Skip to content

Commit 06d8136

Browse files
andrewhopandrewhop
committed
Merge commit 'ab7811ee8751ea699b22095caa70246f641ed3a2' into boringmerge20210421
2 parents 736fce4 + ab7811e commit 06d8136

File tree

152 files changed

+7853
-18014
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

152 files changed

+7853
-18014
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ util/bot/cmake-mac
1515
util/bot/cmake-win32
1616
util/bot/cmake-win32.zip
1717
util/bot/golang
18+
util/bot/libFuzzer
1819
util/bot/libcxx
1920
util/bot/libcxxabi
2021
util/bot/llvm-build

‎BUILDING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Unless otherwise noted, build tools must at most five years old, matching
1010
[Abseil guidelines](https://abseil.io/about/compatibility). If in doubt, use the
1111
most recent stable version of each tool.
1212

13-
* [CMake](https://cmake.org/download/) 3.0 or later is required.
13+
* [CMake](https://cmake.org/download/) 2.8.12 or later is required.
1414

1515
* A recent version of Perl is required. On Windows,
1616
[Active State Perl](http://www.activestate.com/activeperl/) has been

‎FUZZING.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,11 @@ These were determined by rounding up the length of the largest case in the corpu
4242

4343
There are directories in `fuzz/` for each of the fuzzing tests which contain seed files for fuzzing. Some of the seed files were generated manually but many of them are “interesting” results generated by the fuzzing itself. (Where “interesting” means that it triggered a previously unknown path in the code.)
4444

45-
## Minimising the corpuses
45+
## Minimising the corpora
4646

4747
When a large number of new seeds are available, it's a good idea to minimise the corpus so that different seeds that trigger the same code paths can be deduplicated.
4848

49-
In order to minimise all the corpuses, build for fuzzing and run `./fuzz/minimise_corpuses.sh`. Note that minimisation is, oddly, often not idempotent for unknown reasons.
49+
In order to minimise all the corpora, build for fuzzing and run `./fuzz/minimise_corpora.sh`. Note that minimisation is, oddly, often not idempotent for unknown reasons.
5050

5151
## Fuzzer mode
5252

‎crypto/asn1/a_bool.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ int i2d_ASN1_BOOLEAN(int a, unsigned char **pp)
7878
}
7979

8080
ASN1_put_object(&p, 0, 1, V_ASN1_BOOLEAN, V_ASN1_UNIVERSAL);
81-
*p = (unsigned char)a;
81+
*p = a ? 0xff : 0x00;
8282

8383
/*
8484
* If a new buffer was allocated, just return it back.

‎crypto/asn1/a_type.c

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -66,18 +66,28 @@
6666

6767
int ASN1_TYPE_get(const ASN1_TYPE *a)
6868
{
69-
if ((a->value.ptr != NULL) || (a->type == V_ASN1_NULL))
70-
return (a->type);
71-
else
72-
return (0);
69+
if (a->type == V_ASN1_BOOLEAN || a->type == V_ASN1_NULL ||
70+
a->value.ptr != NULL) {
71+
return a->type;
72+
}
73+
return 0;
7374
}
7475

75-
void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value)
76+
const void *asn1_type_value_as_pointer(const ASN1_TYPE *a)
7677
{
77-
if (a->value.ptr != NULL) {
78-
ASN1_TYPE **tmp_a = &a;
79-
ASN1_primitive_free((ASN1_VALUE **)tmp_a, NULL);
78+
if (a->type == V_ASN1_BOOLEAN) {
79+
return a->value.boolean ? (void *)0xff : NULL;
80+
}
81+
if (a->type == V_ASN1_NULL) {
82+
return NULL;
8083
}
84+
return a->value.ptr;
85+
}
86+
87+
void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value)
88+
{
89+
ASN1_TYPE **tmp_a = &a;
90+
ASN1_primitive_free((ASN1_VALUE **)tmp_a, NULL);
8191
a->type = type;
8292
if (type == V_ASN1_BOOLEAN)
8393
a->value.boolean = value ? 0xff : 0;

