@fails-components/webtransport 0.0.1-rc.2 → 0.0.1

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/3c75fe79266cf639f2180722a3f03f8fc3e25685

@@ -0,0 +1 @@
+0+H[�

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/3fbb104fb0eb6cae4af34d8a516998336b3a6778

@@ -0,0 +1 @@
+���3

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/4bd69e424b6fa38f9e63e58b8d0e95ac2d38d598

@@ -0,0 +1 @@
+0
0

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/52d2c7efcd7da0eb7463829e05a598e36729bfae

@@ -0,0 +1 @@
+3

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/53ea84c48a5792281a46eb5a9c896d54ea3f1838

@@ -0,0 +1 @@
+n�

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/5bab61eb53176449e25c2c82f172b82cb13ffb9d

@@ -0,0 +1 @@
+?

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/6cad8b2a41194372ec897bece6512fe8331e274d

@@ -0,0 +1 @@
+;�

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/77de68daecd823babbb58edb1c8e14d7106e83bb

@@ -0,0 +1 @@
+3

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/872ba8af52a8c1380c388bab0e20bec2e729db80

@@ -0,0 +1 @@
+��

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/935a69e9f3bfa1dd3bf058fa3e1b953e82195de6

@@ -0,0 +1 @@
+0���

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/a457945cb86ec812235f407ed70fe72fbaf694a1

@@ -0,0 +1 @@
+��܅�����

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/a4fc609a6546fc0061f499f0faed9054fd388c9a

@@ -0,0 +1 @@
+00E 

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/a7c13e6fe60eee08b9aac00a095a9301ea1a9824

@@ -0,0 +1 @@
+@@

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/b37e0f6fa42840c773747c4cb608c278ab65021d

@@ -0,0 +1 @@
+w�ͳ

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/b95311782071c4d9182c0effe32487fc5cdbd33d

@@ -0,0 +1 @@
+0<�

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/bc26b8c794ac0adf948cbca02e88b3901824ef17

@@ -0,0 +1 @@
+0�

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/bc7b23c2c68e4ad33ecea493ff6e60d423371cd0

@@ -0,0 +1 @@
+��܅����Ԏ

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/ceee46f04a09ef5d3342ef25d9f483e861727575

@@ -0,0 +1 @@
+0��

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/d18c30ba21e0d085dd983ad528f2c9001285d3d2

@@ -0,0 +1 @@
+0�e

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/d2c00146b2f2bcb4c6cecb731d2062273523d8c8

@@ -0,0 +1 @@
+0��

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/defce76f0d3c3e057bb623986bacee7bbd07d1a1

@@ -0,0 +1 @@
+?�

package/third_party/boringssl/src/fuzz/der_roundtrip_corpus/e5b420f71cf412bd9fdebdd46245fabd1f3462e5

@@ -0,0 +1 @@
+0�����_

package/third_party/boringssl/src/include/openssl/cipher.h

@@ -174,6 +174,11 @@ OPENSSL_EXPORT int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx,
 // of output bytes may be up to |in_len| plus the block length minus one and
 // |out| must have sufficient space. The number of bytes actually output is
 // written to |*out_len|. It returns one on success and zero otherwise.
+//
+// If |ctx| is an AEAD cipher, e.g. |EVP_aes_128_gcm|, and |out| is NULL, this
+// function instead adds |in_len| bytes from |in| to the AAD and sets |*out_len|
+// to |in_len|. The AAD must be fully specified in this way before this function
+// is used to encrypt plaintext.
 OPENSSL_EXPORT int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, uint8_t *out,
                                      int *out_len, const uint8_t *in,
                                      int in_len);
@@ -191,6 +196,11 @@ OPENSSL_EXPORT int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, uint8_t *out,
 // output bytes may be up to |in_len| plus the block length minus one and |out|
 // must have sufficient space. The number of bytes actually output is written
 // to |*out_len|. It returns one on success and zero otherwise.
+//
+// If |ctx| is an AEAD cipher, e.g. |EVP_aes_128_gcm|, and |out| is NULL, this
+// function instead adds |in_len| bytes from |in| to the AAD and sets |*out_len|
+// to |in_len|. The AAD must be fully specified in this way before this function
+// is used to decrypt ciphertext.
 OPENSSL_EXPORT int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, uint8_t *out,
                                      int *out_len, const uint8_t *in,
                                      int in_len);
@@ -204,16 +214,18 @@ OPENSSL_EXPORT int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, uint8_t *out,
 OPENSSL_EXPORT int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, uint8_t *out,
                                        int *out_len);
 
