@fails-components/webtransport 0.0.1-rc.2 → 0.0.1

package/third_party/boringssl/src/ssl/test/runner/runner.go

@@ -19032,6 +19032,197 @@ func addHintMismatchTests() {
 	}
 }
 
+func addCompliancePolicyTests() {
+	for _, protocol := range []protocol{tls, quic} {
+		for _, suite := range testCipherSuites {
+			var isFIPSCipherSuite bool
+			switch suite.id {
+			case TLS_AES_128_GCM_SHA256,
+				TLS_AES_256_GCM_SHA384,
+				TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+				TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+				TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+				TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
+				isFIPSCipherSuite = true
+			}
+
+			var certFile string
+			var keyFile string
+			var certs []Certificate
+			if hasComponent(suite.name, "ECDSA") {
+				certFile = ecdsaP256CertificateFile
+				keyFile = ecdsaP256KeyFile
+				certs = []Certificate{ecdsaP256Certificate}
+			} else {
+				certFile = rsaCertificateFile
+				keyFile = rsaKeyFile
+				certs = []Certificate{rsaCertificate}
+			}
+
+			maxVersion := uint16(VersionTLS13)
+			if !isTLS13Suite(suite.name) {
+				if protocol == quic {
+					continue
+				}
+				maxVersion = VersionTLS12
+			}
+
+			testCases = append(testCases, testCase{
+				testType: serverTest,
+				protocol: protocol,
+				name:     "Compliance-fips202205-" + protocol.String() + "-Server-" + suite.name,
+				config: Config{
+					MinVersion:   VersionTLS12,
+					MaxVersion:   maxVersion,
+					CipherSuites: []uint16{suite.id},
+				},
+				certFile: certFile,
+				keyFile:  keyFile,
+				flags: []string{
+					"-fips-202205",
+				},
+				shouldFail: !isFIPSCipherSuite,
+			})
+
+			testCases = append(testCases, testCase{
+				testType: clientTest,
+				protocol: protocol,
+				name:     "Compliance-fips202205-" + protocol.String() + "-Client-" + suite.name,
+				config: Config{
+					MinVersion:   VersionTLS12,
+					MaxVersion:   maxVersion,
+					CipherSuites: []uint16{suite.id},
+					Certificates: certs,
+				},
+				flags: []string{
+					"-fips-202205",
+				},
+				shouldFail: !isFIPSCipherSuite,
+			})
+		}
+
+		// Check that a TLS 1.3 client won't accept ChaCha20 even if the server
+		// picks it without it being in the client's cipher list.
+		testCases = append(testCases, testCase{
+			testType: clientTest,
+			protocol: protocol,
+			name:     "Compliance-fips202205-" + protocol.String() + "-Client-ReallyWontAcceptChaCha",
+			config: Config{
+				MinVersion: VersionTLS12,
+				MaxVersion: maxVersion,
+				Bugs: ProtocolBugs{
+					SendCipherSuite: TLS_CHACHA20_POLY1305_SHA256,
+				},
+			},
+			flags: []string{
+				"-fips-202205",
+			},
+			shouldFail:    true,
+			expectedError: ":WRONG_CIPHER_RETURNED:",
+		})
+
+		for _, curve := range testCurves {
+			var isFIPSCurve bool
+			switch curve.id {
+			case CurveP256, CurveP384:
+				isFIPSCurve = true
+			}
+
+			testCases = append(testCases, testCase{
+				testType: serverTest,
+				protocol: protocol,
+				name:     "Compliance-fips202205-" + protocol.String() + "-Server-" + curve.name,
+				config: Config{
+					MinVersion:       VersionTLS12,
+					MaxVersion:       VersionTLS13,
+					CurvePreferences: []CurveID{curve.id},
+				},
+				flags: []string{
+					"-fips-202205",
+				},
+				shouldFail: !isFIPSCurve,
+			})
+
+			testCases = append(testCases, testCase{
+				testType: clientTest,
+				protocol: protocol,
+				name:     "Compliance-fips202205-" + protocol.String() + "-Client-" + curve.name,
+				config: Config{
+					MinVersion:       VersionTLS12,
+					MaxVersion:       VersionTLS13,
+					CurvePreferences: []CurveID{curve.id},
+				},
+				flags: []string{
+					"-fips-202205",
+				},
+				shouldFail: !isFIPSCurve,
+			})
+		}
+
+		for _, sigalg := range testSignatureAlgorithms {
+			var isFIPSSigAlg bool
+			switch sigalg.id {
+			case signatureRSAPKCS1WithSHA256,
+				signatureRSAPKCS1WithSHA384,
+				signatureRSAPKCS1WithSHA512,
+				signatureECDSAWithP256AndSHA256,
+				signatureECDSAWithP384AndSHA384,
+				signatureRSAPSSWithSHA256,
+				signatureRSAPSSWithSHA384,
+				signatureRSAPSSWithSHA512:
+				isFIPSSigAlg = true
+			}
+
+			if sigalg.cert == testCertECDSAP224 {
+				// This can work in TLS 1.2, but not with TLS 1.3.
+				// For consistency it's not permitted in FIPS mode.
+				isFIPSSigAlg = false
+			}
+
+			maxVersion := uint16(VersionTLS13)
+			if hasComponent(sigalg.name, "PKCS1") {
+				if protocol == quic {
+					continue
+				}
+				maxVersion = VersionTLS12
+			}
+
+			testCases = append(testCases, testCase{
+				testType: serverTest,
+				protocol: protocol,
+				name:     "Compliance-fips202205-" + protocol.String() + "-Server-" + sigalg.name,
+				config: Config{
+					MinVersion:                VersionTLS12,
+					MaxVersion:                maxVersion,
+					VerifySignatureAlgorithms: []signatureAlgorithm{sigalg.id},
+				},
+				flags: []string{
+					"-fips-202205",
+					"-cert-file", path.Join(*resourceDir, getShimCertificate(sigalg.cert)),
+					"-key-file", path.Join(*resourceDir, getShimKey(sigalg.cert)),
+				},
+				shouldFail: !isFIPSSigAlg,
+			})
+
+			testCases = append(testCases, testCase{
+				testType: clientTest,
+				protocol: protocol,
+				name:     "Compliance-fips202205-" + protocol.String() + "-Client-" + sigalg.name,
+				config: Config{
+					MinVersion:              VersionTLS12,
+					MaxVersion:              maxVersion,
+					SignSignatureAlgorithms: []signatureAlgorithm{sigalg.id},
+					Certificates:            []Certificate{getRunnerCertificate(sigalg.cert)},
+				},
+				flags: []string{
+					"-fips-202205",
+				},
+				shouldFail: !isFIPSSigAlg,
+			})
+		}
+	}
+}
+
 func worker(statusChan chan statusMsg, c chan *testCase, shimPath string, wg *sync.WaitGroup) {
 	defer wg.Done()
 