‎crypto/asn1/asn1_locl.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,11 @@ int asn1_enc_restore(int *len, unsigned char **out, ASN1_VALUE **pval,
126126
int asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen,
127127
const ASN1_ITEM *it);
128128

129+
/* asn1_type_value_as_pointer returns |a|'s value in pointer form. This is
130+
* usually the value object but, for BOOLEAN values, is 0 or 0xff cast to
131+
* a pointer. */
132+
const void *asn1_type_value_as_pointer(const ASN1_TYPE *a);
133+
129134

130135
#if defined(__cplusplus)
131136
} /* extern C */

‎crypto/asn1/asn1_test.cc

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
#include <openssl/mem.h>
2727
#include <openssl/obj.h>
2828
#include <openssl/span.h>
29+
#include <openssl/x509v3.h>
2930

3031
#include "../test/test_util.h"
3132

@@ -125,11 +126,95 @@ TEST(ASN1Test, SerializeObject) {
125126
TEST(ASN1Test, SerializeBoolean) {
126127
static const uint8_t kTrue[] = {0x01, 0x01, 0xff};
127128
TestSerialize(0xff, i2d_ASN1_BOOLEAN, kTrue);
129+
// Other constants are also correctly encoded as TRUE.
130+
TestSerialize(1, i2d_ASN1_BOOLEAN, kTrue);
131+
TestSerialize(0x100, i2d_ASN1_BOOLEAN, kTrue);
128132

129133
static const uint8_t kFalse[] = {0x01, 0x01, 0x00};
130134
TestSerialize(0x00, i2d_ASN1_BOOLEAN, kFalse);
131135
}
132136

137+
// The templates go through a different codepath, so test them separately.
138+
TEST(ASN1Test, SerializeEmbeddedBoolean) {
139+
bssl::UniquePtr<BASIC_CONSTRAINTS> val(BASIC_CONSTRAINTS_new());
140+
ASSERT_TRUE(val);
141+
142+
// BasicConstraints defaults to FALSE, so the encoding should be empty.
143+
static const uint8_t kLeaf[] = {0x30, 0x00};
144+
val->ca = 0;
145+
TestSerialize(val.get(), i2d_BASIC_CONSTRAINTS, kLeaf);
146+
147+
// TRUE should always be encoded as 0xff, independent of what value the caller
148+
// placed in the |ASN1_BOOLEAN|.
149+
static const uint8_t kCA[] = {0x30, 0x03, 0x01, 0x01, 0xff};
150+
val->ca = 0xff;
151+
TestSerialize(val.get(), i2d_BASIC_CONSTRAINTS, kCA);
152+
val->ca = 1;
153+
TestSerialize(val.get(), i2d_BASIC_CONSTRAINTS, kCA);
154+
val->ca = 0x100;
155+
TestSerialize(val.get(), i2d_BASIC_CONSTRAINTS, kCA);
156+
}
157+
158+
TEST(ASN1Test, ASN1Type) {
159+
const struct {
160+
int type;
161+
std::vector<uint8_t> der;
162+
} kTests[] = {
163+
// BOOLEAN { TRUE }
164+
{V_ASN1_BOOLEAN, {0x01, 0x01, 0xff}},
165+
// BOOLEAN { FALSE }
166+
{V_ASN1_BOOLEAN, {0x01, 0x01, 0x00}},
167+
// OCTET_STRING { "a" }
168+
{V_ASN1_OCTET_STRING, {0x04, 0x01, 0x61}},
169+
// BIT_STRING { `01` `00` }
170+
{V_ASN1_BIT_STRING, {0x03, 0x02, 0x01, 0x00}},
171+
// INTEGER { -1 }
172+
{V_ASN1_INTEGER, {0x02, 0x01, 0xff}},
173+
// OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2 }
174+
{V_ASN1_OBJECT,
175+
{0x06, 0x0c, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04, 0x01, 0x84, 0xb7,
176+
0x09, 0x02}},
177+
// NULL {}
178+
{V_ASN1_NULL, {0x05, 0x00}},
179+
// SEQUENCE {}
180+
{V_ASN1_SEQUENCE, {0x30, 0x00}},
181+
// SET {}
182+
{V_ASN1_SET, {0x31, 0x00}},
183+
// [0] { UTF8String { "a" } }
184+
{V_ASN1_OTHER, {0xa0, 0x03, 0x0c, 0x01, 0x61}},
185+
};
186+
for (const auto &t : kTests) {
187+
SCOPED_TRACE(Bytes(t.der));
188+
189+
// The input should successfully parse.
190+
const uint8_t *ptr = t.der.data();
191+
bssl::UniquePtr<ASN1_TYPE> val(d2i_ASN1_TYPE(nullptr, &ptr, t.der.size()));
192+
ASSERT_TRUE(val);
193+
194+
EXPECT_EQ(ASN1_TYPE_get(val.get()), t.type);
195+
EXPECT_EQ(val->type, t.type);
196+
TestSerialize(val.get(), i2d_ASN1_TYPE, t.der);
197+
}
198+
}
199+
200+
// Test that reading |value.ptr| from a FALSE |ASN1_TYPE| behaves correctly. The
201+
// type historically supported this, so maintain the invariant in case external
202+
// code relies on it.
203+
TEST(ASN1Test, UnusedBooleanBits) {
204+
// OCTET_STRING { "a" }
205+
static const uint8_t kDER[] = {0x04, 0x01, 0x61};
206+
const uint8_t *ptr = kDER;
207+
bssl::UniquePtr<ASN1_TYPE> val(d2i_ASN1_TYPE(nullptr, &ptr, sizeof(kDER)));
208+
ASSERT_TRUE(val);
209+
EXPECT_EQ(V_ASN1_OCTET_STRING, val->type);
210+
EXPECT_TRUE(val->value.ptr);
211+
212+
// Set |val| to a BOOLEAN containing FALSE.
213+
ASN1_TYPE_set(val.get(), V_ASN1_BOOLEAN, NULL);
214+
EXPECT_EQ(V_ASN1_BOOLEAN, val->type);
215+
EXPECT_FALSE(val->value.ptr);
216+
}
217+
133218
// The ASN.1 macros do not work on Windows shared library builds, where usage of
134219
// |OPENSSL_EXPORT| is a bit stricter.
135220
#if !defined(OPENSSL_WINDOWS) || !defined(BORINGSSL_SHARED_LIBRARY)