-// EVP_Cipher performs a one-shot encryption/decryption operation. No partial
-// blocks are maintained between calls. However, any internal cipher state is
-// still updated. For CBC-mode ciphers, the IV is updated to the final
-// ciphertext block. For stream ciphers, the stream is advanced past the bytes
-// used. It returns one on success and zero otherwise, unless |EVP_CIPHER_flags|
-// has |EVP_CIPH_FLAG_CUSTOM_CIPHER| set. Then it returns the number of bytes
-// written or -1 on error.
+// EVP_Cipher performs a one-shot encryption/decryption operation for non-AEAD
+// ciphers. No partial blocks are maintained between calls. However, any
+// internal cipher state is still updated. For CBC-mode ciphers, the IV is
+// updated to the final ciphertext block. For stream ciphers, the stream is
+// advanced past the bytes used. It returns one on success and zero otherwise.
 //
-// WARNING: this differs from the usual return value convention when using
-// |EVP_CIPH_FLAG_CUSTOM_CIPHER|.
+// WARNING: This function behaves completely differently on AEAD ciphers, such
+// as |EVP_aes_128_gcm|. Rather than being a one-shot operation, it behaves like
+// |EVP_CipherUpdate| or |EVP_CipherFinal_ex|, depending on whether |in| is
+// NULL. It also instead returns the number of bytes written or -1 on error.
+// This behavior is deprecated. Use |EVP_CipherUpdate| or |EVP_CipherFinal_ex|
+// instead.
 //
 // TODO(davidben): The normal ciphers currently never fail, even if, e.g.,
 // |in_len| is not a multiple of the block size for CBC-mode decryption. The
@@ -582,45 +594,6 @@ typedef struct evp_cipher_info_st {
   unsigned char iv[EVP_MAX_IV_LENGTH];
 } EVP_CIPHER_INFO;
 
-struct evp_cipher_st {
-  // type contains a NID identifing the cipher. (e.g. NID_aes_128_gcm.)
-  int nid;
-
-  // block_size contains the block size, in bytes, of the cipher, or 1 for a
-  // stream cipher.
-  unsigned block_size;
-
-  // key_len contains the key size, in bytes, for the cipher. If the cipher
-  // takes a variable key size then this contains the default size.
-  unsigned key_len;
-
-  // iv_len contains the IV size, in bytes, or zero if inapplicable.
-  unsigned iv_len;
-
-  // ctx_size contains the size, in bytes, of the per-key context for this
-  // cipher.
-  unsigned ctx_size;
-
-  // flags contains the OR of a number of flags. See |EVP_CIPH_*|.
-  uint32_t flags;
-
-  // app_data is a pointer to opaque, user data.
-  void *app_data;
-
-  int (*init)(EVP_CIPHER_CTX *ctx, const uint8_t *key, const uint8_t *iv,
-              int enc);
-
-  int (*cipher)(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
-                size_t inl);
-
-  // cleanup, if non-NULL, releases memory associated with the context. It is
-  // called if |EVP_CTRL_INIT| succeeds. Note that |init| may not have been
-  // called at this point.
-  void (*cleanup)(EVP_CIPHER_CTX *);
-
-  int (*ctrl)(EVP_CIPHER_CTX *, int type, int arg, void *ptr);
-};
-
 
 #if defined(__cplusplus)
 }  // extern C

package/third_party/boringssl/src/include/openssl/ssl.h

@@ -5104,6 +5104,44 @@ OPENSSL_EXPORT int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg);
 OPENSSL_EXPORT uint16_t SSL_CIPHER_get_value(const SSL_CIPHER *cipher);
 