@@ -19274,6 +19465,7 @@ func main() {
 	addDelegatedCredentialTests()
 	addEncryptedClientHelloTests()
 	addHintMismatchTests()
+	addCompliancePolicyTests()
 
 	toAppend, err := convertToSplitHandshakeTests(testCases)
 	if err != nil {

package/third_party/boringssl/src/ssl/test/test_config.cc

@@ -385,6 +385,7 @@ std::vector<Flag> SortedFlags() {
                  &TestConfig::quic_early_data_context),
       IntFlag("-early-write-after-message",
               &TestConfig::early_write_after_message),
+      BoolFlag("-fips-202205", &TestConfig::fips_202205),
   };
   std::sort(flags.begin(), flags.end(), [](const Flag &a, const Flag &b) {
     return strcmp(a.name, b.name) < 0;
@@ -1765,6 +1766,11 @@ bssl::UniquePtr<SSL> TestConfig::NewSSL(
   if (enable_ech_grease) {
     SSL_set_enable_ech_grease(ssl.get(), 1);
   }
+  if (fips_202205 && !SSL_set_compliance_policy(
+                         ssl.get(), ssl_compliance_policy_fips_202205)) {
+    fprintf(stderr, "SSL_set_compliance_policy failed\n");
+    return nullptr;
+  }
   if (!ech_config_list.empty() &&
       !SSL_set1_ech_config_list(
           ssl.get(), reinterpret_cast<const uint8_t *>(ech_config_list.data()),

