fd = fd;
-}
-
-void RAND_set_urandom_fd(int fd) {
-  fd = dup(fd);
-  if (fd < 0) {
-    abort();
-  }
-
-  CRYPTO_STATIC_MUTEX_lock_write(&requested_lock);
-  urandom_fd_requested = fd;
-  CRYPTO_STATIC_MUTEX_unlock_write(&requested_lock);
-
-  CRYPTO_once(&once, init_once);
-  if (urandom_fd == kHaveGetrandom) {
-    close(fd);
-  } else if (urandom_fd != fd) {
-    abort();  // Already initialized.
-  }
-}
-
-void RAND_enable_fork_unsafe_buffering(int fd) {
-  if (fd >= 0) {
-    fd = dup(fd);
-    if (fd < 0) {
-      abort();
-    }
-  } else {
-    fd = kUnset;
-  }
-
-  CRYPTO_STATIC_MUTEX_lock_write(&requested_lock);
-  urandom_buffering_requested = 1;
-  urandom_fd_requested = fd;
-  CRYPTO_STATIC_MUTEX_unlock_write(&requested_lock);
-
-  CRYPTO_once(&once, init_once);
-  if (urandom_buffering != 1) {
-    abort();  // Already initialized
-  }
-
-  if (fd >= 0) {
-    if (urandom_fd == kHaveGetrandom) {
-      close(fd);
-    } else if (urandom_fd != fd) {
-      abort();  // Already initialized.
-    }
-  }
-}
-
-static struct rand_buffer *get_thread_local_buffer(void) {
-  struct rand_buffer *buf =
-      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_URANDOM_BUF);
-  if (buf != NULL) {
-    return buf;
-  }
-
-  buf = OPENSSL_malloc(sizeof(struct rand_buffer));
-  if (buf == NULL) {
-    return NULL;
-  }
-  buf->used = BUF_SIZE;  /* To trigger a |fill_with_entropy| on first use. */
-  if (!CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_URANDOM_BUF, buf,
-                               OPENSSL_free)) {
-    OPENSSL_free(buf);
-    return NULL;
-  }
-
-  return buf;
-}
-
-#if defined(USE_SYS_getrandom) && defined(__has_feature)
-#if __has_feature(memory_sanitizer)
-void __msan_unpoison(void *, size_t);
-#endif
-#endif
-
-/* fill_with_entropy writes |len| bytes of entropy into |out|. It returns one
- * on success and zero on error. */
-static char fill_with_entropy(uint8_t *out, size_t len) {
-  while (len > 0) {
-    ssize_t r;
-
-    if (urandom_fd == kHaveGetrandom) {
-#if defined(USE_SYS_getrandom)
-      do {
-        r = syscall(SYS_getrandom, out, len, 0 /* no flags */);
-      } while (r == -1 && errno == EINTR);
-
-#if defined(__has_feature)
-#if __has_feature(memory_sanitizer)
-      if (r > 0) {
-        /* MSAN doesn't recognise |syscall| and thus doesn't notice that we
-         * have initialised the output buffer. */
-        __msan_unpoison(out, r);
-      }
-#endif /* memory_sanitizer */
-#endif /*__has_feature */
-
-#else /* USE_SYS_getrandom */
-      abort();
-#endif
-    } else {
-      do {
-        r = read(urandom_fd, out, len);
-      } while (r == -1 && errno == EINTR);
-    }
-
-    if (r <= 0) {
-      return 0;
-    }
-    out += r;
-    len -= r;
-  }
-
-  return 1;
-}
-
-/* read_from_buffer reads |requested| random bytes from the buffer into |out|,
- * refilling it if necessary to satisfy the request. */
-static void read_from_buffer(struct rand_buffer *buf,
-                             uint8_t *out, size_t requested) {
-  size_t remaining = BUF_SIZE - buf->used;
-
-  while (requested > remaining) {
-    OPENSSL_memcpy(out, &buf->rand[buf->used], remaining);
-    buf->used += remaining;
-    out += remaining;
-    requested -= remaining;
-
-    if (!fill_with_entropy(buf->rand, BUF_SIZE)) {
-      abort();
-      return;
-    }
-    buf->used = 0;
-    remaining = BUF_SIZE;
-  }
-
-  OPENSSL_memcpy(out, &buf->rand[buf->used], requested);
-  buf->used += requested;
-}
-
-/* CRYPTO_sysrand puts |requested| random bytes into |out|. */
-void CRYPTO_sysrand(uint8_t *out, size_t requested) {
-  if (requested == 0) {
-    return;
-  }
-
-  CRYPTO_once(&once, init_once);
-  if (urandom_buffering && requested < BUF_SIZE) {
-    struct rand_buffer *buf = get_thread_local_buffer();
-    if (buf != NULL) {
-      read_from_buffer(buf, out, requested);
-      return;
-    }
-  }
-
-  if (!fill_with_entropy(out, requested)) {
-    abort();
-  }
-}
-
-#endif /* !OPENSSL_WINDOWS && !defined(OPENSSL_FUCHSIA) && \
-          !BORINGSSL_UNSAFE_DETERMINISTIC_MODE */

data/third_party/boringssl/crypto/rsa/blinding.c

@@ -1,265 +0,0 @@
-/* ====================================================================
- * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- * Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
-
