Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 1 | /* Copyright (c) 2017, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 15 | #if !defined(_GNU_SOURCE) |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 16 | #define _GNU_SOURCE // needed for syscall() on Linux. |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 17 | #endif |
| 18 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 19 | #include <openssl/crypto.h> |
Robert Sloan | 309a31e | 2018-01-29 10:22:47 -0800 | [diff] [blame] | 20 | |
| 21 | #include <stdlib.h> |
| 22 | |
| 23 | #include <openssl/digest.h> |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 24 | #include <openssl/hmac.h> |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 25 | #include <openssl/sha.h> |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 26 | |
| 27 | #include "../internal.h" |
| 28 | |
| 29 | #include "aes/aes.c" |
| 30 | #include "aes/key_wrap.c" |
| 31 | #include "aes/mode_wrappers.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 32 | #include "bn/add.c" |
| 33 | #include "bn/asm/x86_64-gcc.c" |
| 34 | #include "bn/bn.c" |
| 35 | #include "bn/bytes.c" |
| 36 | #include "bn/cmp.c" |
| 37 | #include "bn/ctx.c" |
| 38 | #include "bn/div.c" |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 39 | #include "bn/div_extra.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 40 | #include "bn/exponentiation.c" |
| 41 | #include "bn/gcd.c" |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 42 | #include "bn/gcd_extra.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 43 | #include "bn/generic.c" |
| 44 | #include "bn/jacobi.c" |
| 45 | #include "bn/montgomery.c" |
| 46 | #include "bn/montgomery_inv.c" |
| 47 | #include "bn/mul.c" |
| 48 | #include "bn/prime.c" |
| 49 | #include "bn/random.c" |
| 50 | #include "bn/rsaz_exp.c" |
| 51 | #include "bn/shift.c" |
| 52 | #include "bn/sqrt.c" |
| 53 | #include "cipher/aead.c" |
| 54 | #include "cipher/cipher.c" |
| 55 | #include "cipher/e_aes.c" |
| 56 | #include "cipher/e_des.c" |
| 57 | #include "des/des.c" |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 58 | #include "digest/digest.c" |
| 59 | #include "digest/digests.c" |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 60 | #include "ecdh/ecdh.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 61 | #include "ecdsa/ecdsa.c" |
| 62 | #include "ec/ec.c" |
| 63 | #include "ec/ec_key.c" |
| 64 | #include "ec/ec_montgomery.c" |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 65 | #include "ec/felem.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 66 | #include "ec/oct.c" |
| 67 | #include "ec/p224-64.c" |
Robert Sloan | 5581810 | 2017-12-18 11:26:17 -0800 | [diff] [blame] | 68 | #include "../../third_party/fiat/p256.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 69 | #include "ec/p256-x86_64.c" |
Robert Sloan | 5cbb5c8 | 2018-04-24 11:35:46 -0700 | [diff] [blame] | 70 | #include "ec/scalar.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 71 | #include "ec/simple.c" |
Robert Sloan | c6ebb28 | 2018-04-30 10:10:26 -0700 | [diff] [blame] | 72 | #include "ec/simple_mul.c" |
Robert Sloan | 5581810 | 2017-12-18 11:26:17 -0800 | [diff] [blame] | 73 | #include "ec/util.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 74 | #include "ec/wnaf.c" |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 75 | #include "hmac/hmac.c" |
| 76 | #include "md4/md4.c" |
| 77 | #include "md5/md5.c" |
Robert Sloan | 9254e68 | 2017-04-24 09:42:06 -0700 | [diff] [blame] | 78 | #include "modes/cbc.c" |
| 79 | #include "modes/cfb.c" |
| 80 | #include "modes/ctr.c" |
| 81 | #include "modes/gcm.c" |
| 82 | #include "modes/ofb.c" |
| 83 | #include "modes/polyval.c" |
| 84 | #include "rand/ctrdrbg.c" |
| 85 | #include "rand/rand.c" |
| 86 | #include "rand/urandom.c" |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 87 | #include "rsa/blinding.c" |
| 88 | #include "rsa/padding.c" |
| 89 | #include "rsa/rsa.c" |
| 90 | #include "rsa/rsa_impl.c" |
Robert Sloan | 309a31e | 2018-01-29 10:22:47 -0800 | [diff] [blame] | 91 | #include "self_check/self_check.c" |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 92 | #include "sha/sha1-altivec.c" |
| 93 | #include "sha/sha1.c" |
| 94 | #include "sha/sha256.c" |