 
+// Compliance policy configurations
+//
+// A TLS connection has a large number of different parameters. Some are well
+// known, like cipher suites, but many are obscure and configuration functions
+// for them may not exist. These policy controls allow broad configuration
+// goals to be specified so that they can flow down to all the different
+// parameters of a TLS connection.
+
+enum ssl_compliance_policy_t BORINGSSL_ENUM_INT {
+  // ssl_policy_fips_202205 configures a TLS connection to use:
+  //   * TLS 1.2 or 1.3
+  //   * For TLS 1.2, only ECDHE_[RSA|ECDSA]_WITH_AES_*_GCM_SHA*.
+  //   * For TLS 1.3, only AES-GCM
+  //   * P-256 or P-384 for key agreement.
+  //   * For server signatures, only PKCS#1/PSS with SHA256/384/512, or ECDSA
+  //     with P-256 or P-384.
+  //
+  // Note: this policy can be configured even if BoringSSL has not been built in
+  // FIPS mode. Call |FIPS_mode| to check that.
+  //
+  // Note: this setting aids with compliance with NIST requirements but does not
+  // guarantee it. Careful reading of SP 800-52r2 is recommended.
+  ssl_compliance_policy_fips_202205,
+};
+
+// SSL_CTX_set_compliance_policy configures various aspects of |ctx| based on
+// the given policy requirements. Subsequently calling other functions that
+// configure |ctx| may override |policy|, or may not. This should be the final
+// configuration function called in order to have defined behaviour.
+OPENSSL_EXPORT int SSL_CTX_set_compliance_policy(
+    SSL_CTX *ctx, enum ssl_compliance_policy_t policy);
+
+// SSL_set_compliance_policy acts the same as |SSL_CTX_set_compliance_policy|,
+// but only configures a single |SSL*|.
+OPENSSL_EXPORT int SSL_set_compliance_policy(
+    SSL *ssl, enum ssl_compliance_policy_t policy);
+
+
 // Nodejs compatibility section (hidden).
 //
 // These defines exist for node.js, with the hope that we can eliminate the

package/third_party/boringssl/src/ssl/handshake_client.cc

@@ -235,7 +235,12 @@ static bool ssl_write_client_cipher_list(const SSL_HANDSHAKE *hs, CBB *out,
   // Add TLS 1.3 ciphers. Order ChaCha20-Poly1305 relative to AES-GCM based on
   // hardware support.
   if (hs->max_version >= TLS1_3_VERSION) {
-    if (!EVP_has_aes_hardware() &&
+    const bool include_chacha20 = ssl_tls13_cipher_meets_policy(
+        TLS1_CK_CHACHA20_POLY1305_SHA256 & 0xffff,
+        ssl->config->only_fips_cipher_suites_in_tls13);
+
+    if (!EVP_has_aes_hardware() &&  //
+        include_chacha20 &&         //
         !CBB_add_u16(&child, TLS1_CK_CHACHA20_POLY1305_SHA256 & 0xffff)) {
       return false;
     }
@@ -243,7 +248,8 @@ static bool ssl_write_client_cipher_list(const SSL_HANDSHAKE *hs, CBB *out,
         !CBB_add_u16(&child, TLS1_CK_AES_256_GCM_SHA384 & 0xffff)) {
       return false;
     }
-    if (EVP_has_aes_hardware() &&
+    if (EVP_has_aes_hardware() &&  //
+        include_chacha20 &&        //
         !CBB_add_u16(&child, TLS1_CK_CHACHA20_POLY1305_SHA256 & 0xffff)) {
       return false;
     }

package/third_party/boringssl/src/ssl/internal.h

@@ -660,10 +660,15 @@ bool ssl_cipher_requires_server_key_exchange(const SSL_CIPHER *cipher);
 size_t ssl_cipher_get_record_split_len(const SSL_CIPHER *cipher);
 
 // ssl_choose_tls13_cipher returns an |SSL_CIPHER| corresponding with the best
-// available from |cipher_suites| compatible with |version| and |group_id|. It
-// returns NULL if there isn't a compatible cipher.
+// available from |cipher_suites| compatible with |version|, |group_id|, and
+// |only_fips|. It returns NULL if there isn't a compatible cipher.
 const SSL_CIPHER *ssl_choose_tls13_cipher(CBS cipher_suites, uint16_t version,
-                                          uint16_t group_id);
+                                          uint16_t group_id, bool only_fips);
+
+// ssl_tls13_cipher_meets_policy returns true if |cipher_id| is acceptable given
+// |only_fips|. (For now there's only a single policy and so the policy argument
+// is just a bool.)
+bool ssl_tls13_cipher_meets_policy(uint16_t cipher_id, bool only_fips);
 