-#include <openssl/rsa.h>
-
-#include <string.h>
-
-#include <openssl/bn.h>
-#include <openssl/mem.h>
-#include <openssl/err.h>
-
-#include "internal.h"
-#include "../internal.h"
-
-
-#define BN_BLINDING_COUNTER 32
-
-struct bn_blinding_st {
-  BIGNUM *A; /* The base blinding factor, Montgomery-encoded. */
-  BIGNUM *Ai; /* The inverse of the blinding factor, Montgomery-encoded. */
-  unsigned counter;
-};
-
-static int bn_blinding_create_param(BN_BLINDING *b, const BIGNUM *e,
-                                    const BN_MONT_CTX *mont, BN_CTX *ctx);
-
-BN_BLINDING *BN_BLINDING_new(void) {
-  BN_BLINDING *ret = OPENSSL_malloc(sizeof(BN_BLINDING));
-  if (ret == NULL) {
-    OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);
-    return NULL;
-  }
-  OPENSSL_memset(ret, 0, sizeof(BN_BLINDING));
-
-  ret->A = BN_new();
-  if (ret->A == NULL) {
-    goto err;
-  }
-
-  ret->Ai = BN_new();
-  if (ret->Ai == NULL) {
-    goto err;
-  }
-
-  /* The blinding values need to be created before this blinding can be used. */
-  ret->counter = BN_BLINDING_COUNTER - 1;
-
-  return ret;
-
-err:
-  BN_BLINDING_free(ret);
-  return NULL;
-}
-
-void BN_BLINDING_free(BN_BLINDING *r) {
-  if (r == NULL) {
-    return;
-  }
-
-  BN_free(r->A);
-  BN_free(r->Ai);
-  OPENSSL_free(r);
-}
-
-static int bn_blinding_update(BN_BLINDING *b, const BIGNUM *e,
-                              const BN_MONT_CTX *mont, BN_CTX *ctx) {
-  if (++b->counter == BN_BLINDING_COUNTER) {
-    /* re-create blinding parameters */
-    if (!bn_blinding_create_param(b, e, mont, ctx)) {
-      goto err;
-    }
-    b->counter = 0;
-  } else {
-    if (!BN_mod_mul_montgomery(b->A, b->A, b->A, mont, ctx) ||
-        !BN_mod_mul_montgomery(b->Ai, b->Ai, b->Ai, mont, ctx)) {
-      goto err;
-    }
-  }
-
-  return 1;
-
-err:
-  /* |A| and |Ai| may be in an inconsistent state so they both need to be
-   * replaced the next time this blinding is used. Note that this is only
-   * sufficient because support for |BN_BLINDING_NO_UPDATE| and
-   * |BN_BLINDING_NO_RECREATE| was previously dropped. */
-  b->counter = BN_BLINDING_COUNTER - 1;
-
-  return 0;
-}
-
-int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, const BIGNUM *e,
-                        const BN_MONT_CTX *mont, BN_CTX *ctx) {
-  /* |n| is not Montgomery-encoded and |b->A| is. |BN_mod_mul_montgomery|
-   * cancels one Montgomery factor, so the resulting value of |n| is unencoded.
-   */
-  if (!bn_blinding_update(b, e, mont, ctx) ||
-      !BN_mod_mul_montgomery(n, n, b->A, mont, ctx)) {
-    return 0;
-  }
-
-  return 1;
-}
-
-int BN_BLINDING_invert(BIGNUM *n, const BN_BLINDING *b, BN_MONT_CTX *mont,
-                       BN_CTX *ctx) {
-  /* |n| is not Montgomery-encoded and |b->A| is. |BN_mod_mul_montgomery|
-   * cancels one Montgomery factor, so the resulting value of |n| is unencoded.
-   */
-  return BN_mod_mul_montgomery(n, n, b->Ai, mont, ctx);
-}
-
-static int bn_blinding_create_param(BN_BLINDING *b, const BIGNUM *e,
-                                    const BN_MONT_CTX *mont, BN_CTX *ctx) {
-  int retry_counter = 32;
-
-  do {
-    if (!BN_rand_range_ex(b->A, 1, &mont->N)) {
-      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
-      return 0;
-    }
-
-    /* |BN_from_montgomery| + |BN_mod_inverse_blinded| is equivalent to, but
-     * more efficient than, |BN_mod_inverse_blinded| + |BN_to_montgomery|. */
-    if (!BN_from_montgomery(b->Ai, b->A, mont, ctx)) {
-      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
-      return 0;
-    }
-
-    int no_inverse;
-    if (BN_mod_inverse_blinded(b->Ai, &no_inverse, b->Ai, mont, ctx)) {
-      break;
-    }
-
-    if (!no_inverse) {
-      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
-      return 0;
-    }
-
-    /* For reasonably-sized RSA keys, it should almost never be the case that a
-     * random value doesn't have an inverse. */
-    if (retry_counter-- == 0) {
-      OPENSSL_PUT_ERROR(RSA, RSA_R_TOO_MANY_ITERATIONS);
-      return 0;
-    }
-    ERR_clear_error();
-  } while (1);
-
-  if (!BN_mod_exp_mont(b->A, b->A, e, &mont->N, ctx, mont)) {
-    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
-    return 0;
-  }
-
-  if (!BN_to_montgomery(b->A, b->A, mont, ctx)) {
-    OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
-    return 0;
-  }
-
-  return 1;
-}