package/third_party/boringssl/src/ssl/test/test_config.h

@@ -193,6 +193,7 @@ struct TestConfig {
   bool wait_for_debugger = false;
   std::string quic_early_data_context;
   int early_write_after_message = 0;
+  bool fips_202205 = false;
 
   int argc;
   char **argv;

package/third_party/boringssl/src/ssl/tls13_client.cc

@@ -192,11 +192,15 @@ static enum ssl_hs_wait_t do_read_hello_retry_request(SSL_HANDSHAKE *hs) {
   }
 
   // The cipher suite must be one we offered. We currently offer all supported
-  // TLS 1.3 ciphers, so check the version.
+  // TLS 1.3 ciphers unless policy controls limited it. So we check the version
+  // and that it's ok per policy.
   const SSL_CIPHER *cipher = SSL_get_cipher_by_value(server_hello.cipher_suite);
   if (cipher == nullptr ||
       SSL_CIPHER_get_min_version(cipher) > ssl_protocol_version(ssl) ||
-      SSL_CIPHER_get_max_version(cipher) < ssl_protocol_version(ssl)) {
+      SSL_CIPHER_get_max_version(cipher) < ssl_protocol_version(ssl) ||
+      !ssl_tls13_cipher_meets_policy(
+          SSL_CIPHER_get_value(cipher),
+          ssl->config->only_fips_cipher_suites_in_tls13)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CIPHER_RETURNED);
     ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
     return ssl_hs_error;
@@ -372,7 +376,7 @@ static enum ssl_hs_wait_t do_read_server_hello(SSL_HANDSHAKE *hs) {
   }
 
   // Check the cipher suite, in case this is after HelloRetryRequest.
-  if (SSL_CIPHER_get_value(hs->new_cipher) != server_hello.cipher_suite) {
+  if (SSL_CIPHER_get_protocol_id(hs->new_cipher) != server_hello.cipher_suite) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CIPHER_RETURNED);
     ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
     return ssl_hs_error;

package/third_party/boringssl/src/ssl/tls13_server.cc

@@ -116,7 +116,8 @@ static const SSL_CIPHER *choose_tls13_cipher(
 
   const uint16_t version = ssl_protocol_version(ssl);
 
-  return ssl_choose_tls13_cipher(cipher_suites, version, group_id);
+  return ssl_choose_tls13_cipher(cipher_suites, version, group_id,
+                                 ssl->config->only_fips_cipher_suites_in_tls13);
 }
 
 static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {

package/third_party/boringssl/src/util/convert_comments.go

@@ -232,6 +232,29 @@ func convertComments(path string, in []byte) []byte {
 			}
 
 			for i, line := range group.lines {
+				// The OpenSSL style writes multiline block comments with a
+				// blank line at the top and bottom, like so:
+				//
+				//   /*
+				//    * Some multi-line
+				//    * comment
+				//    */
+				//
+				// The trailing lines are already removed above, when buffering.
+				// Remove the leading lines here. (The leading lines cannot be
+				// removed when buffering because we may discover the comment is
+				// not convertible in later lines.)
+				//
+				// Note the leading line cannot be easily removed if there is
+				// code before it, such as the following. Skip those cases.
+				//
+				//   foo(); /*
+				//           * Some multi-line
+				//           * comment
+				//           */
+				if i == 0 && allSpaces(line[:group.column]) && len(line) == group.column+2 {
+					continue
+				}
 				newLine := fmt.Sprintf("%s%s//%s", line[:group.column], adjust, strings.TrimRight(line[group.column+2:], " "))
 				if len(newLine) > 80 {
 					fmt.Fprintf(os.Stderr, "%s:%d: Line is now longer than 80 characters\n", path, lineNo+i+1)