| 95 | #include "sha/sha512.c" |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 96 | #include "tls/kdf.c" |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 97 | |
| 98 | |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 99 | #if defined(BORINGSSL_FIPS) |
| 100 | |
| 101 | #if !defined(OPENSSL_ASAN) |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 102 | // These symbols are filled in by delocate.go (in static builds) or a linker |
| 103 | // script (in shared builds). They point to the start and end of the module, and |
| 104 | // the location of the integrity hash, respectively. |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 105 | extern const uint8_t BORINGSSL_bcm_text_start[]; |
| 106 | extern const uint8_t BORINGSSL_bcm_text_end[]; |
| 107 | extern const uint8_t BORINGSSL_bcm_text_hash[]; |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 108 | #if defined(BORINGSSL_SHARED_LIBRARY) |
| 109 | extern const uint8_t BORINGSSL_bcm_rodata_start[]; |
| 110 | extern const uint8_t BORINGSSL_bcm_rodata_end[]; |
| 111 | #endif |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 112 | #endif |
| 113 | |
| 114 | static void __attribute__((constructor)) |
| 115 | BORINGSSL_bcm_power_on_self_test(void) { |
| 116 | CRYPTO_library_init(); |
| 117 | |
| 118 | #if !defined(OPENSSL_ASAN) |
| 119 | // Integrity tests cannot run under ASAN because it involves reading the full |
| 120 | // .text section, which triggers the global-buffer overflow detection. |
| 121 | const uint8_t *const start = BORINGSSL_bcm_text_start; |
| 122 | const uint8_t *const end = BORINGSSL_bcm_text_end; |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 123 | #if defined(BORINGSSL_SHARED_LIBRARY) |
| 124 | const uint8_t *const rodata_start = BORINGSSL_bcm_rodata_start; |
| 125 | const uint8_t *const rodata_end = BORINGSSL_bcm_rodata_end; |
| 126 | #endif |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 127 | |
| 128 | static const uint8_t kHMACKey[64] = {0}; |
| 129 | uint8_t result[SHA512_DIGEST_LENGTH]; |
| 130 | |
| 131 | unsigned result_len; |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 132 | HMAC_CTX hmac_ctx; |
| 133 | HMAC_CTX_init(&hmac_ctx); |
| 134 | if (!HMAC_Init_ex(&hmac_ctx, kHMACKey, sizeof(kHMACKey), EVP_sha512(), |
| 135 | NULL /* no ENGINE */)) { |
| 136 | fprintf(stderr, "HMAC_Init_ex failed.\n"); |
| 137 | goto err; |
| 138 | } |
| 139 | #if defined(BORINGSSL_SHARED_LIBRARY) |
| 140 | uint64_t length = end - start; |
| 141 | HMAC_Update(&hmac_ctx, (const uint8_t *) &length, sizeof(length)); |
| 142 | HMAC_Update(&hmac_ctx, start, length); |
| 143 | |
| 144 | length = rodata_end - rodata_start; |
| 145 | HMAC_Update(&hmac_ctx, (const uint8_t *) &length, sizeof(length)); |
| 146 | HMAC_Update(&hmac_ctx, rodata_start, length); |
| 147 | #else |
| 148 | HMAC_Update(&hmac_ctx, start, end - start); |
| 149 | #endif |
| 150 | if (!HMAC_Final(&hmac_ctx, result, &result_len) || |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 151 | result_len != sizeof(result)) { |
Robert Sloan | f068def | 2018-10-10 18:45:40 -0700 | [diff] [blame] | 152 | fprintf(stderr, "HMAC failed.\n"); |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 153 | goto err; |
| 154 | } |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 155 | HMAC_CTX_cleanup(&hmac_ctx); |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 156 | |
| 157 | const uint8_t *expected = BORINGSSL_bcm_text_hash; |
| 158 | |
| 159 | if (!check_test(expected, result, sizeof(result), "FIPS integrity test")) { |
| 160 | goto err; |
| 161 | } |
| 162 | #endif |
| 163 | |
| 164 | if (!BORINGSSL_self_test()) { |
| 165 | goto err; |
| 166 | } |
| 167 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 168 | return; |
| 169 | |
| 170 | err: |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 171 | BORINGSSL_FIPS_abort(); |
| 172 | } |
| 173 | |
| 174 | void BORINGSSL_FIPS_abort(void) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 175 | for (;;) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 176 | abort(); |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 177 | exit(1); |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 178 | } |
| 179 | } |
Robert Sloan | 978112c | 2018-01-22 12:53:01 -0800 | [diff] [blame] | 180 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 181 | #endif // BORINGSSL_FIPS |