‎crypto/asn1/tasn_enc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -569,7 +569,7 @@ static int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype,
569569
if (!*tbool && !it->size)
570570
return -1;
571571
}
572-
c = (unsigned char)*tbool;
572+
c = *tbool ? 0xff : 0x00;
573573
cont = &c;
574574
len = 1;
575575
break;

‎crypto/asn1/tasn_fre.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ void ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
192192
ASN1_TYPE *typ = (ASN1_TYPE *)*pval;
193193
utype = typ->type;
194194
pval = &typ->value.asn1_value;
195-
if (!*pval)
195+
if (utype != V_ASN1_BOOLEAN && !*pval)
196196
return;
197197
} else if (it->itype == ASN1_ITYPE_MSTRING) {
198198
utype = -1;

‎crypto/cipher_extra/aead_test.cc

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -125,10 +125,6 @@ static const struct KnownAEAD kAEADs[] = {
125125
"aes_128_cbc_sha1_tls_implicit_iv_tests.txt",
126126
kLimitedImplementation | RequiresADLength(11)},
127127

128-
{"AES_128_CBC_SHA256_TLS", EVP_aead_aes_128_cbc_sha256_tls,
129-
"aes_128_cbc_sha256_tls_tests.txt",
130-
kLimitedImplementation | RequiresADLength(11)},
131-
132128
{"AES_256_CBC_SHA1_TLS", EVP_aead_aes_256_cbc_sha1_tls,
133129
"aes_256_cbc_sha1_tls_tests.txt",
134130
kLimitedImplementation | RequiresADLength(11)},
@@ -138,14 +134,6 @@ static const struct KnownAEAD kAEADs[] = {
138134
"aes_256_cbc_sha1_tls_implicit_iv_tests.txt",
139135
kLimitedImplementation | RequiresADLength(11)},
140136