package/third_party/boringssl/src/util/fipstools/acvp/acvptool/acvp/acvp.go

@@ -91,7 +91,7 @@ func NewServer(prefix string, logFile string, derCertificates [][]byte, privateK
 				return conn, err
 			},
 		},
-		Timeout: 30 * time.Second,
+		Timeout: 120 * time.Second,
 	}
 
 	return &Server{client: client, prefix: prefix, totpFunc: totp, PrefixTokens: make(map[string]string)}

package/third_party/boringssl/src/util/fipstools/acvp/modulewrapper/modulewrapper.cc

@@ -297,10 +297,10 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "direction": ["encrypt", "decrypt"],
         "keyLen": [128, 192, 256],
         "payloadLen": [{
-          "min": 0, "max": 256, "increment": 8
+          "min": 0, "max": 65536, "increment": 8
         }],
         "aadLen": [{
-          "min": 0, "max": 320, "increment": 8
+          "min": 0, "max": 65536, "increment": 8
         }],
         "tagLen": [32, 64, 96, 104, 112, 120, 128],
         "ivLen": [96],
@@ -312,10 +312,10 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "direction": ["encrypt", "decrypt"],
         "keyLen": [128, 192, 256],
         "payloadLen": [{
-          "min": 0, "max": 256, "increment": 8
+          "min": 0, "max": 65536, "increment": 8
         }],
         "aadLen": [{
-          "min": 0, "max": 320, "increment": 8
+          "min": 0, "max": 65536, "increment": 8
         }],
         "tagLen": [32, 64, 96, 104, 112, 120, 128],
         "ivLen": [96],
@@ -334,7 +334,7 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "keyLen": [
             128, 192, 256
         ],
-        "payloadLen": [{"min": 128, "max": 1024, "increment": 64}]
+        "payloadLen": [{"min": 128, "max": 4096, "increment": 64}]
       },
       {
         "algorithm": "ACVP-AES-KWP",
@@ -363,14 +363,14 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         ],
         "payloadLen": [{"min": 0, "max": 256, "increment": 8}],
         "ivLen": [104],
-        "tagLen": [32],
-        "aadLen": [{"min": 0, "max": 1024, "increment": 8}]
+        "tagLen": [32, 64],
+        "aadLen": [{"min": 0, "max": 524288, "increment": 8}]
       },
       {
         "algorithm": "HMAC-SHA-1",
         "revision": "1.0",
         "keyLen": [{
-          "min": 8, "max": 2048, "increment": 8
+          "min": 8, "max": 524288, "increment": 8
         }],
         "macLen": [{
           "min": 32, "max": 160, "increment": 8
@@ -380,7 +380,7 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "algorithm": "HMAC-SHA2-224",
         "revision": "1.0",
         "keyLen": [{
-          "min": 8, "max": 2048, "increment": 8
+          "min": 8, "max": 524288, "increment": 8
         }],
         "macLen": [{
           "min": 32, "max": 224, "increment": 8
@@ -390,7 +390,7 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "algorithm": "HMAC-SHA2-256",
         "revision": "1.0",
         "keyLen": [{
-          "min": 8, "max": 2048, "increment": 8
+          "min": 8, "max": 524288, "increment": 8
         }],
         "macLen": [{
           "min": 32, "max": 256, "increment": 8
@@ -400,7 +400,7 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "algorithm": "HMAC-SHA2-384",
         "revision": "1.0",
         "keyLen": [{
-          "min": 8, "max": 2048, "increment": 8
+          "min": 8, "max": 524288, "increment": 8
         }],
         "macLen": [{
           "min": 32, "max": 384, "increment": 8
@@ -410,7 +410,7 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "algorithm": "HMAC-SHA2-512",
         "revision": "1.0",
         "keyLen": [{
-          "min": 8, "max": 2048, "increment": 8
+          "min": 8, "max": 524288, "increment": 8
         }],
         "macLen": [{
           "min": 32, "max": 512, "increment": 8
@@ -420,7 +420,7 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
         "algorithm": "HMAC-SHA2-512/256",
         "revision": "1.0",
         "keyLen": [{
-          "min": 8, "max": 2048, "increment": 8
+          "min": 8, "max": 524288, "increment": 8
         }],
         "macLen": [{
           "min": 32, "max": 256, "increment": 8
@@ -821,12 +821,12 @@ static bool GetConfig(const Span<const uint8_t> args[], ReplyCallback write_repl
           "direction": ["gen", "ver"],
           "msgLen": [{
             "min": 0,
-            "max": 65536,
+            "max": 524288,
             "increment": 8
           }],
           "keyLen": [128, 256],
           "macLen": [{
-            "min": 32,
+            "min": 8,
             "max": 128,
             "increment": 8
           }]
@@ -1096,10 +1096,21 @@ static bool AESCCMSetup(EVP_AEAD_CTX *ctx, Span<const uint8_t> tag_len_span,
     return false;
   }
   memcpy(&tag_len_32, tag_len_span.data(), sizeof(tag_len_32));
-  if (tag_len_32 != 4) {
-    LOG_ERROR("AES-CCM only supports 4-byte tags, but %u was requested\n",
-              static_cast<unsigned>(tag_len_32));
-    return false;
+  const EVP_AEAD *aead;
+  switch (tag_len_32) {
+    case 4:
+      aead = EVP_aead_aes_128_ccm_bluetooth();
+      break;
+
+    case 8:
+      aead = EVP_aead_aes_128_ccm_bluetooth_8();
+      break;
+
+    default:
+      LOG_ERROR(
+          "AES-CCM only supports 4- and 8-byte tags, but %u was requested\n",
+          static_cast<unsigned>(tag_len_32));
+      return false;
   }
 