 
 // Transcript layer.
@@ -3087,6 +3092,10 @@ struct SSL_CONFIG {
 
   // permute_extensions is whether to permute extensions when sending messages.
   bool permute_extensions : 1;
+
+  // only_fips_cipher_suites_in_tls13 constrains the selection of cipher suites
+  // in TLS 1.3 such that only FIPS approved ones will be selected.
+  bool only_fips_cipher_suites_in_tls13 : 1;
 };
 
 // From RFC 8446, used in determining PSK modes.
@@ -3694,6 +3703,10 @@ struct ssl_ctx_st {
   // If enable_early_data is true, early data can be sent and accepted.
   bool enable_early_data : 1;
 
+  // only_fips_cipher_suites_in_tls13 constrains the selection of cipher suites
+  // in TLS 1.3 such that only FIPS approved ones will be selected.
+  bool only_fips_cipher_suites_in_tls13 : 1;
+
  private:
   ~ssl_ctx_st();
   friend OPENSSL_EXPORT void SSL_CTX_free(SSL_CTX *);

package/third_party/boringssl/src/ssl/s3_both.cc

@@ -691,8 +691,25 @@ class CipherScorer {
   const bool security_128_is_fine_;
 };
 
+bool ssl_tls13_cipher_meets_policy(uint16_t cipher_id, bool only_fips) {
+  if (!only_fips) {
+    return true;
+  }
+
+  switch (cipher_id) {
+    case TLS1_CK_AES_128_GCM_SHA256 & 0xffff:
+    case TLS1_CK_AES_256_GCM_SHA384 & 0xffff:
+      return true;
+    case TLS1_CK_CHACHA20_POLY1305_SHA256 & 0xffff:
+      return false;
+    default:
+      assert(false);
+      return false;
+  }
+}
+
 const SSL_CIPHER *ssl_choose_tls13_cipher(CBS cipher_suites, uint16_t version,
-                                          uint16_t group_id) {
+                                          uint16_t group_id, bool only_fips) {
   if (CBS_len(&cipher_suites) % 2 != 0) {
     return nullptr;
   }
@@ -715,6 +732,11 @@ const SSL_CIPHER *ssl_choose_tls13_cipher(CBS cipher_suites, uint16_t version,
       continue;
     }
 
+    if (!ssl_tls13_cipher_meets_policy(SSL_CIPHER_get_protocol_id(candidate),
+                                       only_fips)) {
+      continue;
+    }
+
     const CipherScorer::Score candidate_score = scorer.Evaluate(candidate);
     // |candidate_score| must be larger to displace the current choice. That way
     // the client's order controls between ciphers with an equal score.

package/third_party/boringssl/src/ssl/ssl_lib.cc

@@ -519,7 +519,8 @@ ssl_ctx_st::ssl_ctx_st(const SSL_METHOD *ssl_method)
       allow_unknown_alpn_protos(false),
       false_start_allowed_without_alpn(false),
       handoff(false),
-      enable_early_data(false) {
+      enable_early_data(false),
+      only_fips_cipher_suites_in_tls13(false) {
   CRYPTO_MUTEX_init(&lock);
   CRYPTO_new_ex_data(&ex_data);
 }
@@ -639,6 +640,8 @@ SSL *SSL_new(SSL_CTX *ctx) {
   ssl->config->retain_only_sha256_of_client_certs =
       ctx->retain_only_sha256_of_client_certs;
   ssl->config->permute_extensions = ctx->permute_extensions;
+  ssl->config->only_fips_cipher_suites_in_tls13 =
+      ctx->only_fips_cipher_suites_in_tls13;
 