141-
{"AES_256_CBC_SHA256_TLS", EVP_aead_aes_256_cbc_sha256_tls,
142-
"aes_256_cbc_sha256_tls_tests.txt",
143-
kLimitedImplementation | RequiresADLength(11)},
144-
145-
{"AES_256_CBC_SHA384_TLS", EVP_aead_aes_256_cbc_sha384_tls,
146-
"aes_256_cbc_sha384_tls_tests.txt",
147-
kLimitedImplementation | RequiresADLength(11)},
148-
149137
{"DES_EDE3_CBC_SHA1_TLS", EVP_aead_des_ede3_cbc_sha1_tls,
150138
"des_ede3_cbc_sha1_tls_tests.txt",
151139
kLimitedImplementation | RequiresADLength(11)},

‎crypto/cipher_extra/cipher_test.cc

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,14 @@
6565
#include <openssl/cipher.h>
6666
#include <openssl/err.h>
6767
#include <openssl/nid.h>
68+
#include <openssl/rand.h>
69+
#include <openssl/sha.h>
6870
#include <openssl/span.h>
6971

7072
#include "../test/file_test.h"
7173
#include "../test/test_util.h"
7274
#include "../test/wycheproof_util.h"
75+
#include "./internal.h"
7376

7477

7578
static const EVP_CIPHER *GetCipher(const std::string &name) {
@@ -474,3 +477,50 @@ TEST(CipherTest, WycheproofAESCBC) {
474477
}
475478
});
476479
}
480+
481+
TEST(CipherTest, SHA1WithSecretSuffix) {
482+
uint8_t buf[SHA_CBLOCK * 4];
483+
RAND_bytes(buf, sizeof(buf));
484+
// Hashing should run in time independent of the bytes.
485+
CONSTTIME_SECRET(buf, sizeof(buf));
486+
487+
// Exhaustively testing interesting cases in this function is cubic in the
488+
// block size, so we test in 3-byte increments.
489+
constexpr size_t kSkip = 3;
490+
// This value should be less than 8 to test the edge case when the 8-byte
491+
// length wraps to the next block.
492+
static_assert(kSkip < 8, "kSkip is too large");
493+
494+
// |EVP_sha1_final_with_secret_suffix| is sensitive to the public length of
495+
// the partial block previously hashed. In TLS, this is the HMAC prefix, the
496+
// header, and the public minimum padding length.
497+
for (size_t prefix = 0; prefix < SHA_CBLOCK; prefix += kSkip) {
498+
SCOPED_TRACE(prefix);
499+
// The first block is treated differently, so we run with up to three
500+
// blocks of length variability.
501+
for (size_t max_len = 0; max_len < 3 * SHA_CBLOCK; max_len += kSkip) {
502+
SCOPED_TRACE(max_len);
503+
for (size_t len = 0; len <= max_len; len += kSkip) {
504+
SCOPED_TRACE(len);
505+
506+
uint8_t expected[SHA_DIGEST_LENGTH];
507+
SHA1(buf, prefix + len, expected);
508+
CONSTTIME_DECLASSIFY(expected, sizeof(expected));
509+
510+
// Make a copy of the secret length to avoid interfering with the loop.
511+
size_t secret_len = len;
512+
CONSTTIME_SECRET(&secret_len, sizeof(secret_len));
513+
514+
SHA_CTX ctx;
515+
SHA1_Init(&ctx);
516+
SHA1_Update(&ctx, buf, prefix);
517+
uint8_t computed[SHA_DIGEST_LENGTH];
518+
ASSERT_TRUE(EVP_sha1_final_with_secret_suffix(
519+
&ctx, computed, buf + prefix, secret_len, max_len));
520+
521+
CONSTTIME_DECLASSIFY(computed, sizeof(computed));
522+
EXPECT_EQ(Bytes(expected), Bytes(computed));
523+
}
524+
}
525+
}
526+
}

0 commit comments

Comments
 (0)