   if (key.size() != 16) {
@@ -1108,8 +1119,8 @@ static bool AESCCMSetup(EVP_AEAD_CTX *ctx, Span<const uint8_t> tag_len_span,
     return false;
   }
 
-  if (!EVP_AEAD_CTX_init(ctx, EVP_aead_aes_128_ccm_bluetooth(), key.data(),
-                         key.size(), tag_len_32, nullptr)) {
+  if (!EVP_AEAD_CTX_init(ctx, aead, key.data(), key.size(), tag_len_32,
+                         nullptr)) {
     LOG_ERROR("Failed to setup AES-CCM with tag length %u\n",
               static_cast<unsigned>(tag_len_32));
     return false;

package/third_party/quiche/quiche/common/platform/default/quiche_platform_impl/quiche_flags_impl.cc

@@ -4,6 +4,6 @@
 
 #include "quiche_platform_impl/quiche_flags_impl.h"
 
-#define QUIC_FLAG(flag, value) bool flag = value;
+#define QUIC_FLAG(flag, value) bool FLAGS_##flag = value;
 #include "quiche/quic/core/quic_flags_list.h"
 #undef QUIC_FLAG

package/third_party/quiche/quiche/common/platform/default/quiche_platform_impl/quiche_flags_impl.h

@@ -13,7 +13,7 @@
 
 #include "quiche/common/platform/api/quiche_export.h"
 
-#define QUIC_FLAG(flag, value) QUICHE_EXPORT_PRIVATE extern bool flag;
+#define QUIC_FLAG(flag, value) QUICHE_EXPORT_PRIVATE extern bool FLAGS_##flag;
 #include "quiche/quic/core/quic_flags_list.h"
 #undef QUIC_FLAG
 

package/third_party/quiche/quiche/common/platform/default/quiche_platform_impl/quiche_logging_impl.h