   if (!ssl->config->supported_group_list.CopyFrom(ctx->supported_group_list) ||
       !ssl->config->alpn_client_proto_list.CopyFrom(
@@ -3079,3 +3082,93 @@ int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg) {
   ctx->legacy_ocsp_callback_arg = arg;
   return 1;
 }
+
+namespace fips202205 {
+
+// (References are to SP 800-52r2):
+
+// Section 3.4.2.2
+// "at least one of the NIST-approved curves, P-256 (secp256r1) and P384
+// (secp384r1), shall be supported as described in RFC 8422."
+//
+// Section 3.3.1
+// "The server shall be configured to only use cipher suites that are
+// composed entirely of NIST approved algorithms"
+static const int kCurves[] = {NID_X9_62_prime256v1, NID_secp384r1};
+
+static const uint16_t kSigAlgs[] = {
+    SSL_SIGN_RSA_PKCS1_SHA256,
+    SSL_SIGN_RSA_PKCS1_SHA384,
+    SSL_SIGN_RSA_PKCS1_SHA512,
+    // Table 4.1:
+    // "The curve should be P-256 or P-384"
+    SSL_SIGN_ECDSA_SECP256R1_SHA256,
+    SSL_SIGN_ECDSA_SECP384R1_SHA384,
+    SSL_SIGN_RSA_PSS_RSAE_SHA256,
+    SSL_SIGN_RSA_PSS_RSAE_SHA384,
+    SSL_SIGN_RSA_PSS_RSAE_SHA512,
+};
+
+static const char kTLS12Ciphers[] =
+    "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
+
+static int Configure(SSL_CTX *ctx) {
+  ctx->only_fips_cipher_suites_in_tls13 = true;
+
+  return
+      // Section 3.1:
+      // "Servers that support government-only applications shall be
+      // configured to use TLS 1.2 and should be configured to use TLS 1.3
+      // as well. These servers should not be configured to use TLS 1.1 and
+      // shall not use TLS 1.0, SSL 3.0, or SSL 2.0.
+      SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION) &&
+      SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION) &&
+      // Sections 3.3.1.1.1 and 3.3.1.1.2 are ambiguous about whether
+      // HMAC-SHA-1 cipher suites are permitted with TLS 1.2. However, later the
+      // Encrypt-then-MAC extension is required for all CBC cipher suites and so
+      // it's easier to drop them.
+      SSL_CTX_set_strict_cipher_list(ctx, kTLS12Ciphers) &&
+      SSL_CTX_set1_curves(ctx, kCurves, OPENSSL_ARRAY_SIZE(kCurves)) &&
+      SSL_CTX_set_signing_algorithm_prefs(ctx, kSigAlgs,
+                                          OPENSSL_ARRAY_SIZE(kSigAlgs)) &&
+      SSL_CTX_set_verify_algorithm_prefs(ctx, kSigAlgs,
+                                         OPENSSL_ARRAY_SIZE(kSigAlgs));
+}
+
+static int Configure(SSL *ssl) {
+  ssl->config->only_fips_cipher_suites_in_tls13 = true;
+
+  // See |Configure(SSL_CTX)|, above, for reasoning.
+  return SSL_set_min_proto_version(ssl, TLS1_2_VERSION) &&
+         SSL_set_max_proto_version(ssl, TLS1_3_VERSION) &&
+         SSL_set_strict_cipher_list(ssl, kTLS12Ciphers) &&
+         SSL_set1_curves(ssl, kCurves, OPENSSL_ARRAY_SIZE(kCurves)) &&
+         SSL_set_signing_algorithm_prefs(ssl, kSigAlgs,
+                                         OPENSSL_ARRAY_SIZE(kSigAlgs)) &&
+         SSL_set_verify_algorithm_prefs(ssl, kSigAlgs,
+                                        OPENSSL_ARRAY_SIZE(kSigAlgs));
+}
+
+}  // namespace fips202205
+
+int SSL_CTX_set_compliance_policy(SSL_CTX *ctx,
+                                  enum ssl_compliance_policy_t policy) {
+  switch (policy) {
+    case ssl_compliance_policy_fips_202205:
+      return fips202205::Configure(ctx);
+    default:
+      return 0;
+  }
+}
+
+int SSL_set_compliance_policy(SSL *ssl, enum ssl_compliance_policy_t policy) {
+  switch (policy) {
+    case ssl_compliance_policy_fips_202205:
+      return fips202205::Configure(ssl);
+    default:
+      return 0;
+  }
+}