@@ -142,8 +142,9 @@ class QUICHE_EXPORT_PRIVATE CheckLogSink : public NoopLogSink {
 #define QUICHE_DCHECK_IMPL(condition) \
   QUICHE_NOOP_STREAM_WITH_CONDITION((condition))
 #else
-#define QUICHE_DCHECK_IMPL(condition) \
-  QUICHE_LOG_IF_IMPL(DFATAL, !static_cast<bool>(condition))
+#define QUICHE_DCHECK_IMPL(condition)                       \
+  QUICHE_LOG_IF_IMPL(DFATAL, !static_cast<bool>(condition)) \
+      << "Check failed: " << #condition
 #endif
 #define QUICHE_DCHECK_EQ_IMPL(val1, val2) QUICHE_DCHECK_IMPL((val1) == (val2))
 #define QUICHE_DCHECK_NE_IMPL(val1, val2) QUICHE_DCHECK_IMPL((val1) != (val2))

package/third_party/quiche/quiche/common/platform/default/quiche_platform_impl/quiche_test_impl.cc

@@ -7,7 +7,7 @@
 #include "quiche/common/platform/api/quiche_flags.h"
 
 QuicheFlagSaverImpl::QuicheFlagSaverImpl() {
-#define QUIC_FLAG(flag, value) saved_##flag##_ = flag;
+#define QUIC_FLAG(flag, value) saved_##flag##_ = FLAGS_##flag;
 #include "quiche/quic/core/quic_flags_list.h"
 #undef QUIC_FLAG
 #define QUIC_PROTOCOL_FLAG(type, flag, ...) saved_##flag##_ = FLAGS_##flag;
@@ -16,7 +16,7 @@ QuicheFlagSaverImpl::QuicheFlagSaverImpl() {
 }
 
 QuicheFlagSaverImpl::~QuicheFlagSaverImpl() {
-#define QUIC_FLAG(flag, value) flag = saved_##flag##_;
+#define QUIC_FLAG(flag, value) FLAGS_##flag = saved_##flag##_;
 #include "quiche/quic/core/quic_flags_list.h"  // NOLINT
 #undef QUIC_FLAG
 #define QUIC_PROTOCOL_FLAG(type, flag, ...) FLAGS_##flag = saved_##flag##_;

package/third_party/quiche/quiche/http2/adapter/http2_protocol.h

@@ -51,7 +51,11 @@ const Http2StreamId kConnectionStreamId = 0;
 
 // The default value for the size of the largest frame payload, according to RFC
 // 7540 Section 6.5.2 (SETTINGS_MAX_FRAME_SIZE).
-const int kDefaultFramePayloadSizeLimit = 16 * 1024;
+const uint32_t kDefaultFramePayloadSizeLimit = 16u * 1024u;
+
+// The maximum value for the size of the largest frame payload, according to RFC
+// 7540 Section 6.5.2 (SETTINGS_MAX_FRAME_SIZE).
+const uint32_t kMaximumFramePayloadSizeLimit = 16777215u;
 
 // The default value for the initial stream and connection flow control window
 // size, according to RFC 7540 Section 6.9.2.

package/third_party/quiche/quiche/http2/adapter/http2_util.cc

@@ -101,6 +101,8 @@ absl::string_view ConnectionErrorToString(ConnectionError error) {
       return "FlowControlError";
     case ConnectionError::kInvalidGoAwayLastStreamId:
       return "InvalidGoAwayLastStreamId";
+    case ConnectionError::kInvalidSetting:
+      return "InvalidSetting";
   }
   return "UnknownConnectionError";
 }

package/third_party/quiche/quiche/http2/adapter/http2_visitor_interface.h

@@ -82,6 +82,8 @@ class QUICHE_EXPORT_PRIVATE Http2VisitorInterface {
     kFlowControlError,
     // The peer sent a GOAWAY with an invalid last-stream-ID field.
     kInvalidGoAwayLastStreamId,
+    // The peer sent an invalid SETTINGS value.
+    kInvalidSetting,
   };
   virtual void OnConnectionError(ConnectionError error) = 0;